Comprehensive and Detailed Step-by-Step Explanation:
To verify thatweb application inputs are sanitized,fuzzingis the best method because it testsvarious malformed inputsto detect security flaws.
* Option A (Incorrect):SQL injectionis a specificattack technique, not a comprehensive input validation test.
* Option B (Correct):Fuzzingis adynamic security testing techniquethat sendsrandom, malformed, or unexpected inputsto check if the application properly sanitizes and validates data.
* Option C (Incorrect):Brute forceattacks targetauthentication mechanisms, notinput sanitization.
* Option D (Incorrect):Password sprayingis an attack method, not a testing technique forinput validation.
Reference:ISACA CISA Review Manual -Domain 5: Protection of Information Assets- Coverssecurity testing techniques, application security, and input validation best practices.