Microsoft DP-420 Exam - Topic 10 Question 32 Discussion

Actual exam question for Microsoft's DP-420 exam

Question #: 32
Topic #: 10

You have a database in an Azure Cosmos DB Core (SQL) API account.

You need to create an Azure function that will access the database to retrieve records based on a variable named accountnumber. The solution must protect against SQL injection attacks.

How should you define the command statement in the function?

Acmd = 'SELECT * FROM Persons p
WHERE p.accountnumber = 'accountnumber''

Bcmd = 'SELECT * FROM Persons p
WHERE p.accountnumber = LIKE @accountnumber'

Ccmd = 'SELECT * FROM Persons p
WHERE p.accountnumber = @accountnumber'

Dcmd = 'SELECT * FROM Persons p
WHERE p.accountnumber = '' + accountnumber + '''

Show Suggested Answer

Suggested Answer: A

by Nana at Feb 07, 2024, 10:12 AM

Limited Time Offer

25%

Off

Get Premium DP-420 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Polly

6 months ago

I thought A looked okay at first, but it's definitely unsafe.

upvoted 0 times

...

Youlanda

6 months ago

Totally agree with C, it's parameterized!

upvoted 0 times

...

Jesusita

6 months ago

Wait, isn't D just asking for SQL injection?

upvoted 0 times

...

Virgina

7 months ago

I think B is incorrect, you can't use LIKE that way.

upvoted 0 times

...

Lynelle

7 months ago

Option C is the way to go!

upvoted 0 times

...

Jani

7 months ago

I have a vague memory that using parameters is safer, so I’m leaning towards option C, but I hope I’m not mixing it up with another topic.

upvoted 0 times

...

Armanda

7 months ago

I practiced a similar question, and I think concatenating strings like in option D is definitely a bad idea for security.

upvoted 0 times

...

Gaynell

7 months ago

I'm not entirely sure, but I feel like using LIKE in option B is not the best approach for this scenario.

upvoted 0 times

...

Pete

8 months ago

I remember we discussed how using parameters can help prevent SQL injection, so I think option C might be the right choice.

upvoted 0 times

...

Buffy

8 months ago

I've got this! The correct approach is to use a parameterized query with the @accountnumber parameter. That's the best way to stay secure.

upvoted 0 times

...

Ariel

8 months ago

Wait, I'm a bit confused. Do I need to use the LIKE operator or just the equals sign?

upvoted 0 times

...

Cecily

8 months ago

Hmm, this looks like a tricky one. I'll need to be careful to avoid SQL injection vulnerabilities.

upvoted 0 times

...

Jamal

8 months ago

Okay, I think I know the answer here. Using a parameterized query is the way to go to protect against SQL injection.

upvoted 0 times

...

Zona

8 months ago

This seems like a straightforward question. I'd probably go with creating an Order Guide to make it easy for managers to order the required items for new employees.

upvoted 0 times

...

Yoko

8 months ago

Ah, I see the logic here. As processes mature, there are more checkpoints and reviews to catch defects early. I'll mark True.

upvoted 0 times

...

Lina

8 months ago

This is a tricky one, but I'm leaning towards it being a preventive control. The system is preventing further login attempts after detecting an issue.

upvoted 0 times

...