Azure Disk Encryption Components for Windows VMs: BitLocker, KEK, and VEK
Which THREE components are part of Azure Disk Encryption for Windows VMs?
Quick Answer
The correct answer is Azure Key Vault with Volume Encryption Key (VEK), BitLocker, and Key Encryption Key (KEK). Azure Disk Encryption for Windows VMs relies on BitLocker to perform the actual volume-level encryption, while the Volume Encryption Key (VEK) protects the encrypted data and is itself safeguarded by a Key Encryption Key (KEK) stored in Azure Key Vault, which also securely holds the VEK. On the AZ-500 exam, this question tests your understanding of the specific encryption chain for Windows versus Linux—a common trap is confusing DM-Crypt (used only for Linux) with BitLocker, or mistakenly including Azure AD as a component. Remember that Azure AD handles authentication, not encryption components. A useful memory tip: think of the KEK as a master key that wraps the VEK, with BitLocker as the enforcer on the disk, all stored in Key Vault—this trio is the core of Azure Disk Encryption for Windows.
⚠ Common exam trap
Test-takers frequently confuse DM-Crypt with BitLocker, mistakenly selecting DM-Crypt for Windows VMs, or they incorrectly assume Microsoft Entra ID is a required component of the encryption process rather than understanding it is only used for authentication in specific scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BitLocker Drive Encryption
BitLocker Drive Encryption is the correct component because Azure Disk Encryption for Windows VMs leverages BitLocker to provide volume-level encryption for the OS and data disks. BitLocker is the native Windows technology that encrypts the entire volume, ensuring data at rest is protected within Azure managed disks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DM-Crypt
Why it's wrong here
DM-Crypt is for Linux VMs.
- ✗
Microsoft Entra ID (Azure AD)
Why it's wrong here
Entra ID is for authentication, not encryption.
- ✓
BitLocker Drive Encryption
Why this is correct
BitLocker is used for Windows VMs.
- ✓
Azure Key Vault with Key Encryption Key (KEK)
Why this is correct
KEK is used to protect the VEK.
- ✓
Azure Key Vault with Volume Encryption Key (VEK)
Why this is correct
VEK is the actual encryption key.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO components are required to enable Azure Disk Encryption for Windows VMs using Azure Key Vault? (Choose two.)
hard- ✓ A.Azure Key Vault with an access policy granting permissions to the Azure Disk Encryption service
- B.A key encryption key (KEK) in Azure Key Vault
- C.A Recovery Services vault
- D.A storage account to store the encryption logs
- ✓ E.The Azure Disk Encryption extension installed on the VM
Why A: Azure Disk Encryption for Windows VMs requires two mandatory components: Azure Key Vault with an access policy that grants the Azure Disk Encryption service (Microsoft.Azure.Security) permissions to read keys and secrets, and the Azure Disk Encryption extension installed on the VM. A key encryption key (KEK) is optional and used for an additional layer of security, but it is not required for encryption to succeed. A Recovery Services vault is used for Azure Backup, not encryption, and a storage account for encryption logs is not required.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.