AZ-500 Secure compute, storage, and databases Practice Question
A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?
⚠ Common exam trap
Candidates often confuse the 'enabledForDiskEncryption' property with RBAC roles or managed identity permissions, assuming that granting a role to the VM or service principal is sufficient, when in fact the platform requires this specific vault-level flag to be enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the key vault's 'enabledForDiskEncryption' property to true.
Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.
Why it's wrong here
The 'Reader' role is an Azure RBAC role that only grants management-plane visibility over the key vault's metadata, such as listing the vault and reading its properties; it does not permit any data-plane operations on the keys and secrets themselves. Azure Disk Encryption's service principal needs actual cryptographic key permissions — Get, WrapKey, and UnwrapKey — to perform envelope encryption and store the disk encryption secret. Without those, ADE cannot read the KEK or write the encryption secret, so granting 'Reader' is fundamentally insufficient for enabling ADE.
- ✓
Set the key vault's 'enabledForDiskEncryption' property to true.
Why this is correct
The 'enabledForDiskEncryption' boolean property on the key vault is a specific vault-level flag that tells Azure's compute platform that the vault is allowed to be used by the Azure Disk Encryption service. When set to true, it grants the ADE service (which runs as part of the Microsoft.Compute resource provider) the necessary access to read secrets and use keys wrapped in the vault during the encryption workflow. This is the standard prerequisite because neither a user-assigned identity nor a service principal with RBAC on the vault alone can suffice without this setting.
- ✗
Grant the virtual machine's managed identity 'Contributor' role on the key vault.
Why it's wrong here
The virtual machine's managed identity is used by applications running on the VM to authenticate to Azure services, but the 'Contributor' role is a management-plane RBAC role that grants full access to manage the key vault's resources, not to perform data-plane operations on keys. For ADE, the relevant permissions must be on the key vault's access policy (or data-plane RBAC) for the 'WrapKey', 'UnwrapKey', and 'Get' operations on the KEK, and those must be granted to the Azure Disk Encryption service, not the VM's identity. Assigning 'Contributor' is both too broad for the purpose and misplaced in scope, since the platform, not the VM, drives the encryption operation.
- ✗
Configure soft-delete and purge protection on the key vault.
Why it's wrong here
Soft-delete and purge protection are mandatory key vault lifecycle settings that protect encryption keys from being temporarily or permanently deleted, particularly when customer-managed keys are involved in Azure Disk Encryption. However, they operate at a different layer than access configuration: they do nothing to authorize or allow the Azure Disk Encryption platform to read, wrap, or unwrap the KEK. The question specifically asks for the access configuration needed to let the platform access the KEK, and while deletion protection is a prerequisite, it must be paired with the 'enabledForDiskEncryption' property plus appropriate access policies to actually enable ADE.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.