A confidential session-host VM was created without the confidential OS disk encryption arrangement now required by a customer. The customer asks to change that confidential encryption setting on the existing VM. What should the deployment plan do?

✓ Correct answer

• Plan a replacement confidential VM created with the required supported encryption configuration and controlled data migration.

Confidential OS disk encryption must be chosen at VM creation and cannot be changed afterward. A replacement plan should select a supported key/image arrangement and handle application and data migration deliberately. Option explanations: A. Plan a replacement confidential VM created with the required supported encryption configuration and controlled data migration.: Creating a compatible replacement with the correct setting addresses the creation-time requirement. B. Enable Controlled Folder Access so the existing OS disk becomes confidentially encrypted.: CFA restricts untrusted file modifications; it does not encrypt the VM's OS disk. C. Enable Secure Boot on the existing VM and treat it as confidential disk encryption.: Secure Boot protects boot integrity and does not change the existing confidential disk encryption arrangement. D. Change an AVD host-pool RDP property to enable the requested disk encryption.: RDP properties configure connection behavior, not the immutable confidential OS disk encryption setting. Sources: About Azure confidential VMs — https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview

Read the source reference