Two Measures to Protect Azure SQL Database from SQL Injection Attacks
You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?
Quick Answer
The correct measures are using parameterized queries in application code and implementing a Web Application Firewall (WAF). Parameterized queries prevent SQL injection by strictly separating SQL code from user-supplied data, ensuring that input is always treated as data, never as executable commands. A WAF adds a critical layer of defense by inspecting and filtering malicious HTTP requests before they can reach your Azure SQL Database. On the AZ-500 exam, this question tests your understanding of application-layer security controls versus infrastructure-level protections; a common trap is confusing encryption features like Transparent Data Encryption (TDE) or Always Encrypted with injection prevention, but those only protect data at rest or in transit, not from malicious queries. To remember, think of the mnemonic "P-WAF": Parameterized queries handle the code, WAF handles the network traffic—together they block injection at both the app and perimeter layers.
⚠ Common exam trap
It's easy for candidates to confuse network-level controls (firewall rules) or encryption features (TDE, Always Encrypted) with application-layer defenses against SQL injection, leading them to select options that protect data confidentiality or access but do not prevent the injection attack itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Azure Web Application Firewall (WAF)
Azure Web Application Firewall (WAF) can inspect incoming HTTP/HTTPS traffic and block malicious payloads, including SQL injection attempts, before they reach the application or database. It provides a perimeter defense that filters out common attack patterns, reducing the attack surface for SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Transparent Data Encryption (TDE)
Why it's wrong here
TDE encrypts data at rest, does not prevent SQL injection.
- ✓
Implement Azure Web Application Firewall (WAF)
Why this is correct
WAF can detect and block SQL injection patterns.
- ✗
Configure Azure SQL Database firewall rules
Why it's wrong here
Firewall rules control network access, not application-level injection.
- ✓
Use parameterized queries in application code
Why this is correct
Parameterized queries prevent injection by separating SQL logic from input.
- ✗
Enable Always Encrypted for sensitive columns
Why it's wrong here
Always Encrypted encrypts data, does not prevent injection.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement? (Choose TWO.)
medium- A.Use Always Encrypted for sensitive columns.
- ✓ B.Deploy Azure Web Application Firewall (WAF) in front of the application.
- C.Enable Transparent Data Encryption (TDE).
- D.Enable SQL Server auditing.
- ✓ E.Use parameterized queries in application code.
Why B: Azure Web Application Firewall (WAF) can inspect incoming HTTP/S traffic and block malicious patterns such as SQL injection payloads before they reach the application. By filtering requests at the edge, WAF provides a critical layer of defense against SQL injection attacks targeting Azure SQL Database.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.