In which key vaults can you store the encryption key for VM1?

You have an Azure subscription named Sub1 that contains the Azure key vaults shown in the following table:

In Sub1, you create a virtual machine that has the following configurations:

✑ Name: VM1

✑ Size: DS2v2

✑ Resource group: RG1

✑ Region: West Europe

✑ Operating system: Windows Server 2016

You plan to enable Azure Disk Encryption on VM1.

In which key vaults can you store the encryption key for VM1?
A . Vault1 or Vault3 only
B . Vault1, Vault2, Vault3, or Vault4
C . Vault1 only
D . Vault1 or Vault2 only

Answer: A

Explanation:

In order to make sure the encryption secrets don’t cross regional boundaries, Azure Disk Encryption needs the Key Vault and the VMs to be co-located in the same region. Create and use a Key Vault that is in the same region as the VM to be encrypted.

Reference: https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites