I85PREP
⌘ K
Akamai App & API Protector study materials
Akamai App & API Protector study resources

Akamai App & API Protector practice questions

One question at a time. Build your Akamai App & API Protector understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1App and API Security

In Akamai App & API Protector, which component is primarily responsible for inspecting API requests for schema conformance and parameter violations?

  1. The Adaptive Media Delivery policy
  2. The Image Manager policy
  3. The API Protection rule set within the security configuration Correct answer.
  4. The Edge DNS zone management module

Explanation

API Protection is a rule set inside a security configuration that evaluates API traffic against learned or declared schemas and flags deviations such as unexpected parameters or malformed bodies. The other listed features are unrelated delivery or DNS services.

Question 2App and API Security

A customer wants Akamai to automatically learn an API's request structure from observed production traffic before enforcing strict validation. Which capability supports this?

  1. Site Shield
  2. API Acceleration
  3. API Discovery and API Self-Learning Correct answer.
  4. EdgeWorkers

Explanation

API Discovery inventories API endpoints from traffic, and API Self-Learning builds a baseline schema from observed requests so that validation can be enforced without manual schema authoring. The other options are performance or network-protection features.

Question 3App and API Security

Which attack category is the primary focus of the Web Application Firewall rule sets in App & API Protector?

  1. TLS certificate misissuance
  2. BGP route hijacking
  3. Injection and cross-site scripting against web applications Correct answer.
  4. Volumetric DNS amplification

Explanation

The WAF rule sets target application-layer attacks such as SQL injection, command injection, and cross-site scripting. Volumetric and routing attacks are handled by other layers of the platform.

Question 4App and API Security

What is the purpose of a security configuration's match target in App & API Protector?

  1. To choose the TLS cipher suite for the edge
  2. To configure cache-control headers
  3. To define which hostnames and paths a rule set applies to Correct answer.
  4. To set the origin server's keep-alive timeout

Explanation

Match targets determine the scope of a security policy by selecting hostnames and path patterns, so different rules can apply to different parts of a property. The other choices are delivery or transport settings.

Question 5App and API Security

An application owner needs to block requests that contain a known malicious payload pattern while allowing similar legitimate traffic. Which WAF action best fits?

  1. Monitor
  2. Alert
  3. Bypass
  4. Deny Correct answer.

Explanation

The Deny action blocks matching requests, which is appropriate when the rule reliably distinguishes malicious from benign traffic. Alert and Monitor only log, and Bypass disables inspection.

Question 6App and API Security

Which Akamai capability provides a managed list of reputational threat intelligence used to score incoming clients?

  1. Ion
  2. Edge DNS
  3. Client Reputation Correct answer.
  4. Global Traffic Management

Explanation

Client Reputation assigns risk scores to clients based on observed malicious behavior and threat intelligence, allowing rules to challenge or block high-risk clients. The other products are DNS, traffic-management, and delivery offerings.

Question 7App and API Security

What does the term 'positive security model' mean in the context of API protection?

  1. Allowing only traffic that matches an explicitly defined schema or allowlist Correct answer.
  2. Blocking traffic that matches known bad signatures
  3. Encrypting all traffic between client and edge
  4. Rate limiting requests per client IP

Explanation

A positive model permits only requests that conform to an expected structure, rejecting everything else. Signature-based blocking is the negative model, and the other choices are unrelated controls.

Question 8App and API Security

Which feature lets a security team test a new WAF rule in production without affecting end users?

  1. Origin shielding
  2. SureRoute
  3. Alert-only mode on the rule Correct answer.
  4. Prefetching

Explanation

Running a rule in alert-only mode logs matches without blocking, letting teams evaluate false positives before enforcing. The other options are performance and network features.

Question 9App and API Security

A security engineer wants to apply different WAF rules to /api/ than to /www/ on the same hostname. What is the most appropriate configuration approach?

  1. Use a single rule set with no path conditions
  2. Enable one global policy for the entire hostname
  3. Disable WAF for /api/ and rely on origin firewalls
  4. Create separate match targets with distinct path patterns and assign different security policies Correct answer.

Explanation

Match targets can scope a security policy by path, so /api/ and /www/ can each be governed by different rule sets. A single global policy cannot differentiate behavior by path.

Question 10App and API Security

An API endpoint accepts a JSON body with a fixed set of fields. A request includes an unexpected field named 'adminFlag'. Which API protection behavior best addresses this?

  1. TLS renegotiation
  2. Cache-key normalization
  3. Rate limiting the client
  4. Schema validation rejecting unexpected parameters Correct answer.

Explanation

Schema validation enforces the declared or learned structure, so undefined fields like 'adminFlag' are flagged or blocked. The other options affect volume, transport, or caching, not payload structure.

Question 11App and API Security

What is the main benefit of API Discovery in an organization with many undocumented endpoints?

  1. It inventories API endpoints observed in traffic so they can be brought under protection Correct answer.
  2. It automatically rewrites API responses for performance
  3. It replaces the need for TLS on API endpoints
  4. It provisions new origin servers

Explanation

API Discovery surfaces endpoints seen in traffic, including shadow APIs, so teams can apply appropriate protections. It does not rewrite responses, remove TLS requirements, or provision infrastructure.

Question 12App and API Security

A rule set is producing false positives on a legitimate query parameter. What is the most precise way to reduce them while keeping protection?

  1. Switch the whole configuration to monitor mode
  2. Create a rule exception or condition targeting only that parameter Correct answer.
  3. Disable the entire rule set
  4. Remove the match target

Explanation

Targeted exceptions or conditions narrow the rule's scope so legitimate traffic passes while other traffic remains protected. Disabling the rule set or the whole policy removes protection broadly.

Question 13App and API Security

Which Akamai feature helps protect APIs against automated credential-stuffing attempts by challenging suspicious clients?

  1. Cloudlets for caching
  2. Bot Manager Correct answer.
  3. Edge DNS
  4. Image Manager

Explanation

Bot Manager detects and challenges automated clients, including credential-stuffing bots, using behavioral and reputational signals. The other options are media, DNS, and caching features.

Question 14App and API Security

An attacker sends a request with an SQL comment sequence embedded in a cookie value. Which protection layer is designed to detect this?

  1. The caching layer keying on the cookie
  2. The origin load balancer's health checks
  3. The WAF rule set inspecting request headers and cookies Correct answer.
  4. The DNS resolver

Explanation

WAF rules inspect request components, including cookies and headers, for injection signatures. Caching, health checks, and DNS do not analyze payload content for attacks.

Question 15App and API Security

What does the 'deny' action do when a request matches a WAF rule in App & API Protector?

  1. It blocks the request and returns an error response to the client Correct answer.
  2. It routes the request to a backup origin
  3. It challenges the client with a CAPTCHA
  4. It forwards the request but logs the match

Explanation

Deny terminates the request at the edge and returns an error response, preventing it from reaching the origin. Logging, challenging, and failover are separate actions.

Question 16App and API Security

A team wants to enforce that API requests only use the HTTP methods defined for each endpoint. Which control accomplishes this?

  1. Origin keep-alive tuning
  2. Client reputation scoring
  3. TLS version pinning
  4. Method enforcement within API protection rules Correct answer.

Explanation

API protection can restrict allowed HTTP methods per endpoint, rejecting undefined methods such as DELETE on a read-only resource. The other options address reputation, transport, or connection behavior.

Question 17App and API Security

Why is a positive security model often recommended for APIs with well-defined schemas?

  1. It rejects any request that deviates from the expected structure, reducing unknown attack surface Correct answer.
  2. It requires no configuration and works automatically
  3. It eliminates the need for authentication
  4. It encrypts request bodies at the edge

Explanation

Because APIs have predictable structures, an allowlist model can reject deviations and thereby shrink the attack surface from unexpected inputs. It still requires configuration and does not replace authentication or encryption.

Question 18App and API Security

An organization observes a spike in requests from a set of IPs previously associated with abuse. Which feature most directly informs an automated block?

  1. Client Reputation scores combined with a rule action Correct answer.
  2. Adaptive media bitrate ladders
  3. DNS zone transfers
  4. Cache prefetching

Explanation

Client Reputation provides risk scores derived from prior abusive behavior, and rules can act on those scores to block or challenge. The other options are delivery or DNS mechanics.

Question 19App and API Security

What is the role of a security policy version in App & API Protector?

  1. It configures log delivery destinations
  2. It stores TLS certificates for the edge
  3. It defines origin load-balancing weights
  4. It captures a snapshot of rule settings that can be activated and rolled back Correct answer.

Explanation

Policy versions snapshot rule configurations so changes can be reviewed, activated, and rolled back if needed. Certificates, load balancing, and logging are managed separately.

Question 20App and API Security

A customer wants to allow legitimate file uploads to an endpoint while blocking attempts to upload executable content. Which approach is most appropriate?

  1. Enforce content-type and file-extension constraints in API or WAF rules for that endpoint Correct answer.
  2. Rely solely on client reputation
  3. Turn off WAF for the upload path
  4. Disable all POST methods globally

Explanation

Constraining allowed content types and extensions for the specific upload endpoint permits legitimate files while blocking risky ones. Global method blocking or disabling WAF is overly broad.

Question 21App and API Security

During tuning, a team finds a WAF rule matches on a parameter used by a partner integration but not by attackers. What is the most surgical remediation?

  1. Add a condition that excludes that parameter value pattern only for the partner's match target Correct answer.
  2. Lower the rule's sensitivity across all traffic
  3. Remove the rule from the policy
  4. Switch the entire policy to alert mode

Explanation

Scoping an exception to the specific parameter and match target preserves protection for all other traffic. Broad sensitivity changes, rule removal, or global alert mode reduce protection unnecessarily.

Question 22App and API Security

Why must API Self-Learning be given a sufficient observation period before enforcement is enabled?

  1. TLS sessions must be renegotiated
  2. The edge must warm its caches for the API
  3. Origin health checks must complete
  4. The baseline must capture the full range of legitimate request structures to avoid false positives Correct answer.

Explanation

Self-Learning derives a schema from observed traffic, so a short window may miss legitimate variations and cause false positives once enforcement begins. Caching, TLS, and health checks are unrelated to schema accuracy.

Question 23App and API Security

An attacker slowly varies payload encoding to evade signature matching on an API. Which strategy best complements signature-based rules?

  1. Adding more origin servers
  2. Increasing cache TTLs
  3. Positive schema validation that rejects non-conforming requests Correct answer.
  4. Disabling logging to reduce noise

Explanation

When signatures can be evaded by encoding variation, a positive model that only accepts conforming requests provides a structural defense. Cache, logging, and capacity changes do not address evasion.

Question 24App and API Security

A security team needs to distinguish malicious automated API scraping from legitimate high-volume integrations. Which combination is most effective?

  1. A single static IP blocklist
  2. Relying on TLS version alone
  3. Disabling the API entirely during peak hours
  4. Bot detection signals plus rate and behavioral analysis scoped to the API match target Correct answer.

Explanation

Combining bot detection with behavioral and rate analysis, scoped to the relevant endpoint, separates abusive automation from sanctioned high-volume clients. Static blocklists and transport settings are insufficient.

Question 25App and API Security

What is the effect of assigning a rule the 'alert' action while the rest of the policy enforces deny?

  1. The entire policy stops blocking
  2. Matching requests are blocked with a custom error page
  3. Matching requests are logged but allowed, while other rules continue to block Correct answer.
  4. The rule is removed from the policy

Explanation

The alert action is per-rule: it logs matches without blocking while other rules retain their configured actions. It does not alter the whole policy or remove the rule.

Question 26App and API Security

Which Akamai App & API Protector component inspects inbound request payloads for known attack signatures such as SQL injection and cross-site scripting patterns?

  1. The client reputation service
  2. The adaptive rate control engine
  3. The API gateway caching layer
  4. The WAF rule sets Correct answer.

Explanation

WAF rule sets contain signatures and logic that match malicious payload patterns in request data. Rate control and reputation services act on traffic volume and client history rather than payload content.

Question 27App and API Security

What is the primary purpose of the network list feature in App & API Protector?

  1. To store TLS certificates for origin connections
  2. To define API schemas for positive security enforcement
  3. To group IP addresses or geographies for reuse in policy rules Correct answer.
  4. To schedule automatic policy version upgrades

Explanation

Network lists are reusable collections of IPs, CIDRs, or geographies that policies can reference in match conditions. They centralize allow and deny decisions so the same list can be applied across many rules.

Question 28App and API Security

Which action should be configured on a WAF rule to block matching requests outright?

  1. Deny Correct answer.
  2. Bypass
  3. Alert
  4. Monitor

Explanation

The deny action rejects a request that matches the rule, typically returning an error to the client. Alert and monitor record the match without blocking, and bypass skips inspection.

Question 29App and API Security

What does API Discovery primarily produce for a security team?

  1. A signed certificate for each API hostname
  2. A patched version of the origin application code
  3. A list of observed API endpoints and their request characteristics Correct answer.
  4. A firewall rule set for the origin database

Explanation

API Discovery analyzes traffic to surface API endpoints, including undocumented ones, along with observed methods and parameters. This inventory supports later policy and schema enforcement decisions.

Question 30App and API Security

Which Akamai capability evaluates the historical behavior and reputation of a client to influence whether a request is allowed?

  1. Response header rewriting
  2. Payload signature matching
  3. Schema validation
  4. Client reputation scoring Correct answer.

Explanation

Client reputation scoring aggregates signals about a client's prior behavior to classify risk. Policies can then use that score to challenge, throttle, or block the client.

Question 31App and API Security

What does the positive security model require of API requests?

  1. That requests avoid all query string parameters
  2. That requests carry a valid client TLS certificate
  3. That requests originate only from allowlisted geographies
  4. That requests match explicitly defined allowed behavior Correct answer.

Explanation

A positive model permits only traffic that conforms to a defined contract of methods, paths, parameters, and formats. Anything outside that contract is treated as suspect.

Question 32App and API Security

Which feature allows a security team to observe how a new rule would behave on live traffic without blocking users?

  1. Network list synchronization
  2. Origin health check
  3. Policy version rollback
  4. Rule in alert or monitor mode Correct answer.

Explanation

Running a rule in alert or monitor mode records matches without enforcing a block. This lets teams assess false positives on real traffic before switching to deny.

Question 33App and API Security

Which control restricts an API endpoint to only the HTTP methods that its contract defines?

  1. TLS cipher suite restriction
  2. Response body compression
  3. Method enforcement in the API match conditions Correct answer.
  4. DNS CNAME flattening

Explanation

Method enforcement matches on the HTTP method so that only defined methods reach the endpoint. Requests using undefined methods are then blocked or flagged.

Question 34App and API Security

A security engineer needs to apply stricter WAF rules to requests whose path begins with /api/ while leaving /www/ traffic on baseline rules. What is the most appropriate configuration approach?

  1. Apply the stricter rules globally and accept false positives on /www/
  2. Disable the WAF entirely for the hostname and rely on rate controls
  3. Create a child security policy that inherits from the parent and add path-scoped rules Correct answer.
  4. Create a second hostname for the API and duplicate all origin settings

Explanation

Child policies inherit parent configuration while allowing targeted overrides, so path-scoped rules can be added without disturbing other traffic. This keeps baseline protection consistent across the hostname.

Question 35App and API Security

A JSON API accepts a fixed set of fields, but a request includes an unexpected field named isAdmin. Which control most directly rejects the request based on the defined contract?

  1. Positive security schema validation Correct answer.
  2. Client reputation scoring
  3. Response header inspection
  4. Adaptive rate control

Explanation

Schema validation compares the request structure against the defined contract, so an undeclared field fails validation. This enforces the positive model at the field level.

Question 36App and API Security

A rule is generating false positives on a legitimate query parameter used by a partner integration. What is the most precise way to reduce the false positives while keeping protection?

  1. Lower the overall policy sensitivity to the minimum
  2. Disable logging for the entire hostname
  3. Remove the rule set from the policy entirely
  4. Create a targeted exception for that specific rule and parameter Correct answer.

Explanation

A targeted exception suppresses the specific match for the identified rule and parameter while leaving other rules active. Broad changes would weaken protection across the whole policy.

Question 37App and API Security

An attacker embeds an encoded SQL comment sequence in a cookie value to evade simple signature matching. Which protection layer is designed to detect this?

  1. Client certificate validation
  2. Origin load balancing
  3. WAF payload inspection with normalization Correct answer.
  4. Response caching policy

Explanation

WAF payload inspection normalizes encodings before matching signatures, which exposes obfuscated attack patterns. This allows detection even when the payload is encoded differently.

Question 38App and API Security

A security team wants to challenge suspicious clients that exhibit automated credential-stuffing behavior against login APIs. Which capability is most appropriate?

  1. Response compression tuning
  2. Origin TLS renegotiation
  3. Static IP allowlisting
  4. Bot management with behavioral detection Correct answer.

Explanation

Bot management applies behavioral detection to identify automation and can issue challenges to suspicious clients. This targets automated abuse without blocking legitimate users.

Question 39App and API Security

Why is a sufficient observation period important before enabling enforcement for API Self-Learning?

  1. It ensures the learned baseline reflects normal traffic and reduces false positives Correct answer.
  2. It reduces the origin server's CPU load
  3. It automatically patches vulnerable API code
  4. It is required to renew the TLS certificate

Explanation

Self-Learning builds a model of expected API behavior from observed traffic, so enforcement should begin only after enough representative traffic has been seen. Otherwise legitimate but uncommon requests may be blocked.

Question 40App and API Security

An attacker gradually varies payload encoding to evade signature matching on an API. Which strategy best complements signature-based detection?

  1. Increasing the origin timeout value
  2. Enabling response compression
  3. Adding more DNS records
  4. Behavioral anomaly detection against a learned baseline Correct answer.

Explanation

Behavioral anomaly detection flags requests that deviate from the learned normal pattern, which can catch evasive variants that signatures miss. Combining it with signatures broadens coverage.

Question 41App and API Security

A security team needs to distinguish malicious automated API scraping from legitimate high-volume integrations. Which combination of controls is most effective?

  1. A single global IP blocklist
  2. Increasing the cache TTL for API responses
  3. Behavioral bot detection combined with client reputation Correct answer.
  4. Disabling logging for API paths

Explanation

Behavioral detection identifies automation patterns while reputation scoring adds context about the client's history. Together they reduce false positives against legitimate integrations.

Question 42App and API Security

What is the effect of setting a single rule to alert while the rest of the policy enforces deny?

  1. The policy reverts to its previous version
  2. Matching requests for that rule are logged but allowed while other rules still block Correct answer.
  3. The rule is removed from the policy at the next deployment
  4. All rules in the policy stop blocking traffic

Explanation

Rule actions are evaluated individually, so an alert rule records matches without blocking while other rules continue to deny. This is useful for validating a single rule safely.

Question 43App and API Security

A customer wants to permit legitimate document uploads to an endpoint while blocking attempts to upload executable content. Which approach best fits?

  1. Disable the WAF for the upload path
  2. Block all POST requests to the endpoint
  3. Enforce allowed content types and inspect file signatures Correct answer.
  4. Allow uploads only from a single IP address

Explanation

Restricting content types and inspecting the file's actual signature allows legitimate documents while rejecting executable payloads. This balances usability with protection.

Question 44App and API Security

Why does a positive security model suit APIs with well-defined schemas?

  1. The schema provides an explicit contract that defines allowed requests Correct answer.
  2. Schemas automatically patch application vulnerabilities
  3. APIs never receive unexpected input in practice
  4. Schemas eliminate the need for TLS

Explanation

A schema states exactly which methods, fields, and formats are valid, giving the positive model a precise definition to enforce. Requests outside that contract can be rejected with confidence.

Question 45App and API Security

What does a security policy version represent in App & API Protector?

  1. A TLS certificate chain
  2. A snapshot of the policy configuration that can be activated or rolled back Correct answer.
  3. A per-request authentication token
  4. A list of origin IP addresses

Explanation

Policy versions capture configuration states so teams can activate, compare, or roll back changes. This supports controlled change management.

Question 46App and API Security

An organization sees a spike in requests from IPs previously linked to abuse. Which configuration most directly uses that information to mitigate the traffic?

  1. Increase the origin server timeout
  2. Enable response compression
  3. Reference a reputation-based network list in a deny or challenge rule Correct answer.
  4. Add a new CNAME record for the hostname

Explanation

Network lists populated with known-abusive IPs can be referenced in deny or challenge rules to mitigate the traffic directly. This applies existing intelligence to policy enforcement.

Question 47App and API Security

A team wants to ensure that only requests matching the documented API contract reach the origin, rejecting everything else. Which posture does this describe?

  1. Passive monitoring
  2. Client-side validation
  3. Positive security enforcement Correct answer.
  4. Signature-only detection

Explanation

Positive enforcement allows only traffic that matches the documented contract and rejects the rest. This contrasts with signature-based detection, which blocks known bad patterns.

Question 48App and API Security

During tuning, a team finds a WAF rule matches a parameter used by a partner integration but never by attackers. What is the most appropriate response?

  1. Add a narrowly scoped exception for that rule and parameter Correct answer.
  2. Remove the partner integration
  3. Disable the entire rule set globally
  4. Lower the policy sensitivity for all traffic

Explanation

A narrowly scoped exception removes the false positive for that specific case while preserving protection elsewhere. Broad changes would weaken the policy unnecessarily.

Question 49App and API Security

An attacker sends requests that individually look benign but collectively probe many API endpoints in sequence. Which detection approach best addresses this pattern?

  1. Validating the TLS certificate chain
  2. Inspecting a single request in isolation
  3. Checking only the response status code
  4. Correlating behavior across requests over time Correct answer.

Explanation

Sequential probing is visible only when behavior is correlated across multiple requests, such as endpoint enumeration patterns. Single-request inspection cannot see the broader pattern.

Question 50App and API Security

A security team must decide whether to enforce a learned API model. Which evidence most strongly supports enabling enforcement?

  1. The observed baseline covers the endpoint's normal methods and parameters with low variance Correct answer.
  2. The endpoint receives the highest total request volume in the estate
  3. The API uses JSON rather than XML
  4. The origin server was recently upgraded

Explanation

Enforcement is safe when the learned baseline reliably represents normal behavior, indicated by coverage and low variance. Volume, infrastructure changes, and payload format are not evidence of model quality.