Question 8

Explanation

Correct Answer: C. Input validation Explanation: SQL injection is a common web application vulnerability that allows attackers to manipulate SQL queries through user-supplied input. To mitigate SQL injection vulnerabilities, the BEST control is input validation. Input validation involves validating and sanitizing user inputs to ensure they meet the expected format, length, and type before using them in SQL queries. By implementing robust input validation mechanisms, such as using parameterized queries or prepared statements, an application can prevent unauthorized SQL commands or malicious code from being injected. Input validation helps to ensure that user inputs are treated as data and not as executable code, thereby significantly reducing the risk of SQL injection attacks. While options such as an Intrusion Detection System (IDS) (Option A) and firewall configuration (Option B) are important security measures, they are not specifically designed to address SQL injection vulnerabilities. These controls focus more on network security and detecting/preventing unauthorized access rather than directly mitigating SQL injection risks. Encryption of database files (Option D) is a valuable control for protecting sensitive data at rest, but it does not directly address SQL injection vulnerabilities. Encryption helps safeguard the confidentiality of the data, but it does not prevent the injection of malicious SQL commands or manipulation of queries. Therefore, the most effective control for addressing SQL injection vulnerabilities is input validation. It ensures that user inputs are validated and sanitized before interacting with the database, significantly reducing the risk of SQL injection attacks and protecting the integrity and security of the application's database.