Akamai App & API Protector study guide
Akamai App & API Protector · Work through your exam, one topic at a time.
Akamai App & API Protector is a security product within Akamai's application and API security portfolio, and this independent study page supports candidates preparing for a certification-style exam on it. The material is organized around four equally weighted domains: App and API Security; Bot & Agent Control; Web Application and API Protection (WAAP); and DDoS Protection. The Akamai App & API Protector study guide has 4 sections and about 1,248 words.
01App and API Security
App & API Protector applies a layered rule set to inbound HTTP/S traffic. Know the difference between managed (Kona) rules and custom rules : managed rules are curated and versioned by the vendor with attack categories and a numeric ID, while custom rules are yours to define by hostname, path, method, header, or parameter conditions.
332 words, about 2 min02Bot & Agent Control
Bot management separates good automation (search engine crawlers, monitoring, partner integrations) from bad automation (scrapers, credential stuffing, carding, scalpers). Detection blends signatures (declared user-agent and verified crawler identity), behavioral analysis (request cadence, navigation patterns, mouse/keyboard telemetry where collected), and client interrogation (JavaScript or SDK challenges that legitimate browsers can solve).
314 words, about 2 min03Web Application and API Protection (WAAP)
WAAP is the umbrella: WAF , API security , bot mitigation , DDoS , and often client-side protection , delivered consistently across edge and origin. Understand the OWASP Top 10 categories a WAF targets - injection, broken access control, misconfiguration, SSRF, and so on - and that the WAF addresses classes of attacks, not every instance of a vulnerability.
307 words, about 2 min04DDoS Protection
DDoS defense spans volumetric (bandwidth/packet floods), protocol/state-exhaustion (SYN floods, reflection/amplification), and application-layer (HTTP floods, slowloris) attacks. Know the mitigation stack: anycast scrubbing at the edge absorbs and cleans volumetric traffic; rate limiting and connection controls handle floods; behavioral/application profiling catches L7 attacks that look like normal requests.
295 words, about 1 min