A security incident affected an organization’s critical business services, and the customer-side web API became unresponsive and crashed. An investigation revealed a spike of API call requests and a high number of inactive sessions during the incident. Which two recommendations should the engineers make to prevent similar incidents in the future? (Choose two.)

The incident was caused by a spike in API calls and a high number of inactive sessions, leading to resource exhaustion and a crash. To prevent this, two key controls are necessary. First, implementing API rate limiting (B) directly addresses the "spike of API call requests" by setting thresholds on how many requests a client can make in a given time frame. Second, configuring shorter timeout periods (A) for sessions addresses the "high number of inactive sessions" by closing them more quickly, which frees up server resources like memory and connection slots, preventing exhaustion.

C. API key maintenance is a good security practice for authentication and authorization but does not directly prevent a volume-based resource exhaustion attack.
D. Automating error reporting is a reactive measure that informs about a problem after it has occurred; it does not prevent the incident itself.
E. Decreasing simultaneous API responses would likely worsen the user experience by creating a larger request queue, potentially exacerbating the unresponsiveness.

1. OWASP Foundation, "OWASP API Security Top 10 2019," API4: Lack of Resources & Rate Limiting. "APIs do not always impose restrictions on the size or number of resources that can be requested by the client/user... This can lead to Denial of Service (DoS)... To prevent this: Implement rate limiting... define proper timeouts on the server side." (This directly supports options B and A).

2. Cisco, "Cisco Application Policy Infrastructure Controller (APIC) Security Configuration Guide," Section on Contracts and Filters. While not a direct quote, the principles of applying filters and policies to control traffic flow and prevent resource exhaustion are fundamental to Cisco's application-centric security models, aligning with the concept of rate limiting.

3. Cisco, "Denial of Service Attack," Official Documentation. "DoS attacks typically function by overwhelming a target machine with requests until normal traffic is unable to be processed, resulting in denial-of-service to users... Mitigation techniques include rate limiting." (This supports rate limiting as a primary DoS defense).