A financial analytics platform must protect sensitive data in use. Some workloads run as Linux containers on AKS, while others run on VMs. You must use hardware-based Trusted Execution Environments, support remote attestation before workloads run, and minimize code changes. What should you implement?

The correct solution uses Confidential VMs (like DCasv5/ECasv5 with AMD SEV-SNP) for hardware-based Trusted Execution Environments (TEEs) to protect data in use. Enabling confidential containers (Kata Confidential Containers) on AKS extends this protection to containerized workloads. Microsoft Azure Attestation provides remote attestation, verifying the integrity of the TEE and its loaded code before workloads execute, which is crucial for sensitive data. This approach minimizes code changes as the protection is largely infrastructure-based. Incorrect options: Standard Dv5 VMs with disk encryption and TLS protect data at rest and in transit, but not data in use within the CPU/memory. Dedicated Hosts and customer-managed keys enhance isolation and data at rest security but do not provide TEEs or data-in-use protection. Azure Confidential Ledger is for tamper-proof logging, not for protecting application runtime memory. GPU-optimized VMs are for compute-intensive tasks, and while Shielded VMs offer some protection, they don't provide the same level of TEE-based data-in-use protection or attestation required.