Civic staff admin tools query Cosmos DB for NoSQL using filters from UI fields. How should those queries be written?
Select an answer to reveal the explanation.
Short Explanation
Parameterized queries are like using labeled form slots at the clerk window—values fill the blanks without rewriting the whole SQL sentence, so sneaky injection tricks bounce off.
Full Explanation
Civic staff admin tools that query Cosmos DB for NoSQL using filters from UI fields must treat those values as data, not as executable SQL text. Parameterized Cosmos queries bind staff-supplied filters so values cannot alter query structure, which is the correct injection-resistant pattern for municipal ordinance and records lookups from clerk consoles. Concatenating raw UI strings into Cosmos SQL text lets crafted input change predicates or projection shape and is a classic injection anti-pattern in admin tooling that can expose or mutate civic records. Granting every clerk unrestricted account-key access instead of scoped queries expands blast radius far beyond a single filter bug and bypasses least-privilege identity for municipal data. Disabling query APIs and requiring portal-only browsing blocks the automation admin tools need and does not teach secure query construction for department workflows. Exam caveat: parameterization is a data-plane control; it complements—not replaces—RBAC, managed identities, and key hygiene for Azure Cosmos DB. Operationally, enforce parameterized query helpers in the admin SDK path, penetration-test filter fields with adversarial strings, and confirm clerk identities are role-scoped rather than sharing a master key across the city.