A city's public APIs must validate caller tokens, throttle abusive clients, and avoid error messages that reveal internal stack traces. Which set of practices does this describe?
Select an answer to reveal the explanation.
Short Explanation
Treat the API like a busy city counter: check badges (tokens), do not let one person hog the line (rate limits), and do not announce the filing-cabinet combination when something breaks. That trio is basic API security hygiene. Dumping stack traces and connection strings is how internals leak.
Full Explanation
API security practices include validating access tokens, applying rate limits to curb abuse, and returning generic errors that do not leak internals such as stack traces or connection strings. Unauthenticated write endpoints and verbose failure bodies increase exploitation risk. Cloud+ security best practices explicitly call out API hardening as part of cloud application protection.