A Recently Concluded Penetration Test Revealed That a Legacy Web

Multiple Choice

A recently concluded penetration test revealed that a legacy web application is vulnerable to SQL injection. Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not in a position to risk the availability on the application. Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk? (Choose two.)

A) Identity and eliminate inline SQL statements from the code.
B) Identify and eliminate dynamic SQL from stored procedures.
C) Identify and sanitize all user inputs.
D) Use a whitelist approach for SQL statements.
E) Use a blacklist approach for SQL statements.
F) Identify the source of malicious input and block the IP address.