You are designing a data protection strategy for Azure virtual machines. All the virtual machines are in the Standard tier and use managed disks.
You need to recommend a solution that meets the following requirements:
-> The use of encryption keys is audited.
-> All the data is encrypted at rest always.
-> You manage the encryption keys, not Microsoft.
What should you include in the recommendation?
Click on the arrows to vote for the correct answer
A. B. C. D.D
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overviewThe recommended solution that meets the given requirements is Azure Disk Encryption (ADE), which uses the industry-standard BitLocker feature to encrypt virtual machine disks.
Explanation:
A. BitLocker Drive Encryption (BitLocker): BitLocker is a Windows feature that provides full disk encryption capabilities. It can be used to encrypt the virtual machine disks, but it does not meet all the given requirements. BitLocker does not offer centralized key management capabilities, and it is not designed for cloud-based virtual machines. Therefore, it does not allow you to manage the encryption keys, which is a requirement in this scenario.
B. Azure Storage Service Encryption: Azure Storage Service Encryption automatically encrypts the data stored in Azure Storage accounts. However, this solution does not apply to virtual machine disks. It only encrypts the data that is stored in Azure Storage, such as blobs, files, and queues.
C. Client-side encryption: Client-side encryption is a technique in which the data is encrypted before it is sent to the cloud. This approach allows you to manage the encryption keys, but it does not meet the requirement of auditing the use of encryption keys. Also, it requires additional efforts for key management and configuration, which may increase the complexity of the solution.
D. Azure Disk Encryption (ADE): ADE meets all the given requirements. It uses BitLocker to encrypt the virtual machine disks, which ensures that all the data is encrypted at rest always. It also supports centralized key management, allowing you to manage the encryption keys, which is required in this scenario. Moreover, it logs all the key usage and management operations, providing a complete audit trail of the encryption key usage.
In summary, Azure Disk Encryption is the recommended solution for encrypting virtual machine disks in Azure, providing the required capabilities to ensure secure, encrypted storage of data.