An enterprise is deploying APIs that utilize a private key and a public key to ensure the connection string is protected. To connect to the API, customers must use the private key. Which of the follow

Implementing a VPN for all APIs provides secure communication channels, but it doesn't directly address the method of authenticating API requests or preventing hard-coded strings within the application layer for database access.

Signing a key with DSA (Digital Signature Algorithm) provides authenticity and non-repudiation for the key itself, but HMAC is more commonly used for authenticating messages or requests in an API context to protect against tampering and unauthorized use.

Deploying MFA (Multi-Factor Authentication) is for human user accounts, not typically for service accounts connecting an API to a database; API key management and message authentication are the relevant controls here.

HMAC (Hash-based Message Authentication Code) uses a cryptographic hash function and a secret key to generate a message authentication code. When used with API keys, it ensures the integrity and authenticity of the API requests, preventing tampering and unauthorized access without exposing the raw private key in transit, thus securing the connection to the database and avoiding hard-coded strings.