Quick Answer
The correct answer is to set 'Force encryption' to 'Yes' on the server. This setting enforces encrypted connections to Azure SQL Database by mandating that all client connections use Transport Layer Security (TLS), rejecting any unencrypted attempts. It directly controls encryption in transit, ensuring data is protected as it moves between the client and the database, which is distinct from encryption at rest or auditing features. On the Microsoft Azure Database Administrator Associate DP-300 exam, this concept tests your understanding of securing data in motion, often appearing in scenarios where you must differentiate between server-level and database-level settings. A common trap is confusing this with the 'Encrypt connection' option in client drivers, which is a client-side request rather than a server-side enforcement. Memory tip: think of the server as the bouncer—set 'Force encryption' to 'Yes' to reject any connection that doesn't show a valid TLS ID.
This DP-300 practice question tests your understanding of implement a secure environment. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You need to ensure that all connections to an Azure SQL Database are encrypted. Which setting should you enforce?
Configure firewall rules to allow only specific IP addresses.
Why wrong: Firewall rules control access, not encryption.
Set 'Force encryption' to 'Yes' on the server.
This setting enforces encrypted connections to the database.
Enable Transparent Data Encryption (TDE).
Why wrong: TDE encrypts data at rest, not in transit.
Enable SQL Auditing.
Why wrong: Auditing logs activity, not encrypts connections.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Set 'Force encryption' to 'Yes' on the server.
Option B is correct because setting 'Force encryption' to 'Yes' on the Azure SQL Database server enforces TLS encryption for all client connections. This setting ensures that any client connecting to the database must use an encrypted connection, rejecting any unencrypted attempts. It is the direct mechanism to mandate encryption in transit, as opposed to encryption at rest or auditing.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Configure firewall rules to allow only specific IP addresses.
Why it's wrong here
Firewall rules control access, not encryption.
Set 'Force encryption' to 'Yes' on the server.
Why this is correct
This setting enforces encrypted connections to the database.
Related concept
Read the scenario before looking for a memorised answer.
Enable Transparent Data Encryption (TDE).
Why it's wrong here
TDE encrypts data at rest, not in transit.
Enable SQL Auditing.
Why it's wrong here
Auditing logs activity, not encrypts connections.
Common exam traps
The trap here is confusing encryption in transit (TLS/SSL) with encryption at rest (TDE), leading candidates to select TDE when the question specifically asks about securing connections.
Detailed technical explanation
When 'Force encryption' is set to 'Yes', the server rejects any connection that does not use TLS, typically by refusing the initial handshake if the client does not request encryption. This setting works in conjunction with the client-side 'Encrypt=True' option in connection strings; if the server enforces encryption, clients without encryption will fail to connect. In Azure SQL Database, this is configured at the server level via the Azure portal or T-SQL, and it applies to all databases on that logical server.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implement a secure environment — study guide chapter
Learn the concepts, then practise the questions
Implement a secure environment practice questions
Targeted practice on this topic area only
All DP-300 questions
953 questions across all exam domains
Microsoft Azure Database Administrator Associate DP-300 study guide
Full concept coverage aligned to exam objectives
DP-300 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise DP-300 questions linked to Plan and configure a high availability and disaster recovery environment.
Practise DP-300 questions linked to Plan and implement data platform resources.
Practise DP-300 questions linked to Monitor, configure, and optimize database resources.
Practise DP-300 questions linked to Configure and manage automation of tasks.
Practise DP-300 questions linked to Plan and configure high availability and disaster recovery.
Practise DP-300 questions linked to Implement a secure environment.
Practise DP-300 questions linked to DP-300 fundamentals.
Practise DP-300 questions linked to DP-300 scenario.
Practise DP-300 questions linked to DP-300 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
The correct answer is: Set 'Force encryption' to 'Yes' on the server. — Option B is correct because setting 'Force encryption' to 'Yes' on the Azure SQL Database server enforces TLS encryption for all client connections. This setting ensures that any client connecting to the database must use an encrypted connection, rejecting any unencrypted attempts. It is the direct mechanism to mandate encryption in transit, as opposed to encryption at rest or auditing.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are implementing a new Azure SQL Database and need to ensure that connections from client applications are encrypted using TLS 1.2 or higher. Which server-level firewall rule setting should you configure?
easyWhy D: Option D is correct because the 'Minimal TLS version' server-level firewall rule setting enforces the minimum TLS version for encrypted connections to Azure SQL Database. By setting this to 1.2, the server will reject any connection attempts using TLS 1.0 or 1.1, ensuring all client applications use TLS 1.2 or higher. This setting is configured in the Azure portal under the 'Networking' blade of the SQL server resource.
Variation 2. You have a new Azure SQL Database. You need to ensure that all connections use TLS 1.2 or higher. What should you configure?
easyWhy A: Option B is correct because Azure SQL Database has a server-level setting to enforce minimum TLS version. Option A is wrong because there is no database-level TLS setting. Option C is wrong because the firewall does not control encryption protocols. Option D is wrong because auditing is unrelated.
Last reviewed: Jun 11, 2026
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.