The Chief Executive Officer (CEO) has asked the IT administrator to protect the externally facing web server from SQL injection attacks and ensure the backend database server is monitored for…

A Web Application Firewall inspects HTTP and HTTPS requests and applies rule sets specifically designed to detect and block SQL injection payloads before they reach the backend database, fulfilling the web server protection requirement. A Database Activity Monitoring solution provides continuous, real-time visibility into database queries and transactions, detects anomalous behavior such as unexpected bulk data access, and can enforce active response policies - including session termination - to stop threats in progress, directly satisfying the enforcement requirement.

A UTM can provide general network filtering but lacks the deep, application-layer SQL injection rule enforcement that a WAF provides, and a NIDS is a passive detection system that cannot actively terminate database sessions.

A DAM alone cannot protect the web server from SQL injection at the HTTP layer, and a SIEM only aggregates and correlates log data for alerting without providing real-time database session enforcement or web-layer blocking.

A UTM does not offer the precision SQL injection protection of a dedicated WAF, and an HSM is a cryptographic key management device with no capability to monitor or terminate database behavior.

A SIEM collects and correlates security event data for analyst review but cannot actively block SQL injection at the application layer or enforce automated termination rules against unusual database activity.