4.2.1. Disk Encryption and VM Security Features
💡 First Principle: A VM's disk is a portable attack surface in a way its running memory isn't — a disk (or a snapshot of one) can be detached, copied, or accessed outside the running VM entirely, which is exactly the scenario disk encryption is designed to defeat, while secure boot and vTPM protect the boot process itself from tampering.
Disk encryption options include Azure Disk Encryption (BitLocker/DM-Crypt inside the guest OS) and encryption at host (encrypting the host-level infrastructure, covering temp disks and caches that guest-level encryption misses). Secure boot verifies that only signed, trusted bootloaders and OS components load during startup, preventing bootkit and rootkit attacks that try to compromise the OS before it's even running. A virtual Trusted Platform Module (vTPM) provides a virtualized hardware root of trust for operations like measured boot attestation and key storage. Integrity monitoring (via guest attestation) continuously verifies that boot integrity hasn't been tampered with after startup, catching a compromise that occurs post-boot rather than only at the moment of boot. Security type on a VM (Trusted launch, Confidential, or Standard) determines which of these protections are available and enabled together.
⚠️ Exam Trap: Secure boot and disk encryption protect against different threat models — secure boot stops a compromised or malicious bootloader from ever running, while disk encryption protects data confidentiality if the disk itself is extracted or accessed outside the running VM. A scenario about a stolen VHD file is a disk-encryption question; a scenario about a bootkit is a secure-boot question.
Reflection Question: Why does encryption at host cover risks that guest-level Azure Disk Encryption alone does not?
