The correct option is Web Application Firewall.

A Web Application Firewall inspects HTTP requests and responses and can detect and block common SQL injection payloads using signatures and behavioral rules. It is deployed in front of web applications so it can stop malicious queries before they reach the database. A WAF provides a rapid, configurable layer of defense for web traffic and is therefore the most effective choice among the listed controls for preventing SQL injection attacks, although secure coding practices like parameterized queries should still be used as the primary safeguard.

Transport Layer Security is incorrect because TLS only protects data in transit and does not inspect or sanitize HTTP content, so it cannot prevent injection of malicious SQL into requests.

Identity Aware Proxy is incorrect because an identity proxy enforces authentication and access control and it does not filter or block malicious input patterns in application requests.

Endpoint antivirus scanning is incorrect because antivirus tools focus on detecting malware on hosts and files and they do not analyze HTTP request payloads for SQL injection.

Full AWS Practitioner Certification Question