Signature-based rules match known attack patterns, such as SQL injection syntax, within HTTP requests and drop matching traffic before it reaches the web server. This satisfies the requirement to detect and block typical SQL injection payloads.
Why this answer
Signature-based detection rules match HTTP request payloads against known attack patterns — regex or token sequences characteristic of SQL injection, such as ' OR 1=1--, UNION SELECT, or encoded variants. A WAF in front of an online banking portal uses these signatures (e.g., ModSecurity CRS rules 942100, 942110) to inspect parameters, headers, and bodies, then drop matching requests before they reach the origin server. This is the classic negative-security model that blocks known-bad inputs.
Exam trap
The trap is conflating 'detecting SQLi patterns' with anomaly/ML detection — candidates overthink and pick behavioral profiling when the question explicitly describes matching known attack patterns.
How to eliminate wrong answers
Option A is wrong because TCP handshake stateful inspection only validates the three-way handshake and connection state — it has no visibility into application-layer SQL syntax. Option B is wrong because behavioral anomaly ML profiling learns normal traffic baselines and flags deviations; it is not pattern-matching for known SQLi signatures and typically produces probabilistic, not deterministic, blocks. Option C is wrong because DLP pattern matching targets sensitive data exfiltration (credit cards, PII), not injection attack syntax.