While performing data validation of web content, a security technician is required to restrict malicious input. Which of the following processes is an efficient way of restricting malicious input?

Validating only query strings covers just one input vector and ignores malicious data delivered through POST bodies, HTTP headers, cookies, and other channels.

Scanning tools perform external vulnerability assessments against the application and do not provide real-time runtime input validation within the application logic itself.

Checking that input matches the expected data type (e.g., integer not arbitrary string), does not exceed a defined maximum length (preventing buffer overflow and oversized-payload attacks), and falls within an acceptable value range implements the core input validation principle recommended by OWASP. This approach blocks SQL injection, command injection, overflow, and many other injection-class vulnerabilities at the application's trust boundary, regardless of the delivery channel used by the attacker.

Filtering for 'extraneous queries' is vague and does not systematically address type mismatches, oversized payloads, or out-of-range values that constitute the bulk of malicious input.