MENU
You have a database in an Azure Cosmos DB Core (SQL) API account.
You need to create an Azure function that will access the database to retrieve records based on a variable named accountnumber. The solution must protect against SQL injection attacks.
How should you define the command statement in the function?
Suggested Answer: A
Get Premium DP-420 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
33 comments · newest first
PO
Polly
11 months ago
I thought A looked okay at first, but it's definitely unsafe.
YO
Youlanda
11 months ago
Totally agree with C, it's parameterized!
JE
Jesusita
11 months ago
Wait, isn't D just asking for SQL injection?
VI
Virgina
12 months ago
I think B is incorrect, you can't use LIKE that way.
LY
Lynelle
12 months ago
Option C is the way to go!
JA
Jani
1 year ago
I have a vague memory that using parameters is safer, so I’m leaning towards option C, but I hope I’m not mixing it up with another topic.
AR
Armanda
1 year ago
I practiced a similar question, and I think concatenating strings like in option D is definitely a bad idea for security.
GA
Gaynell
1 year ago
I'm not entirely sure, but I feel like using LIKE in option B is not the best approach for this scenario.
PE
Pete
1 year ago
I remember we discussed how using parameters can help prevent SQL injection, so I think option C might be the right choice.
BU
Buffy
1 year ago
I've got this! The correct approach is to use a parameterized query with the @accountnumber parameter. That's the best way to stay secure.
AR
Ariel
1 year ago
Wait, I'm a bit confused. Do I need to use the LIKE operator or just the equals sign?
CE
Cecily
1 year ago
Hmm, this looks like a tricky one. I'll need to be careful to avoid SQL injection vulnerabilities.
JA
Jamal
1 year ago
Okay, I think I know the answer here. Using a parameterized query is the way to go to protect against SQL injection.
ZO
Zona
1 year ago
This seems like a straightforward question. I'd probably go with creating an Order Guide to make it easy for managers to order the required items for new employees.
YO
Yoko
1 year ago
Ah, I see the logic here. As processes mature, there are more checkpoints and reviews to catch defects early. I'll mark True.
LI
Lina
1 year ago
This is a tricky one, but I'm leaning towards it being a preventive control. The system is preventing further login attempts after detecting an issue.
GO
Goldie
2 years ago
Hey, at least it's not as bad as Bobby Tables' dad. That guy's a real troublemaker!
TH
Theron
1 year ago
D) cmd = \'SELECT * FROM Persons p WHERE p.accountnumber = '\' + accountnumber + \''\'
EM
Emogene
1 year ago
I heard about Bobby Tables' dad too, he caused quite a mess!
FE
Fernanda
1 year ago
C) cmd = \'SELECT * FROM Persons p WHERE p.accountnumber = @accountnumber\'
RO
Robt
2 years ago
A) cmd = \'SELECT * FROM Persons p WHERE p.accountnumber = 'accountnumber'
TA
Tarra
2 years ago
Wait, what's SQL injection? I thought we were just retrieving some records. Did I miss something important here?
AN
Antonio
2 years ago
I agree with Amie. Option C is the way to go to ensure the security of the database.
HE
Henriette
1 year ago
I agree, option C is the safest choice to protect the database from potential threats.
HE
Henriette
1 year ago
I think option C is the correct one. It uses parameterized queries to prevent SQL injection attacks.
CY
Cyndy
2 years ago
I'm not sure, but I think option D might also work.
AM
Amie
2 years ago
Option C is the correct answer. Using parameterized queries is the best way to protect against SQL injection attacks.
YA
Yasuko
1 year ago
Definitely, it's an important security measure to keep our data safe.
WY
Wynell
2 years ago
So we should always use parameterized queries when accessing databases in Azure functions.
CA
Cammy
2 years ago
Yes, you're right. Parameterized queries help protect against SQL injection attacks.
DU
Dulce
2 years ago
I think the correct answer is C) cmd = \'SELECT * FROM Persons p WHERE p.accountnumber = @accountnumber\'
ST
Stevie
2 years ago
I agree with Minna, option C protects against SQL injection attacks.
MI
Minna
2 years ago
I think the correct answer is C.