Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How BitLocker Secures Azure Data Box Disk
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise plans to migrate 20 TB of sensitive on-premises files to Azure Blob storage using Azure Data Box Disk. The company's compliance policy mandates that all data copied onto the physical migration drives must be protected using industry-standard software encryption before transit.
Which software encryption technology is used by Azure Data Box Disk to secure the data?
Explanations
Azure Storage Server-Side Encryption (SSE)
Azure Storage Server-Side Encryption (SSE)
What Azure Storage Server-Side Encryption (SSE) Is
Server-Side Encryption (SSE) is an automatic encryption feature provided natively by Azure Storage that encrypts all data at the storage service level as it is written to cloud storage disks, utilizing platform-managed or customer-managed encryption keys.
Why It Doesn't Meet the Requirement
- Protects Data in Cloud Storage: Server-Side Encryption protects data once it arrives in the cloud and is committed to Azure Storage services (such as Azure Blob Storage or Azure Managed Disks).
- Does Not Encrypt Offline Transit Disks: SSE does not encrypt the physical disks when they are detached and transported physically via courier from an on-premises datacenter.
Key Characteristics and Limitations
- Enabled by default with platform-managed keys across all Azure storage accounts and managed disks.
- Cannot be disabled on Azure Managed Disks or Azure Storage accounts.
- Operates at the Azure service layer rather than on local client hardware during file copy.
This Answer Would Be Correct If
The question asked which encryption mechanism automatically protects cloud data at rest after it has been ingested into an Azure Managed Disk or Azure Storage Account.
Transparent Data Encryption (TDE)
Transparent Data Encryption (TDE)
What Transparent Data Encryption (TDE) Is
Transparent Data Encryption (TDE) is a database-level security feature used in systems like Azure SQL Database, Azure SQL Managed Instance, and SQL Server to encrypt database data files, log files, and backup files at rest.
Why It Doesn't Meet the Requirement
- Database Scope Only: TDE operates within the database engine and protects database files rather than underlying physical removable storage media or general file systems.
- Not an Offline Migration Tool Mechanism: TDE does not manage or secure physical hardware volumes used during Azure Data Box data transfer jobs.
Key Characteristics and Limitations
- Encrypts SQL Server and database files at rest automatically without altering application code.
- Uses a database encryption key (DEK) protected by a server certificate or Azure Key Vault.
- Cannot be applied to encrypt file shares, raw disks, or unformatted block volumes directly.
This Answer Would Be Correct If
The scenario involved securing relational database data files at rest automatically inside an Azure SQL Database or SQL Server instance.
Azure Disk Encryption (ADE)
Azure Disk Encryption (ADE)
What Azure Disk Encryption (ADE) Is
Azure Disk Encryption (ADE) is an Azure security feature designed to encrypt the OS and data disks of running Azure Virtual Machines (IaaS VMs) using BitLocker on Windows VMs or DM-Crypt on Linux VMs, integrated with Azure Key Vault.
Why It Doesn't Meet the Requirement
- Applies to Cloud Virtual Machines: ADE is designed specifically for existing cloud-hosted virtual machine disks running in Azure infrastructure rather than physical offline appliances shipped to customer datacenters.
- Not for Offline Transit Disks: ADE does not manage the software encryption workflow on physical Data Box Disks connected locally to on-premises copy workstations.
Key Characteristics and Limitations
- Integrates directly with Azure Key Vault to store and manage disk encryption keys and secrets for running VMs.
- Requires virtual machine extension agents to manage key acquisition and volume mounting inside cloud VMs.
- Does not provide the standalone passkey unlocking utilities utilized during on-premises Data Box copying.
This Answer Would Be Correct If
The organization needed to configure encryption on the operating system and data disks of live Azure Virtual Machines using keys stored in Azure Key Vault.
BitLocker encryption
BitLocker encryption
What BitLocker Encryption Is
BitLocker is a native volume encryption feature developed by Microsoft that provides data protection by encrypting entire physical storage volumes using robust AES (Advanced Encryption Standard) encryption algorithms.
How It Meets the Compliance and Security Requirements
When utilizing Azure Data Box Disk, software-based disk encryption is powered by BitLocker technology:
- Protection in Transit: Every disk provided in the order is encrypted using BitLocker, ensuring that data copied onto the physical drive remains inaccessible without the authorized passkey while in transit between the customer site and the Azure datacenter.
- Passkey Protection: The disks can be unlocked using an Azure-generated passkey or a custom passkey specified during order creation, ensuring secure access during data copy.
- Cross-Platform Support: BitLocker-encrypted Data Box Disks can be connected to either Windows or Linux systems using standard USB or SATA connections.
Key Advantages and Capabilities
- Pre-configured Security: Disks arrive pre-encrypted, preventing plain-text data from ever resting unencrypted on physical storage.
- Strict Access Control: Disks require a 12-to-32 character alphanumeric passkey to unlock.
- Data Ingestion Integrity: After arrival at Microsoft datacenters, data is uploaded securely to Azure Storage and the physical disks are securely erased following NIST SP 800-88 standards.
- Zero Network Exposure: Eliminates bandwidth bottlenecks and vulnerabilities associated with public Internet data transfer.
Why This Is Optimal
BitLocker is the standard built-in software encryption mechanism for Azure Data Box Disk, requiring no additional proprietary third-party software while offering enterprise-grade encryption at rest and in transit.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Data Box Offline Data Transfer
Describe migration options, including Azure Migrate and Azure Data Box
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Migrate
Describe migration options, including Azure Migrate and Azure Data Box
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Data Box with Azure Storage Mover
Describe migration options, including Azure Migrate and Azure Data Box
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Data Box Heavy vs Data Box
Describe migration options, including Azure Migrate and Azure Data Box
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Infrastructure as a Service (IaaS)
Define cloud computing
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated