AKAMAI-AAP Practice Test

AKAMAI-AAP practice test: what's covered

• Akamai WAAP
• Adaptive Security Engine
• Bot Mgmt
• API Security
• Rate Controls

Free AKAMAI-AAP sample questions

1. Akamai App & API Protector is BEST described as:

   • A. An on-prem appliance WAF
   • B. A cloud/edge-delivered WAAP that consolidates WAF, API security, bot management, and DDoS/rate protection on Akamai's globally-distributed edge network in front of customer origins
   • C. A backup service
   • D. A DNS-only product
   Show answer

   Correct: B. App & API Protector is Akamai's all-in-one WAAP, running on the edge platform. It protects web apps + APIs with WAF, bot, rate, and DDoS controls before traffic reaches origin. Successor/sibling to Kona Site Defender (KSD).

2. Traffic is protected by App & API Protector because the customer's hostname is:

   • A. Left pointing at origin
   • B. Onboarded to Akamai (DNS CNAME to an Akamai edge hostname) so requests traverse the edge — where security policy is enforced — before going to origin
   • C. Advertised via BGP
   • D. Stored in a database
   Show answer

   Correct: B. You CNAME the hostname to an Akamai edge hostname. Now all traffic hits the edge first, where WAAP policy runs. Origin should be locked down to only accept Akamai (site shield / origin ACL) so attackers can't bypass the edge.

3. Which TWO protections are bundled in App & API Protector? (Choose 2)

   • A. Web Application Firewall (WAF) with managed + custom rules
   • B. Bot management / API security / rate controls
   • C. BGP route optimization
   • D. Disk backup
   Show answer

   Correct: A and B. WAAP = WAF + Bot + API security + rate/DDoS controls in one product. That consolidation (vs separate point products) is the value proposition. BGP/backup are unrelated.

4. To prevent attackers from bypassing the edge and hitting origin directly, you should:

   • A. Nothing
   • B. Lock down origin to accept connections ONLY from Akamai (e.g., Site Shield / origin firewall ACL to Akamai IPs + a shared secret header) so the WAAP cannot be bypassed
   • C. Open origin to the whole internet
   • D. Use BGP
   Show answer

   Correct: B. A WAAP only helps if traffic must pass through it. If origin accepts direct connections, attackers skip the edge. Site Shield (Akamai-IP allowlist) + a secret validation header on origin enforces edge-only access.

5. A "Security Configuration" in App & API Protector contains:

   • A. Only one rule
   • B. The full security policy set (WAF, rate, bot, API, network lists, match targets) for a set of hostnames — versioned, and activated to staging then production
   • C. A BGP table
   • D. A backup schedule
   Show answer

   Correct: B. A Security Configuration bundles all WAAP policy for its hostnames, with versioning. You edit a version, activate to staging for testing, then production. Match targets bind policies to specific hostnames/paths.

Last updated: 2026-10-19

AKAMAI-AAP practice test FAQ