Which setting should be enabled to require encrypted client connections?

1. ✓ A require_secure_transport (SSL enforcement) set to ON (correct answer)
2. B log_connections
3. C ssl_ciphers only
4. D pgcrypto extension

Shortcut: Enforcing SSL/TLS rejects unencrypted connections at the server. The client must then supply sslmode=require or stricter.