Which of the following is an IS auditor's BEST recommendation to mitigate the risk of eavesdropping associated with an application programming interface (API) integration implementation?

SOAP is a protocol for structuring messages but does not inherently provide encryption for the communication channel; it relies on underlying protocols like TLS for security.

Encrypting the XML file would protect the data at rest or during specific stages, but it does not protect the data *in transit* over the network from eavesdropping unless the transport channel itself is encrypted.

Masking API endpoints might make them harder to discover but does not protect the data exchanged over the network from eavesdropping once a connection is established.

Transport Layer Security (TLS) encrypts the entire communication channel between the client and the API server, establishing a secure, private connection. This prevents eavesdropping by ensuring that all data transmitted over the network, including API requests and responses, is encrypted and protected from interception and unauthorized viewing.