A regulated customer requires that all connections to its Azure SQL logical server use at least TLS 1.2, and that older protocol versions be rejected. Which server setting should the administrator configure?
Show answer and explanation
Answer: C
The minimal TLS version setting on an Azure SQL logical server controls the lowest TLS protocol version the server accepts from clients. Setting it to 1.2 causes connections that negotiate older versions to be refused, which meets the regulated customer's requirement for encryption in transit. The other options protect data at rest, encrypt individual columns, or hide values from non-privileged users, and none of them controls the protocol version used for connections.
Why the other options are wrong
- A. Transparent Data Encryption encrypts database files and backups at rest. It does not restrict which TLS version clients use to connect, so the requirement for in-transit protocol enforcement would remain unmet.
- B. Always Encrypted protects specific column values from database administrators, but it does not affect the protocol used for client connections. Older TLS versions would still be accepted by the server.
- D. Dynamic Data Masking changes what non-privileged users see in query results. It has no bearing on the TLS version a client negotiates, so it cannot satisfy the connection requirement.