AZ-500 Secure compute, storage, and databases Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.

  Why this is correct

  Correct. Azure Disk Encryption (ADE) relies on the Azure Disk Encryption service principal (AzureDiskEncryption) to access your Key Vault. When a KEK is used, that service principal must be granted the 'unwrap key' and 'wrap key' permissions in the Key Vault's access policy; otherwise, the service cannot decrypt or re-encrypt the disk encryption key. The error you see is a classic permissions failure, not a network or identity issue, because the service principal lacks the required cryptographic operations on the vault's keys.

• ✗

  The Key Vault firewall is blocking the Azure platform.

  Why it's wrong here

  Incorrect. A Key Vault firewall that blocks the Azure platform would present a network connectivity failure, typically with an error such as 'Access denied due to network rules' or 'The operation is forbidden because of the network rules.' The scenario describes an error specifically about missing 'unwrap key' and 'wrap key' permissions, which is an authorization issue at the access policy level, not a connectivity issue. Furthermore, the question does not mention that the firewall is enabled, so you cannot assume it is the cause.

• ✗

  The VM does not have a managed identity assigned.

  Why it's wrong here

  Incorrect. Azure Disk Encryption does not use a VM-managed identity to access Key Vault. Instead, it uses the built-in Azure Disk Encryption service principal, a platform-level identity that is automatically provisioned in the subscription. Assigning a managed identity to the VM is unrelated to ADE's Key Vault access and would not change the permission error you are seeing, because the service principal's access policy is what controls the wrap and unwrap operations.

• ✗

  The KEK is in a different Azure region than the VM.

  Why it's wrong here

  Incorrect. The KEK's region is not related to the access policy permission error. Azure Disk Encryption requires the Key Vault to be in the same region as the VM for successful encryption, but a regional mismatch would surface as a deployment validation error (e.g., 'The vault is not in the same region as the disk') rather than a permissions error. The message you received points specifically to missing 'unwrap key' and 'wrap key' permissions for the service principal, so the KEK's location is not the root cause.