Which of the following application security principles involves inputting random data into a program?

A brute force attack systematically tries all possible combinations of credentials or keys to gain unauthorized access; it is an attack strategy, not an application testing principle.

Sniffing involves passively capturing network traffic to analyze packets; it does not involve injecting data into a program.

Fuzzing (fuzz testing) works by automatically feeding a program large volumes of random or semi-random input data and monitoring for unexpected behavior such as crashes, hangs, or memory errors. It is a widely used security technique for discovering input validation flaws, buffer overflows, and other vulnerabilities that might not be found through manual code review or structured testing alone.

A buffer overflow is a specific vulnerability or attack technique where data written to a buffer exceeds its bounds; it is a potential result of fuzzing rather than the testing technique itself.