350-201 · Question #136
A security incident affected an organization's critical business services, and the customer-side web API became unresponsive and crashed. An investigation revealed a spike of API call requests and a…
The correct answer is A. Configure shorter timeout periods. B. Determine API rate-limiting requirements. A surge in API requests combined with a high count of inactive sessions points to resource exhaustion, which is addressed by enforcing rate limits and reducing session timeout durations.
Question
A security incident affected an organization's critical business services, and the customer-side web API became unresponsive and crashed. An investigation revealed a spike of API call requests and a high number of inactive sessions during the incident. Which two recommendations should the engineers make to prevent similar incidents in the future? (Choose two.)
Options
- AConfigure shorter timeout periods.
- BDetermine API rate-limiting requirements.
- CImplement API key maintenance.
- DAutomate server-side error reporting for customers.
- EDecrease simultaneous API responses.
How the community answered
(27 responses)- A74% (20)
- C15% (4)
- D4% (1)
- E7% (2)
Why each option
A surge in API requests combined with a high count of inactive sessions points to resource exhaustion, which is addressed by enforcing rate limits and reducing session timeout durations.
Configuring shorter timeout periods forces inactive sessions to be terminated sooner, releasing server resources and preventing the accumulation of idle sessions that contributed to the crash.
Implementing API rate limiting caps the number of requests a single client or IP can make within a defined window, directly mitigating the request spike that overwhelmed the service.
API key maintenance improves access control and credential hygiene but does not prevent a high volume of requests or idle sessions from exhausting server capacity.
Automating server-side error reporting improves post-incident visibility and customer communication but does not prevent the resource exhaustion condition from recurring.
Decreasing simultaneous API responses would reduce throughput and worsen service availability rather than addressing the root causes of request flooding and session buildup.
Concept tested: API rate limiting and session timeout to prevent resource exhaustion
Source: https://owasp.org/www-project-api-security/
Topics
Community Discussion
No community discussion yet for this question.