Mitigating Malformed Input Attacks in Web Products
A development team is launching a new public-facing web product. The Chief Information Security Officer has asked that the product be protected from attackers who use malformed or invalid inputs to destabilize the system. Which of the following practices should the development team implement?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests input validation strategies, with the common trap being to select static analysis tools that only review code rather than test runtime behavior against bad inputs.
Fuzzing is the most effective practice for detecting vulnerabilities caused by malformed or invalid inputs by actively testing how a system handles unexpected data.
Many learners choose Static Code Analysis because it identifies code flaws like buffer overflows, but it does not actively destabilize the system to prove the vulnerability exists at runtime.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Fuzzing (Option A) is an automated software testing technique that involves feeding a program with random, invalid, or unexpected data to discover crashes, memory leaks, or security vulnerabilities. Since the CISO specifically wants protection from attackers using "malformed or invalid inputs" to "destabilize the system," fuzzing is the direct mitigation technique used to identify and fix these instability issues before deployment. It simulates the attack vector described.Why the Other Options Are Wrong
Static code analysis (Option C) and manual peer review (Option D) are preventative measures that examine source code for errors like SQL injection or buffer overflows, but they do not actively test the running application's resilience to malformed inputs. Continuous deployment (Option B) is a DevOps practice for releasing code quickly and does not inherently provide security controls against input-based attacks.Community Comment Notes
The community heavily favors Fuzzing, with users noting that it directly addresses the goal of finding bugs through "random, unexpected, or invalid data." Some users argue for Static Code Analysis, claiming it identifies issues like XSS, but this misses the specific requirement to test system destabilization via input handling.Exam Strategy
When a question mentions "invalid inputs," "crashes," or "destabilizing," look for fuzzing as the primary answer. Reserve static analysis for questions about reviewing code structure or identifying syntax/logic errors without execution.
Frequently Asked Questions
Why isn't Static Code Analysis the right answer?
SAST reviews source code for potential flaws but doesn't test the running application's reaction to actual malformed inputs, which is what fuzzing does.
How does fuzzing protect against attackers?
Fuzzing proactively finds vulnerabilities by crashing the system with bad data during testing, allowing developers to patch those weaknesses before attackers exploit them.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →