Web Application and API Protection (WAF, API Security, Bot Management, DDoS)
What the domain tests
Operational command of WAAP controls on F5 BIG-IP Advanced WAF/ASM and F5 Distributed Cloud: how a policy moves from learning to blocking, how APIs are protected beyond signatures, how bots are separated from humans and good scripts, and how denial-of-service is absorbed at the right layer.
Core rules
- WAF lifecycle. Deploy a policy in transparent mode, use learning suggestions and traffic baselines to shrink false positives, then move to blocking. Keep signature accuracy current, enable protocol/JSON/XML validation, and make every exception narrow and documented.
- API protection. Import the OpenAPI document to build a positive schema, flag sensitive data (PII, card numbers) in responses, apply per-endpoint rate limits, and tune for object-ID enumeration patterns. Discovery should be re-run so shadow endpoints are not silently unprotected.
- Bot management. Combine known-bot signatures, TLS/HTTP fingerprinting, browser validation challenges, behavioral analytics, and CAPTCHA as an escalation step. For native mobile traffic, use an SDK-based attestation path rather than JavaScript challenges that an API client cannot run.
- DDoS. Separate volumetric L3/L4 scrubbing from L7 defenses such as request-rate limits, slowloris detection, dynamic signatures and DNS query-flood protection. Baselines define what normal looks like before an attack starts.
Worked example
Credential stuffing targets /login. Layer the response: baseline the normal login rate per IP and per session; enable bot defense on the login path with device identification; add an L7 rate limit keyed to IP plus session; enable brute-force and credential-stuffing signatures; escalate suspicious sessions from a silent challenge to CAPTCHA; and monitor false positives for users behind shared NAT, since a single aggressive IP limit will lock out an entire office.
Traps that cost marks
Turning on blocking before tuning. Serving JavaScript challenges to API or mobile clients. Assuming volumetric scrubbing handles an L7 flood. Leaving bot defense on all paths and breaking monitoring scripts. Forgetting that login protections must also cover token refresh and password-reset endpoints, which are equally attractive to attackers.