API and Network Security Design Questions

Addresses design patterns and operational controls for securing APIs and networked services. Topics include API authentication and authorization patterns, token handling, OAuth and JWT considerations, input validation, rate limiting and throttling, API gateway functionality, DDoS and abuse mitigation, service-to-service authentication, mutual TLS, network segmentation, VPC design, security groups and firewalling, logging and monitoring for anomalous traffic, and trade offs between developer experience and protection. Candidates should propose architecture diagrams, threat mitigations, and operational monitoring strategies.