When implementing a REST API, how does an engineer mitigate security risks?

Authenticating the client's identity is vital for preventing broken authentication vulnerabilities but does not directly mitigate DoS or DDoS attacks, which target API availability rather than unauthorized access.

Configuring object properties to protect data typically refers to data validation, serialization, and integrity, which safeguards data but does not prevent the API service from being overwhelmed by traffic.

Configuring separate authorization schemes is essential for controlling access to different API resources and preventing broken access control, but it does not protect against the volume-based attacks like DoS or DDoS.

Configuring rate limiting on a REST API restricts the number of requests a client can make within a specified time frame. This directly reduces the risk of DoS and DDoS attacks by preventing malicious actors from overwhelming the API server with an excessive volume of requests, thus ensuring the API remains available and responsive for legitimate users.