Secure, monitor, and optimize data storage and data processing →mediumMultiple ChoiceObjective-mapped
Secure Data Transfer with Encryption in Transit in Azure Data Factory
You are designing an Azure Data Factory pipeline to ingest data from an on-premises SQL Server into Azure Synapse Analytics. The data must be encrypted in transit. Which integration runtime type should you use and what additional configuration is required?
Quick Answer
The answer is to use a Self-hosted Integration Runtime with a certificate for HTTPS. This is correct because a self-hosted IR is the only integration runtime type that can establish a connection to on-premises networks, and applying a certificate enables HTTPS encryption to secure data in transit between your on-premises SQL Server and Azure. On the DP-203 exam, this scenario tests your understanding of how Azure Data Factory handles hybrid connectivity and encryption at the application layer, often appearing as a distractor where candidates mistakenly choose Azure IR (which cannot access on-premises) or network-level solutions like ExpressRoute or VPN Gateway that don’t provide application-layer encryption. A common trap is assuming private network connectivity alone satisfies encryption in transit requirements, but ADF still needs the self-hosted IR with a certificate for HTTPS. Memory tip: think “On-prem needs Self, and Self needs Cert” to recall that on-premises data movement requires the self-hosted IR and a certificate for transport layer security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Self-hosted Integration Runtime with a certificate for HTTPS
A self-hosted integration runtime is required to connect to on-premises networks. To encrypt data in transit, a certificate must be configured for HTTPS encryption. Option A is wrong because Azure Integration Runtime cannot directly access on-premises data sources. Option B is incorrect because Azure VPN Gateway provides network-level connectivity but does not handle application-layer encryption; the self-hosted IR still needs a certificate. Option D is wrong because using a public endpoint does not ensure encryption in transit without additional configuration, and Azure IR still cannot access on-premises directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Integration Runtime with ExpressRoute
Why it's wrong here
ExpressRoute provides private connectivity but does not encrypt ADF data in transit.
- ✗
Use Self-hosted Integration Runtime with Azure VPN Gateway
Why it's wrong here
VPN Gateway is network-level; self-hosted IR still needs certificate for application-layer encryption.
- ✓
Use Self-hosted Integration Runtime with a certificate for HTTPS
Why this is correct
Self-hosted IR with certificate encrypts data in transit.
- ✗
Use Azure Integration Runtime with a public endpoint
Why it's wrong here
Azure IR cannot access on-premises SQL Server without a gateway.
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Data Transformation Pipelines
Data transformation pipelines are automated sequences of steps that take raw data from a source, clean and reshape it into a usable format, and then load it into a destination for analysis or storage.
Key term
Azure Synapse Analytics
Azure Synapse Analytics is a cloud-based data integration, warehousing, and analytics service that brings together big data and data warehouse capabilities under one platform.
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a data pipeline in Azure Data Factory that processes streaming data from Azure Event Hubs and stores it in Azure Data Lake Storage Gen2. The data must be encrypted at rest and in transit. Which configuration ensures encryption in transit?
easy- A.Enable encryption at rest using Azure Storage Service Encryption.
- ✓ B.Use HTTPS endpoint for Azure Data Lake Storage Gen2.
- C.Configure the Azure Data Factory integration runtime to use TLS 1.2.
- D.Deploy Azure Firewall to inspect traffic between Event Hubs and Data Lake.
Why B: HTTPS ensures encryption in transit for Azure Data Lake Storage Gen2. Option A is wrong because encryption at rest does not cover data in transit. Option C is wrong because while TLS 1.2 is important, the integration runtime configuration does not directly apply to the storage endpoint; the storage account itself must use HTTPS. Option D is wrong because Azure Firewall does not provide encryption; it filters traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.