Which of the following attacks can be mitigated by avoiding making system calls from within a web application?

Denial of Service attacks exploit resource exhaustion, amplification, or network-layer flooding, none of which depend on system calls made from within the web application code.

OS command injection occurs when user-supplied input is passed to OS shell functions such as exec() or system(); eliminating system calls from the web application removes the mechanism that makes this attack possible.

Advanced SQL injection attacks can escalate to OS command execution through database features like SQL Server's xp_cmdshell or MySQL's LOAD_FILE; preventing the application from making system calls limits this escalation path and reduces the effective impact of SQL injection.

Buffer overflow attacks exploit improper memory boundary handling in compiled code, requiring mitigations like bounds checking and memory-safe languages, not restrictions on system call usage.