The requirement is to stop prompt flooding against the city's 311 AI API. Which controls should the team prioritize first?

Implementing rate limits and token limits matched to the flooding requirement is what the team should prioritize first to stop prompt flooding against the city's 311 AI API. Requirements-driven control selection maps the stated risk—high-volume prompt floods—to gateway protections that constrain how often clients may call and how large each request may be. Rate limits curb request frequency; token limits curb oversized contexts that amplify cost and resource exhaustion on a civic 311 assistant under flood conditions.

Implementing system prompt hardening and adversarial suffix detection controls matched to the flooding requirement fails by concept because hardening instructions and detecting malicious suffixes defends against prompt injection and jailbreaks, not volume floods; it doesn't cap how often clients may call or how large each request may be. Deploying output content moderation and toxicity classification filters matched to the flooding requirement fails because filtering outbound responses for toxicity screens content after generation and doesn't throttle the inbound flood while it's happening; the team still needs enforced rate and token limits, not just output screening, to stop it. Enforcing PII redaction and sensitive data disclosure prevention controls matched to the flooding requirement fails by concept because redacting sensitive data protects confidentiality in outputs instead of throttling volume; the 311 API still needs preventive rate and token limits to constrain the flood, not just disclosure controls.

Exam caveat: Flooding maps to rate and token limits first—not to enforcing PII redaction and sensitive data disclosure prevention controls, which protect confidentiality rather than throttling volume-based flooding.

Operational check: On the 311 AI API gateway, set per-client rate and token ceilings aligned to normal civic usage, generate a synthetic flood, confirm throttling and alerts fire, keep monitoring enabled, and verify legitimate 311 requests within quota still succeed.