To prevent from Database Access Control attack
-
access control should be handled by the application and database layers
-
Always include current authenticated username as part of the query.
-
Never rely on presentation layer to restrict values submitted by the user
-
All the above
All options are valid measures to prevent Database Access Control attacks. Access control must be enforced at both application and database layers (defense-in-depth). Including the authenticated username in queries ties operations to specific users. Never trusting presentation layer validation prevents bypass attacks. Option D correctly captures that all these practices are necessary.
Defending against database access-control attacks requires layering controls: access control enforced at both the application and database layers (not just one), always tying queries to the currently authenticated user rather than trusting client-supplied identifiers, and never relying on the presentation/UI layer alone to restrict what values a user can submit (since that layer is easily bypassed). Because all three practices are needed together, 'all the above' is the correct choice.