Which of the following will BEST mitigate web-based application attacks?

The correct answer is B. Validating the data input. The vast majority of web application attacks - SQL injection, cross-site scripting (XSS), command injection, and path traversal - exploit the application's failure to properly validate or sanitize user-supplied input. Input validation is an application-layer defense that…

Submitted by haruto_sh· Apr 18, 2026Information Security Program Development and Management

Question

Options

AImplementing an intrusion detection system (IDS)
BValidating the data input
CUtilizing Transport Layer Security (TLS)
DEmploying a stateful inspection firewall at the perimeter

How the community answered

(43 responses)

A
7% (3)
B
79% (34)
C
2% (1)
D
12% (5)

Explanation

The vast majority of web application attacks - SQL injection, cross-site scripting (XSS), command injection, and path traversal - exploit the application's failure to properly validate or sanitize user-supplied input. Input validation is an application-layer defense that addresses the root cause. An IDS (A) can detect known attack patterns but operates passively and cannot stop novel or obfuscated payloads. TLS (C) encrypts data in transit but does not protect against malicious content within that data. A stateful firewall (D) operates at the network/transport layer and cannot inspect application-layer semantics well enough to catch these attacks.

Topics

#Web application security#Input validation#Application security controls#Secure coding

Community Discussion

No community discussion yet for this question.

Full CISM Practice