Correct Answer: Azure Disk Encryption (ADE) with BitLocker/dm-crypt and customer-managed keys stored in Azure Key Vault
For CMK (customer-managed keys) on managed disks: use **Server-Side Encryption (SSE) with Customer-Managed Keys** via a Disk Encryption Set referencing keys in Azure Key Vault (or ...
Correct Answer
Azure Disk Encryption (ADE) with BitLocker/dm-crypt and customer-managed keys stored in Azure Key Vault
Why This Answer Is Correct
For CMK (customer-managed keys) on managed disks: use **Server-Side Encryption (SSE) with Customer-Managed Keys** via a Disk Encryption Set referencing keys in Azure Key Vault (or Managed HSM). Alternatively, **Azure Disk Encryption (ADE)** uses OS-level dm-crypt (Linux) or BitLocker (Windows) with keys wrapped in Key Vault. For double encryption, both can be layered. HANA native Data Volume Encryption encrypts at the application layer but doesn't satisfy regulatory requirements for "encryption at rest" at the infrastructure level. PMK (platform-managed keys) means Microsoft manages the keys — not compliant with CMK mandates.
This question evaluates your knowledge of High Availability — a core concept tested in Microsoft Certified: Azure for SAP Workloads Specialty (AZ-120). Understanding High Availability is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You are configuring SAP HANA System Replication (HSR) across two different Azure Availability Zones in the same region. What replication mode should you use to ensure zero data loss while minimizing the impact on the primary node's performance?
You are designing the network topology for an SAP landscape on Azure. To ensure high availability of the SAP ASCS/SCS instance across two VMs in an availability set, what networking component is required to route traffic to the active node?
When configuring a SUSE Linux Enterprise Server (SLES) Pacemaker cluster for SAP ASCS High Availability in Azure, what resource is used to reliably fence (STONITH) a failed node?
You are migrating a legacy SAP ECC system running on Windows Server to Azure. You want to ensure the VMs automatically restart on healthy hardware if an underlying Azure host fails. What is this capability called?
Your organization uses Azure Active Directory (Entra ID) for authentication. You want to configure Single Sign-On (SSO) for your SAP Fiori launchpad. Which standard protocol is natively supported by both SAP Fiori (ABAP front-end) and Azure AD for this purpose?