DP-300 Implement a secure environment Practice Question
Your company is planning to migrate on-premises SQL Server databases to Azure SQL Managed Instance. The security team requires that all database connections be encrypted and that the server's identity be verified using a certificate from a trusted public certificate authority (CA). What should you configure?
⚠ Common exam trap
Many exam-takers confuse encryption in transit (Force Encryption/TLS) with encryption at rest (TDE) or column-level encryption (Always Encrypted), and mistakenly think a custom CA certificate is needed when Azure SQL Managed Instance already uses a trusted public CA certificate by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the 'Force Encryption' property to True for the managed instance.
Setting 'Force Encryption' to True on the managed instance enforces TLS encryption for all client connections and ensures the server presents a certificate from a trusted public CA to verify its identity. This meets both requirements: encryption of data in transit and server identity verification via a trusted certificate chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the 'Force Encryption' property to True for the managed instance.
Why this is correct
Correct: This ensures encryption for all connections, and the server certificate is from a trusted CA.
- ✗
Install a custom CA-signed certificate on the managed instance.
Why it's wrong here
Incorrect: You cannot install custom certificates on Azure SQL Managed Instance.
- ✗
Enable Transparent Data Encryption (TDE) with a server certificate.
Why it's wrong here
Incorrect: TDE protects data at rest, not in transit.
- ✗
Configure Always Encrypted with column master key in Key Vault.
Why it's wrong here
Incorrect: Always Encrypted encrypts specific columns, not the connection.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Managed Instance
Azure SQL Managed Instance is a fully managed cloud database service that gives you nearly all the features of Microsoft SQL Server on your own server, without you having to manage the hardware or operating system.
About these practice questions
Courseiva writes every DP-300 question from scratch — 906 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.