How to Prevent API Injection Attacks?
Which security actions must be implemented to prevent an API injection attack?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests your ability to distinguish generic security best practices from the specific control—input validation, filtering, and sanitization—that directly prevents injection attacks.
API injection attacks are mitigated by validating, filtering, and sanitizing all incoming data before processing. Community consensus strongly confirms option C as the correct defense against injection vectors.
Candidates often choose option D (short-lived tokens) because token management is a popular API security topic, but tokens authenticate callers and do not prevent malicious payloads from being injected.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C directly addresses the root cause of injection attacks: untrusted input reaching an interpreter or backend. Validating ensures data conforms to expected formats, filtering removes disallowed characters, and sanitization neutralizes payloads before execution. This defense-in-depth approach is the universally accepted method for preventing SQL injection, command injection, and similar API injection variants.Why the Other Options Are Wrong
Option A (logging failed attempts) is a detective control that helps after an attack occurs but does nothing to block the malicious payload itself. Option B (password hashing with biometrics) strengthens user authentication but has no bearing on how incoming API data is processed. Option D (short-lived tokens and app authentication) reduces the blast radius of credential theft but does not inspect or neutralize injected content within otherwise valid requests.Community Comment Notes
Commenters unanimously support option C, with multiple users linking to authoritative sources such as IEEE Computer Society and Escape.tech that emphasize input validation, sanitization, and escaping. Comment [5] adds valuable context by recommending parameterized queries as a complementary technique to separate code from user input, reinforcing the principle of never trusting raw data.Official Reference
Exam Strategy
When a question mentions 'injection,' immediately look for the answer containing 'validate,' 'sanitize,' or 'filter.' Distractors often describe strong but unrelated controls like token rotation or logging—always match the control to the specific threat.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →