AZ-500 Secure compute, storage, and databases Practice Question
You need to ensure that Azure SQL Database connections are encrypted and the server's identity is verified. Which connection string parameter should be required?
⚠ Common exam trap
Many candidates assume `TrustServerCertificate=True` is sufficient for security, not realizing that it disables server identity verification, which is a critical component of a secure TLS connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt=True; TrustServerCertificate=False
Setting `Encrypt=True` forces TLS encryption for all data in transit between the client and Azure SQL Database, while `TrustServerCertificate=False` ensures that the server's TLS certificate is validated against a trusted certificate authority (CA). This combination provides both encryption and server identity verification, which is required for secure connections to Azure SQL Database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt=Optional
Why it's wrong here
Encrypt=Optional tells the client to attempt TLS encryption but to silently fall back to an unencrypted channel if the server does not support or require it. Because authentication and data confidentiality are only conditional, this setting does not guarantee that the SQL database connection is actually encrypted in transit. For a security-critical environment, you must use 'Encrypt=True' to enforce encryption, rather than leaving it to the server's capabilities.
- ✓
Encrypt=True; TrustServerCertificate=False
Why this is correct
This is the correct configuration for Azure SQL Database. Encrypt=True forces the client to use TLS for all data sent over the network, while TrustServerCertificate=False requires the client to validate the server's TLS certificate against a trusted root CA. Azure SQL Database's certificate chains are issued from trusted public CAs, so validation succeeds and the connection is both encrypted and protected against man-in-the-middle attacks.
- ✗
TrustServerCertificate=True
Why it's wrong here
Setting TrustServerCertificate=True disables critical certificate validation, telling the client to accept any server certificate without checking whether it was issued by a trusted authority. Because it does not require encryption on its own, this setting is both insecure and incomplete; even if combined with Encrypt=True, it would permit an attacker to impersonate the SQL Server. You should always leave TrustServerCertificate=False so the server's identity is verified.
- ✗
Encrypt=False
Why it's wrong here
Encrypt=False explicitly disables TLS encryption, meaning that all queries and result sets are transmitted in clear text across the network. This allows any observer with network access to read sensitive data, including passwords and business data, and completely defeats the purpose of securing an Azure SQL Database connection. In Azure SQL Database, you should never use Encrypt=False, as it violates the principle of secure, encrypted communication.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.