You have an Azure SQL Database server named SQL1. You plan to turn on Advanced Threat Protection for SQL1 to detect all threat detection types. Which action will Advanced Threat Protection detect as…

Question

Options

• AA user updates more than 50 percent of the records in a table.
• BA user attempts to sign as select * from table1.
• CA user is added to the db_owner database role.
• DA user deletes more than 100 records from the same table.

• A
  3% (2)
• B
  93% (54)
• C
  2% (1)
• D
  2% (1)

Explanation

Explanation

Option B is correct because a user attempting to execute sign as select * from table1 represents a SQL injection attack pattern - specifically, an attempt to manipulate a SQL query through malformed or suspicious syntax, which is exactly the type of anomalous activity Advanced Threat Protection (ATP) is designed to flag as a potential security threat.

Options A and D are incorrect because bulk data modifications (updating 50%+ of records) and large deletions (100+ records) are normal database operations that could occur in routine batch jobs or maintenance tasks - ATP does not have thresholds based on record counts. Option C is incorrect because adding a user to the db_owner role is a standard administrative privilege action managed through SQL Server security controls, not something ATP classifies as a threat detection event.

Memory Tip: Think of ATP as a "suspicious SQL behavior detector" - it looks for signs of injection attacks, anomalous access patterns, and unusual query structures (like malformed syntax in Option B). If an action looks like normal database administration or routine data manipulation, ATP won't flag it; if it looks like someone trying to exploit the SQL engine itself, that's ATP's target.

No community discussion yet for this question.