3.2.2. Defender for Databases
💡 First Principle: A syntactically valid, properly-authenticated SQL query can still be an attack — data exfiltration, privilege escalation, or SQL injection all use legitimate query mechanics — which is exactly the gap Defender for Databases is built to close through behavioral analysis rather than permission checks.
Defender for Databases (covering Azure SQL Database, SQL Managed Instance, and other Azure database services) provides vulnerability assessment (scanning for misconfigurations and missing patches) and advanced threat protection, which detects anomalous activity patterns — unusual query volume, access from an unfamiliar geographic location, or a query pattern consistent with SQL injection — and raises alerts.
⚠️ Exam Trap: Vulnerability assessment and advanced threat protection are two capabilities within the same Defender for Databases plan, not two separate products — a scenario asking "which single plan would provide both a misconfiguration scan and real-time SQL injection detection" is pointing at Defender for Databases as one answer, not two.
Reflection Question: A query pattern consistent with SQL injection is detected against a database using a fully patched, correctly-permissioned schema. What does that tell you about the limits of platform-level security alone (3.2.1) versus what detection (this section) adds?
