Akamai App & API Protector study plan

Define the core App & API Protector terminology (config versions, match conditions, rules, hostnames) in your own words

Map how domain 1 (App and API Security) and domain 3 (WAAP) overlap and where they diverge

Sketch the request lifecycle through a property: hostname → rule tree → match → action

List the security controls available for web applications versus APIs and note which apply to each

Build a decision table for choosing actions (alert, deny, bypass, monitor) for common attack classes

Explain how match conditions combine (hostname, path, method, headers, IP, geo) and predict which rule fires for a given request

Distinguish web application protections from API-specific protections and justify when each is required

Draft a rule tree for a sample e-commerce site plus its public API

Describe common web and API attack categories (injection, broken access control, data exposure, abuse of endpoints) and the control that mitigates each

Explain how API discovery and endpoint inventory support security decisions

Compare signature-based versus behavioral/anomaly approaches and state when each is stronger

Identify tuning tradeoffs between false positives and false negatives in a production rollout

Define bot categories (good, bad, and gray/unknown) and give a real-world example of each

Explain common bot-detection signals and how challenges versus blocks are chosen

Describe agent control concepts: which automated clients should be allowed, throttled, or denied

Draft a bot policy for a login page, a checkout flow, and a public API

Explain how bot management interacts with API security controls on the same endpoint

Design a layered defense where bot signals feed API protections and vice versa

Analyze a credential-stuffing scenario and select detection plus response measures

Identify monitoring metrics that reveal bot activity versus legitimate traffic spikes

Classify DDoS attack types (volumetric, protocol, application-layer) and match each to a mitigation approach

Explain how always-on versus on-demand scrubbing affects detection and response time

Describe how application-layer DDoS differs from bot traffic and where controls overlap

Draft an incident runbook for an application-layer flood hitting a protected hostname

Integrate DDoS response with WAAP rule tuning so mitigations do not block legitimate users

Explain how rate controls, geo controls, and challenge actions combine during an attack

Practice sizing thresholds for rate-based controls using a sample traffic profile

Review how all four domains interact during a combined attack scenario

Re-derive the key facts of each domain from memory and flag weak areas

Complete timed practice questions across all four domains and score each domain separately

Rewrite condensed cheat sheets for any domain scoring below 75%

Verify you can explain one cross-domain scenario end to end without notes