After a SQL injection finding, a team debates three controls for a customer search page: a maximum input length on the search box, a web application firewall in front of the site, and parameterized queries in the data-access code. Which statement describes how these controls should be used?
Select an answer to reveal the explanation.
Short Explanation
A WAF is a bouncer reading faces at the door; it's helpful, but a good disguise gets past it. Parameterized queries change the building so there's no door at all for input to become code. You keep the bouncer and the length limit, but they're backup, not the plan.
Full Explanation
Parameterized queries address the root cause of SQL injection: they separate the statement's structure from its data so that user input is never parsed as SQL. That makes them the primary defense recommended by secure coding guidance. Input validation, such as a reasonable maximum length or an allowed character set, and a web application firewall are valuable as defense in depth, because they reduce noise, block some automated attacks and buy time, but neither changes how the query is built. A WAF matches requests against signatures and rules; attackers routinely use encoding, comments and alternate syntax to evade pattern matching, and a WAF has limited insight into how a given application assembles SQL, so relying on it alone leaves the flaw in place. Length limits are weaker still: short payloads such as a single quote plus a tautology fit in a handful of characters, and many fields legitimately accept long text. Treating any one of the three as equivalent ignores that only parameterization removes the vulnerability itself. Exam caveat: layered controls are correct, but the exam expects the layer that fixes the code to be named as primary. Operational check: confirm the search query uses bound parameters and that the WAF and validation still log blocked attempts.