To verify thatweb application inputs are sanitized,fuzzingis the best method because it testsvarious malformed inputsto detect security flaws.
Option A (Incorrect):SQL injectionis a specificattack technique, not a comprehensive input validation test.
Option B (Correct):Fuzzingis adynamic security testing techniquethat sendsrandom, malformed, or unexpected inputsto check if the application properly sanitizes and validates data.
Option C (Incorrect):Brute forceattacks targetauthentication mechanisms, notinput sanitization.
Option D (Incorrect):Password sprayingis an attack method, not a testing technique forinput validation.
Reference:ISACA CISA Review Manual -Domain 5: Protection of Information Assets- Coverssecurity testing techniques, application security, and input validation best practices.