AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure Managed Disks for their virtual machines. They want to ensure that all managed disks are encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also want to automatically revoke access to the disks if the key is disabled or deleted. Which feature should they configure?
⚠ Common exam trap
Many candidates confuse Azure Disk Encryption (ADE) with server-side encryption (SSE-CMK), mistakenly thinking ADE provides automatic access revocation when the key is disabled, whereas ADE only encrypts at the guest OS level and does not enforce platform-level access control based on key state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with customer-managed keys (SSE-CMK)
Server-side encryption with customer-managed keys (SSE-CMK) encrypts Azure Managed Disks at rest using a key stored in Azure Key Vault. When the key is disabled or deleted, Azure automatically revokes access to the disk by failing any I/O operations that require that key, ensuring the disk becomes inaccessible. This directly meets the requirement for both CMK-based encryption and automatic access revocation upon key loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Disk Encryption (ADE) with a Key Encryption Key (KEK)
Why it's wrong here
Azure Disk Encryption (ADE) with a Key Encryption Key (KEK) uses BitLocker (Windows) or dm-crypt (Linux) to encrypt VM disks from inside the guest OS, requiring a VM extension or agent installation and an encrypted OS-boot process. While the KEK can be disabled or deleted in Key Vault to revoke access, the encryption is not integrated with the Azure managed-disk control plane; revocation may require guest-side actions (e.g., remount or reboot) and does not protect the underlying disk infrastructure. For the stated requirement—native, infrastructure-level encryption with key revocation—ADE is a valid alternative but is operationally heavier and less integrated than SSE-CMK.
- ✓
Server-side encryption with customer-managed keys (SSE-CMK)
Why this is correct
Server-side encryption with customer-managed keys (SSE-CMK) is the native Azure managed-disk encryption feature that encrypts disk data at rest using a customer-provided key from Azure Key Vault or a managed HSM. Because the managed-disk service must unwrap the disk encryption key from the CMK for every attach and I/O operation, disabling or deleting the CMK makes the disk inaccessible and fully satisfies the key-revocation requirement without any in-VM agent or manual configuration. This approach works at the platform layer, applying encryption to all writes sent to the disk, and is the preferred way to achieve both encryption at rest and customer-controlled revocation.
- ✗
Azure Storage Service Encryption (SSE) with platform-managed keys
Why it's wrong here
Azure Storage Service Encryption (SSE) with platform-managed keys is the default encryption for managed disks: all data is encrypted at rest using Microsoft-managed keys, which are transparently rotated and never exposed to the customer. This ensures confidentiality against raw disk theft but offers no customer control and no ability to revoke the encryption key on demand, because the customer never owns or manages the key material. The requirement explicitly asks for a revocation capability, so platform-managed keys are insufficient.
- ✗
Azure Key Vault soft-delete and purge protection
Why it's wrong here
Azure Key Vault soft-delete and purge protection are security controls that prevent accidental or malicious permanent deletion of keys by placing a deleted key in a recoverable state for a retention period and disallowing immediate purge. These features do not encrypt managed disks by themselves; they only protect the lifecycle of the key material used by an encryption feature such as SSE-CMK. While enabling them is a prerequisite for using customer-managed keys for managed disks, they are not the feature that performs encryption or revokes access to disk data, so they do not meet the stated requirement.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.