Study. uk . com
  1. Home
  2. All questions
  3. Question 144

CompTIA Security+ study material · question 144 of 611

Which validation strategy does OWASP recommend, and why?

  1. Client-side checking, because it reduces server load
  2. Allow-listing, because attackers reliably find inputs a deny-list has not anticipated
  3. Deny-listing, because known attack patterns can be blocked centrally
  4. Length checking alone, because it is language-independent
Show the answer

Answer: B. Allow-listing, because attackers reliably find inputs a deny-list has not anticipated

An allow-list defines what is acceptable; a deny-list must anticipate every bad variant and always trails the attacker.

Source: OWASP Input Validation Cheat Sheet (OWASP) — OWASP Input Validation Cheat Sheet › Validation

Challenge yourself on this topic → Study as cards