CyberTech Inc. recently experienced SQL injection attacks on its official website. The company appointed Bob, a security professional, to build and incorporate defensive strategies against such…

Question

Options

• AOutput encoding
• BEnforce least privileges
• CWhitelist validation
• DBlacklist validation

• A
  8% (4)
• B
  2% (1)
• C
  86% (42)
• D
  4% (2)

Explanation

Whitelist validation is the correct answer because Bob is implementing a security approach that only permits pre-approved, explicitly defined entities (data type, range, size, and value) to pass through - this is the defining characteristic of whitelisting, where everything is denied by default unless it appears on the approved list.

Why the distractors are wrong:

• Output encoding (A) is a technique that sanitizes data after processing by converting special characters into safe representations before displaying output - it addresses how data is presented, not how input is filtered.
• Enforce least privileges (B) is a broader security principle that restricts user/system access rights to the minimum necessary - it doesn't directly describe an input validation method.
• Blacklist validation (D) is the opposite approach, where known malicious inputs are blocked while everything else is allowed - this is generally considered weaker than whitelisting because attackers can find unlisted bypass techniques.

Memory Tip: Think of whitelist as a VIP guest list - only those explicitly approved get in. Blacklist is like a banned list - everyone enters except those flagged. For SQL injection defense, whitelisting is preferred because you control exactly what's accepted, leaving no room for unexpected malicious input.

No community discussion yet for this question.