A company provides an API that runs on the public cloud for its customers. A fixed number of VMs host the APIs. During peak hours, the company…

The primary issue is resource exhaustion on a fixed set of VMs during peak demand, impacting all users. The goal is a cost-effective solution that ensures fair access. API throttling (or rate limiting) directly addresses this by imposing a limit on the number of requests a user can make within a specific timeframe. This prevents any single customer from monopolizing resources, ensuring the API remains accessible and performs consistently for all users. It is the most cost-effective method as it manages demand to fit the existing infrastructure, avoiding the recurring costs associated with adding more virtual machines.

A. Use an allow list for customers using APIs.

An allow list is a security control for authorization, not a mechanism for managing request volume or ensuring fair usage among authorized customers.

B. Increase the number of VMs running APIs.

This is horizontal scaling. While it would alleviate the performance issue, it directly increases operational costs and is therefore not the most cost-effective solution.

D. Increase the MTU on the VMs.

Modifying the Maximum Transmission Unit (MTU) is a network-level optimization for packet size and would not solve a resource contention problem caused by a high volume of API requests.

1. Official Vendor Documentation (Principle): The AWS API Gateway documentation

a model for industry-standard cloud services

explains that throttling is used to protect backend services from being overwhelmed. It states

"Throttling can be used to help prevent your API from being overwhelmed by too many requests... to ensure 'fair use' among all your API clients."

Source: Amazon API Gateway Developer Guide

"Throttling API requests for better throughput

" Section: "Usage plans with API keys."

2. University Courseware: In courses on scalable system design

rate limiting is taught as a fundamental pattern for protecting services and ensuring availability. It is presented as a server-side control to manage client behavior and prevent resource starvation.

Source: Stanford University

CS 110: Principles of Computer Systems

Lecture 19: "Networking III & Intro to Threading

" discussion on server design patterns for handling high client load.

3. Peer-reviewed Academic Publication: Research on Quality of Service (QoS) in cloud-based systems identifies rate limiting as a key mechanism for service differentiation and overload protection. It allows providers to enforce service-level agreements (SLAs) and maintain system stability under variable load without immediate

costly resource scaling.

Source: Armbrust

M.

et al. (2010). "A view of cloud computing." Communications of the ACM

53(4)

50-58. Section 4

"Classes of Utility Computing." (This foundational paper discusses the economic and architectural principles of cloud computing

including the need for metered

elastic resource management

for which throttling is a primary implementation tactic). DOI: https://doi.org/10.1145/1721654.1721672