AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Set the Key Vault access policy to grant the Azure Disk Encryption service the required permissions. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

  Why this is correct

  This sequence is correct because Azure Disk Encryption (ADE) requires a Key Vault with soft-delete and purge protection to exist before you can grant the ADE service permission to access the key encryption key or disk encryption key. Setting the Key Vault access policy after creating the vault ensures the service principal has the required 'get', 'wrapKey', and 'unwrapKey' permissions when the encryption operation begins. Only after these prerequisites are satisfied can you successfully enable encryption on the Windows VM by referencing the configured Key Vault and key.

• ✗

  1. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Enable disk encryption on the Windows VM, specifying the Key Vault and key.

  Why it's wrong here

  This order is invalid because you cannot set a Key Vault access policy on a vault that has not yet been created; the Key Vault resource must exist in Azure before any access policy can be assigned. Even if the access policy step were somehow deferred, Azure Disk Encryption would fail at the encryption operation because the service lacks permission to access the vault. Moreover, the Key Vault's soft-delete and purge protection settings must be configured at creation time, not after the fact, so creating the vault after setting an access policy is logically impossible.

• ✗

  1. Create or configure an Azure Key Vault with soft-delete and purge protection. 2. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

  Why it's wrong here

  This order fails because enabling disk encryption before the Key Vault access policy is configured will cause the encryption process to error out when the Azure Disk Encryption service attempts to wrap the disk encryption key using the key in the vault. The access policy must be in place before the encryption operation starts so the ADE service principal has the necessary permissions to read, wrap, and unwrap the key. Although the Key Vault is created first, skipping the permission-granting step is the critical omission that breaks the prerequisite chain.

• ✗

  1. Enable disk encryption on the Windows VM, specifying the Key Vault and key. 2. Create or configure an Azure Key Vault with soft-delete and purge protection. 3. Set the Key Vault access policy to grant the Azure Disk Encryption service permissions.

  Why it's wrong here

  This order is fundamentally incorrect because Azure Disk Encryption cannot be enabled without an already-existing, properly configured Key Vault, so attempting to enable encryption first will fail immediately. The Key Vault must be created first with soft-delete and purge protection enabled, and then the access policy must be set to grant the Azure Disk Encryption service the required key and secret permissions. Only after these two prerequisites are satisfied can you successfully run the encryption operation on the VM; any other order violates the dependency sequence.

Go deeper

Related to this question