Deploy and manage Azure compute resources

To protect sensitive information such as an API key from being viewed in clear text after deployment, you should define the key and value using the secure environment variables configuration. In an ACI YAML template, this involves using the 'secureValue' property (instead of the standard 'value' property) for the specific environment variable entry within the environment variables list. When configured this way, the value is available to the application running inside the container but appears hidden or obscured when the container group properties are listed via the Azure Portal or CLI.

Placing the pair inside the standard environment variables list using plain numbers or strings allows the value to be read in clear text by anyone with access to the resource configuration. Embedding the key in the command line arguments is similarly insecure, as the command string is visible in the container properties. Finally, resource group metadata is used for tagging and organization, not for securely injecting runtime environment variables into container instances.

The correct action is to update the target regions of the image version to include West Europe.

Azure Compute Gallery (formerly Shared Image Gallery) is designed to facilitate the sharing and management of images across multiple regions. In order to deploy a virtual machine in a specific region, the image version data must reside in that region. You can achieve this by modifying the replication settings of the specific Image Version to include the desired target region (West Europe). Azure will then replicate the image content to that region, enabling the deployment.

Deploying a secondary gallery is unnecessary administrative overhead, as a single gallery can manage replication across regions. Moving the gallery resource to a global subscription scope is not a valid technical solution for data replication, as the resource itself must reside in a region and data distribution is handled via target regions. Exporting the managed disk manually creates a disjointed workflow that ignores the central management and replication benefits provided by the Azure Compute Gallery.

The correct action is to create a snapshot of the virtual machine disks. Enabling Azure Disk Encryption (ADE) modifies the data on the disks significantly. If the encryption process fails, gets interrupted, or encounters errors, there is a risk of data corruption or the Virtual Machine (VM) becoming unusable. Microsoft assumes that you have a backup or snapshot available to restore the VM to its previous state before running the encryption command.

Why the other answers are incorrect:
- Enabling purge protection on the Key Vault is a mandatory prerequisite for the Key Vault used with ADE to prevent accidental key loss, but it does not help recover the actual data residing on the VM disks if the encryption process itself causes corruption.
- Deallocating the virtual machine is not necessary because Azure Disk Encryption for Windows VMs supports online encryption (while the VM is running). Furthermore, deallocating does not create a backup of the data.
- Rotating access keys for the storage account is a general security practice but does not provide a recovery mechanism for a failed disk encryption operation.