🎴 Flashcard Mode

All options are valid measures to prevent Database Access Control attacks. Access control must be enforced at both application and database layers (defense-in-depth). Including the authenticated username in queries ties operations to specific users. Never trusting presentation layer validation prevents bypass attacks. Option D correctly captures that all these practices are necessary.