Exam PT0-002 topic 1 question 193 discussion

This is an example of a SQL injection attack. SQL injection attacks exploit vulnerabilities in web applications that allow malicious users to input and execute their own SQL statements within the database. In this example, the attacker is specifically attempting to get the database to return all records with a role that contains the word ‘admin’. If successful, this would allow the attacker to gain access to administrator accounts on the system.

It's clearly an SQLi attack. The attackers presumably exfiltrated a database dump for administrator passwords, which they used for privilege escalation. Parameterized queries, in addition to input validation/sanitization, is one of the most recommended solutions to such injection attacks. MFA is essential as well, but that's just a general best practice. It doesn't fix this SPECIFIC vulnerability. Encryption is just another best security practice that doesn't remediate the underlying vulnerability in question. The secure SDLC is just a theoretical framework. It may advise fixes for software vulnerabilities like injection attacks, but it's not an actual solution in itself.