Advanced Threat Protection is enabled for an Azure SQL Database server and configured to detect all threat types. If an application generates a malformed SQL statement in the database, which alert will be triggered?

A malformed SQL statement, especially one that could be exploited, falls under the category of a potential vulnerability rather than an active attack. Azure Advanced Threat Protection (ATP) for SQL Database identifies such statements as a "Vulnerability to SQL injection" because it indicates a weakness in the application's code that could be exploited, not necessarily an active, successful injection attempt. "Potential SQL injection alert" is incorrect because ATP distinguishes between detecting a vulnerability and detecting an active, successful injection. "Access from a potentially harmful application alert" is for suspicious client applications, not malformed queries. "Brute force SQL credentials alert" is for repeated failed login attempts.