Azure Disk Encryption artifacts (such as the BitLocker/DM-Crypt encryption keys) can be protected in Key Vault by a software-protected key or by a hardware-protected key. Choosing ' key ' (rather than ' certificate ' or ' secret ' ) creates a cryptographic key object that can be used as a key-encryption key to wrap the disk encryption secret before it is written to the vault. Specifying --kty RSA-HSM (as opposed to plain RSA) ensures the key material is generated and protected inside a FIPS 140-validated hardware security module rather than in software, which is the highest level of protection Key Vault offers for this purpose. This matches the completed command shown in the exhibit, and Vault1 must be a Premium-tier vault for the RSA-HSM key type to be available, since HSM-backed keys are not supported on the Standard vault tier. Once artifact1 exists as an RSA-HSM key, its key identifier is supplied to Set-AzVMDiskEncryptionExtension as the key-encryption key parameter so that every BitLocker protector secret written to Vault1 is wrapped by it before storage.