I have a nasty feeling that this is being used as some sort of silly job interview question.
The type of validation that is preferable is the type that does the job. If more than one type does the job, pick the one that seems most useful/simple/attractive to you.
Given various types of validation that can happen at different levels of a request/response process, I prefer to screen the data as close to the request origination point as possible, for the simple reason that there's no point is doing a lot of work that will have to be thrown away if you can detect the problem before you do the work. But I'm not sure the validation types you listed make that distinction.
An IDE is no substitute for an Intelligent Developer.