AZ-500 Secure compute, storage, and databases Practice Question
Your company uses Azure SQL Managed Instance. You need to ensure that all connections from clients use TLS 1.2 or higher. What should you configure?
⚠ Common exam trap
Many candidates confuse 'Force encryption' (which only ensures encryption, not a specific TLS version) with the 'Minimal TLS version' setting, or mistakenly think Azure Policy or firewall rules can directly control TLS protocol negotiation at the connection level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings
Azure SQL Managed Instance exposes a 'Minimal TLS version' property in its settings that enforces the minimum TLS version for all client connections. Setting this to 1.2 ensures that any connection attempt using TLS 1.0 or 1.1 is rejected at the server level, providing a centralized, server-side enforcement mechanism without relying on client-side configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings
Why this is correct
The Minimal TLS version property on Azure SQL Managed Instance is the native server-side setting that enforces the lowest TLS protocol accepted for client connections. Setting it to 1.2 rejects any handshake attempt using TLS 1.0 or 1.1 before the session is established, independent of the client driver or connection string. This is the only direct control that guarantees all connections use at least TLS 1.2.
- ✗
Configure a firewall rule to block non-TLS 1.2 connections
Why it's wrong here
Firewall rules in Azure SQL Managed Instance are purely IP-based access controls that evaluate source addresses against allowed ranges. They operate at the network layer and have no visibility into the TLS handshake or the negotiated protocol version. Since the firewall permits or blocks the connection before any TLS negotiation occurs, it cannot selectively block non-TLS 1.2 connections.
- ✗
Create an Azure Policy to require TLS 1.2 for all SQL Managed Instances
Why it's wrong here
Azure Policy evaluates and enforces Azure Resource Manager resource properties, but the TLS version setting for SQL Managed Instance is contained within the database engine and is not exposed as an ARM property. As a result, an Azure Policy initiative can audit the instance's configuration only if the property exists, which it does not for this specific setting. Policy cannot directly modify the instance's TLS minimum because no built-in definition targets this property, so it cannot enforce TLS 1.2.
- ✗
Enable the 'Force encryption' option on the client side
Why it's wrong here
Enabling Force Encryption on the client side ensures the connection is encrypted via TLS, but it does not specify which TLS version is used during negotiation. TLS 1.0, 1.1, and 1.2 are all valid encrypted protocols, so a client with Force Encryption can still complete a handshake over an older version. The setting only mandates encryption, not the minimum protocol version, leaving TLS 1.2 unenforced.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.