What is an effective countermeasure against web server attacks?

Question

Options

• AUsing prepared statements in database queries
• BImplementing network firewalls
• CValidating and sanitizing user input
• DEncrypting data at rest

• A
  2% (1)
• B
  9% (4)
• C
  73% (33)
• D
  16% (7)

Explanation

Validating and sanitizing user input (C) directly neutralizes the most common web server attack vectors - XSS, SQL injection, command injection, and path traversal - by ensuring malicious data never reaches vulnerable processing logic. Because web servers are fundamentally input-processing machines, controlling what enters the system is the most targeted defense at the application layer.

Why the distractors fall short:

• A (Prepared statements) is a database-layer defense against SQL injection specifically - it protects the database, not the web server itself, and doesn't address other attack classes.
• B (Network firewalls) operate at the network/transport layer and can block unauthorized connections, but they cannot inspect or sanitize malicious payloads inside legitimate HTTP requests.
• D (Encrypting data at rest) protects stored data from unauthorized access if storage is compromised - it does nothing to prevent an active attack against a running web server.

Memory tip: Think of the web server as a front door - a firewall is the fence around the building (perimeter), prepared statements are a lock on the safe inside (database), and encryption is a sealed vault (storage). Only input validation/sanitization is the bouncer at the door, checking everything that tries to walk in.

No community discussion yet for this question.