A developer uses a 'whitelist' approach for input validation: only accept values matching an expected pattern. A security reviewer prefers this over a 'blacklist' approach. Why is allowlisting (whitelisting) fundamentally stronger for security?

• A.An allowlist defines a complete set of acceptable inputs; anything not matching is rejected. A blocklist attempts to enumerate all bad inputs - which is inherently incomplete since attackers can use encoding variants, new attack patterns, and context-specific bypasses not yet in the blocklist. Allowlists have no 'unknown unknowns' because the default is reject
• B.Allowlists are faster to compute at runtime
• C.Allowlists are required by PCI-DSS regulations
• D.Blocklists are not supported by modern web frameworks