A customer requires VM encryption.

Which action must be taken to provide this feature?

A. Upgrade the vCenter Server to at least version 7.0.

B. Encrypt the VM directly from vCenter Server, as it is transparent to VMware Cloud Director.

C. In the vCenter Server, add a KMS > enable encryption policy > in VMware Cloud Director, add policy to Provide VDC > add policy to Organization VDC.

D. Add a KMS to VMware Cloud Director > create encryption policy > add policy to Organization VDC.

Explanation:
Available in vSphere 7.0 and later, the vSphere Trust Authority trusted key provider makes access to the encryption keys conditional to the attestation state of a workload cluster. vSphere Trust Authority requires an external key server.

Reference:
https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html