You have an Azure VM (VM1) that uses Azure Disk Encryption. To determine which Azure Key Vault contains the VM's encryption keys with minimal administrative effort, which PowerShell cmdlet should you run?

The Get-AzVMDiskEncryptionStatus cmdlet is the correct choice because it directly provides information about the encryption status of an Azure VM, including the associated Key Vault URI. This cmdlet is specifically designed to retrieve disk encryption details for a virtual machine. Get-AzKeyVaultKey retrieves keys from a specified Key Vault, but you wouldn't know which Key Vault to query initially. Get-AzKeyVault lists all Key Vaults in your subscription, requiring you to then manually search through each one for the relevant key, which is not minimal administrative effort. Get-AzDiskEncryptionSet retrieves information about Disk Encryption Sets, which are used for managing encryption at scale, but it doesn't directly link to a specific VM's encryption key location in a Key Vault.