Which two actions are recommended as security best practices to protect REST API? (Choose two.)

While multi-factor authentication is a strong security measure, 'dual authentication of the session' is not a standard or specific API security best practice term, and hashing and encryption are more fundamental.

Using a password hash ensures that user credentials are not stored in plaintext within the system, making them much harder to compromise even if the API's underlying database is breached.

SSL (Secure Sockets Layer), or more accurately TLS (Transport Layer Security), provides encryption for the communication channel between the client and the REST API, protecting sensitive data from eavesdropping and tampering during transmission over the network.

TACACS+ is an AAA protocol primarily used for authenticating, authorizing, and accounting device administration access (e.g., to routers/switches), not typically for securing application-level REST API endpoints.

Out-of-band authentication is a method of multi-factor authentication, but password hashing and SSL/TLS for transport encryption are more universally applicable and fundamental best practices for REST API security.