You have an Azure VM named VM1 and an Azure Key Vault named Vault1. You plan to enable Azure Disk Encryption on VM1 using a key encryption key (KEK). What two actions must you perform on Vault1 to prepare it for Azure Disk Encryption?

To enable Azure Disk Encryption with a KEK, you must first create the KEK within the Key Vault. This key will be used to encrypt the disk encryption keys. Additionally, you need to grant Azure Disk Encryption permission to access the Key Vault. This is done by enabling the "Azure Disk Encryption for volume encryption" access policy on the Key Vault, which allows the Azure Disk Encryption service to retrieve the KEK for encryption operations. Selecting "Azure Virtual machines for deployment" is for enabling Key Vault access for VM deployment, not disk encryption. Creating a new secret is for storing sensitive data, not for KEKs. Configuring a key rotation policy is a best practice but not a prerequisite for initial setup.