Which of the following PRIMARILY contributes to security incidents in web-based applications?

Systems administration and operating systems relate to infrastructure-level security concerns rather than being the primary contributor to web-based application-specific security incidents.

System incompatibility and patch management are general IT security concerns that affect overall infrastructure but do not primarily drive security incidents specific to web-based application logic and design.

Third-party applications and change controls are contributing factors to broader IT security risk but are not the primary drivers of web application security incidents compared to application interface weaknesses and testing deficiencies.

Improper stress testing fails to uncover performance and security weaknesses under load conditions, while poorly designed or unsecured application interfaces (APIs and input/output points) are the primary attack surface for web applications. These two factors together represent the most direct contributors to web application security incidents, as untested interfaces can expose injection flaws, authentication bypasses, and data exposure vulnerabilities.