At a SaaS company, a SQL injection reaches the billing application even though the network firewall allows only HTTPS to that host. Which deployment would see the injection in the request?

An application control placed in front of the billing app, where the request content, including a SQL injection, can be inspected is the deployment that would see the injection. The SQL statement is application content inside a request to the billing app. An application control placed in front of that app inspects the request where the content is visible and can recognize the injection. Another network firewall rule on the same HTTPS port, still judging the connection by its headers adds another rule on the same HTTPS port and still judges the connection by its headers. A header or port decision cannot read the SQL inside the request. An endpoint agent on a laptop that never runs the billing app and never sees the query sits on a laptop that never runs the billing app. An agent that never sees the query cannot inspect it, no matter how well that laptop is monitored. A log archive that only keeps records of requests that already finished and does not inspect the live query keeps records of requests that already finished. It does not inspect the live query, and it cannot be the control that sees the injection on the way into the app. Exam caveat: the application control has to sit where the request is visible, which means TLS has ended at or before that control. Operational check: compare a billing request at the application control, where the query text should appear, with the network firewall log, where the same session should show as an HTTPS allow.