A municipal upload feature re-encodes images but still stores files under a web-accessible path with predictable names. What defense-in-depth guidance fits best?
Select an answer to reveal the explanation.
Short Explanation
Converting a photo is good — leaving it where the web server can run weird leftovers is not. Solid upload hygiene stacks re-encoding with off-webroot storage, random names, and no execution. A .jpg suffix is not a security control.
Full Explanation
File-upload defense in depth combines content validation or re-encoding, storage outside the executable webroot, unpredictable object names, and disabled script execution on the store. Image conversion reduces some polyglot risks but does not replace the other controls. Trusting extensions or removing authentication increases exposure. Testers should recommend the layered pattern rather than a single transformation step.