What best describes Input Validation as a security practice?

• A. Ensuring data is safe and well-formed before processing using whitelist validation
• B. Encrypting data in transit
• C. Logging all input events
• D. Validating output only

Answer: (A)

Input validation focuses on ensuring that data from users or other systems is safe and in the expected form before the application processes it. Using a whitelist (allowlist) of accepted values, formats, lengths, and character sets is the most robust approach because it explicitly defines what is allowed and rejects everything else. This directly reduces the risk of injection and malformed data slipping through.

Encrypting data in transit protects confidentiality, not whether inputs are safe to process. Logging input events helps with auditing and monitoring, but it doesn’t stop unsafe data from being processed. Validating output only means you check what you produce after processing, which may still allow unsafe input to cause harm or behave unpredictably during handling.