Akamai WAF — App & API Protector Track
App & API Protector + Adaptive Security Engine + match targets + Bot Manager + API security. The production Akamai WAAP stack, taught the way an L2/L3 engineer actually tunes it.
Who Is This For
- WAF / WAAP / WebSec engineers running Akamai App & API Protector (or still calling it Kona / KSD)
- CDN and Property Manager operators who now own security configuration, match targets and ASE tuning
- L2 / L3 engineers moving from F5 ASM, Cloudflare WAF or Imperva onto Akamai edge WAAP
- SOC and application-security analysts who must prove “Akamai blocked it” with DataStream evidence, not a console screenshot
Prerequisites
- HTTP / HTTPS, DNS, TLS and how a reverse proxy sits in front of origin
- OWASP Top 10 awareness (we recap in the WAF modules)
- CDN or load-balancer exposure helps; an Akamai Control Center seat is useful but not assumed
Full Syllabus — 12 Modules
M 1Akamai Intelligent Edge & Request Flow
- Edge hostname vs origin hostname — CNAME is the factory door
- Property, CP code, contract and group — what identity the ticket actually has
- Request path: DNS → edge hostname → property behaviors → origin
- Why an A-record to origin never prints an Akamai security event
M 2Property Manager vs App & API Protector
- Delivery (Property Manager / Ion) is not the WAF — two products, two activation paths
- Behaviors, rule trees and caching vs security configuration
- Staging vs production activation for property and for security
- Prolexic (network DDoS) vs App & API Protector (HTTP WAAP) — do not mix the tickets
M 3App & API Protector Object Model
- Security configuration → shared resources → security policy
- Match target binds hostname / path / file extension — nothing is protected without one
- Evaluation hostnames and versioning
- Alert vs Deny: start in Alert, prove with logs, then Deny
M 4Adaptive Security Engine (replacing Kona)
- ASE vs Kona Rule Set vs Automated Attack Groups — what interviews still name, what the console now shows
- Attack groups, rule actions, and tuning recommendations
- False-positive workflow: isolate the rule, narrow the exception, re-test
- When “turn the WAF off” is the wrong answer
M 5Custom Rules, Match Targets & Exceptions
- Custom deny / allow rules without punching an OWASP hole
- Hostname, path, method and header match — write the smallest exception that still works
- Policy evaluation order and skip conditions
- Change control: clone, change, activate STAGING, then PRODUCTION
M 6Rate Controls & Application-Layer DoS
- Rate policies: burst vs average, client identifiers
- Protect login, checkout, search and expensive API endpoints
- Combine rate with ASE — rate is not a substitute for a WAF rule
- Prove the threshold with a replay, not a guess
M 7Bot Manager & Account Protector
- Bot categories, detected vs strictly applied actions
- Credential stuffing and account takeover on login / checkout
- Challenge vs deny — what the user sees vs what the log proves
- Known bots, scrapers and AI crawlers vs malicious automation
M 8API Security & Positive Controls
- API discovery and endpoint inventory vs what the gateway actually publishes
- Schema / spec validation and JSON positive security
- Posture: unused, shadow and zombie APIs
- When an API needs a dedicated match target, not the website policy
M 9Client-Side Protection & Sensitive Data
- Script inventory and PCI-style client-side governance
- Sensitive-data detection in responses
- Content Protector / crawler-control decisions (allow, throttle, block, monetize)
- What client-side protection cannot see (and why WAF still matters)
M 10DataStream, SIEM & the Evidence Desk
- Security events vs delivery logs — pick the tool that answers the ticket
- DataStream 2 fields an L3 must quote: action applied, policy, rule, hostname
- Property activation history, GREP, Request Content, Pragma / X-Cache
- Prove “Akamai is serving” vs “Akamai blocked it” vs “origin never saw it”
M 11akamai appsec CLI — Staging to Production
- List configs, clone, accept a tuning recommendation
- Activate STAGING, replay a checkout POST, then PRODUCTION
- Rollback, version diff and who approved the change
- Common activation failures: missing match target, wrong hostname, still in Alert
M 12Architecture Capstone & Interview Prep
- Design a WAAP for a public website plus JSON API on the same edge
- Akamai vs Cloudflare vs F5 AWAF — which object makes the decision on each stack
- L2 / L3 WebSec interview question bank (match target, ASE, Alert vs Deny, DataStream)
- Incident scenarios: SQLi still reaching origin, login stuffing, false-positive checkout
Practice Labs
Match-Target Bind
Map hostname and path to a security policy. Prove that a hostname with no match target is unprotected even if ASE is on.
ASE Tuning Loop
Start in Alert, isolate a noisy rule, write a narrow exception, then move that hostname to Deny with before/after evidence.
Login Abuse Controls
Design rate policy + Bot Manager actions for /login and a high-cost API, and say which log field proves the action.
Evidence Desk
Take a “WAF missed SQLi” ticket and pick the first tool: property activation, security event, GREP, or origin log.
What You Get
40 Hours
Live + recorded sessions for App & API Protector, ASE, bots, APIs and CLI.
Walkthroughs
Recorded admin demos of Control Center and akamai appsec. Vendor tenants are often read-only for students.
Real Case Studies
False-positive checkout, credential stuffing, missing match target, Alert-left-on-in-production.
Interview Q&A
L2 / L3 Akamai WAF question bank on the interview hub.
Certificate
Techclick Infosec course completion certificate.
WhatsApp Group
Doubt-clearing batch group with the trainer.
Official Reference Set
Product names and console paths change (Kona → ASE is the current example), so the course uses current Akamai TechDocs as the source of truth.
Your Instructor
Trained by working senior cloud and network security engineers with 13+ years of hands-on enterprise experience across Palo Alto, Zscaler, Fortinet, F5, Akamai, Cloudflare and large-scale deployments.
FAQ
Q 1Do I need my own Akamai Control Center tenant?
Helpful, not required. Most student tenants cannot give every learner write access. You get recorded admin demos, screenshot-based config exercises and a troubleshooting workbook so you can still answer L2/L3 interview labs.
Q 2Is this Kona Site Defender or App & API Protector?
The live product is App & API Protector with Adaptive Security Engine. Interviews and older runbooks still say Kona / KSD / Automated Attack Groups — we map the old names to the current objects so you do not fail a ticket on vocabulary.
Q 3Do I receive a certificate?
Eligible learners receive a Techclick course completion certificate. This page does not claim an Akamai-issued certification. Vendor exam vouchers and badges are separate.
Q 4Duration and batch schedule?
About 40 hours over 5–6 weeks, live + recorded. WhatsApp us for the next start date.
Q 5Akamai WAF vs Cloudflare WAF vs F5 AWAF — which should I pick?
Pick the WAF your JD or production estate names. Akamai if the CDN/WAF is Akamai; Cloudflare for orange-cloud SaaS edge; F5 AWAF for BIG-IP data-center WAF. Compare syllabi at /syllabus/compare or send the JD on WhatsApp.
More Akamai WAF (App & API Protector) questions
Q 1What is included in Techclick Akamai WAF (App & API Protector) training?
Live mentor-led Akamai WAF (App & API Protector) training with a published syllabus, recorded classes, interview practice and career support. Labs cover Match targets, ASE tuning, Bot Manager, API security, akamai appsec CLI, DataStream evidence. Trainer is Ram Dixit (13+ years L3 network security). WhatsApp +91 92772 29456 or email support@techclick.in. Syllabus: https://ai.techclick.in/syllabus/akamai-waf
Q 2Who should join the Akamai WAF (App & API Protector) course?
Working L1–L3 engineers and serious career-switchers targeting WAAP / Akamai WAF engineer. Prerequisite: HTTP, DNS, TLS. This is operator training (policy, logs, troubleshooting), not a theory-only YouTube playlist. https://ai.techclick.in/syllabus/akamai-waf
Q 3Does Techclick Akamai WAF (App & API Protector) training include vendor certification?
The syllabus is aligned to Akamai WAF / WAAP operator skills. Techclick issues a completion certificate. Vendor exam vouchers, Pearson VUE fees and official badges are separate and change independently. We prepare you to sit the exam; we do not sell fake certificates.
Q 4Are there live labs in the Akamai WAF (App & API Protector) course?
Yes. You practice Match targets, ASE tuning, Bot Manager, API security, akamai appsec CLI, DataStream evidence. Where a vendor tenant cannot give every student write access, you still get recorded admin demos plus a troubleshooting workbook so you can answer L2/L3 interview labs. Details: https://ai.techclick.in/syllabus/akamai-waf
Q 5What is the fee for Akamai WAF (App & API Protector) training online?
Fees change by batch. Do not trust random portals — confirm the current fee and start date on WhatsApp +91 92772 29456 or support@techclick.in.
Q 6What jobs can I target after Akamai WAF (App & API Protector) training?
Typical India roles: WAAP / Akamai WAF engineer. Techclick helps with resume, LinkedIn and mock interviews. We do not guarantee a job or a salary. Outcomes depend on your lab hours and interview performance.
Q 7Akamai WAF (App & API Protector) vs other Techclick courses — which should I pick?
Akamai if the CDN/WAF is Akamai; Cloudflare for orange-cloud edge; F5 AWAF for BIG-IP. Compare syllabi at https://ai.techclick.in/syllabus/compare or message +91 92772 29456 with your JD and we will map the stack.
Q 8How does Techclick teach Match target bind, ASE Alert vs Deny, and DataStream evidence in Akamai WAF (App & API Protector)?
We walk the production path: what object makes the decision, which log proves it, what usually breaks, and how you verify the fix. For Akamai WAF (App & API Protector) the signature topic is Match target bind, ASE Alert vs Deny, and DataStream evidence. That is the difference between a click-tour and an L3 answer. https://ai.techclick.in/syllabus/akamai-waf
Q 9How long is the Akamai WAF (App & API Protector) live batch?
About 40 live hours over 5–6 weeks — confirm dates. All sessions are recorded in the student portal. Exact start date is confirmed on WhatsApp because batches fill and shift.
Q 10Where can I practice Akamai WAF (App & API Protector) interview questions for free?
Free lessons: https://ai.techclick.in/blogs · interview Q&A: https://ai.techclick.in/akamai-interview-hub · quizzes: https://exam.techclick.in. Paid students also get a role-specific Q&A bank and mock interviews. Start free, then join the live batch if you want labs with a trainer.
Protect the edge. Master Akamai WAF.
Talk to us about the next batch.