API / APIGEE Gateway Interview Questions
What is Advanced API Security in Apigee and how does it detect bot attacks?
Advanced API Security (formerly known as Apigee Sense) is an AI/ML-powered add-on that analyses API traffic patterns to detect and block bots, credential stuffing attacks, and API abuse -- without any policy configuration from the developer.
| Capability | Description |
|---|---|
| Bot detection | ML models identify bot-like traffic patterns (high frequency, regular intervals, scripted behaviour) |
| Anomaly detection | Identifies unexpected changes in traffic volume, error rates, or latency |
| Risk assessment | Assigns risk scores to client IPs and API keys based on behaviour |
| Security reports | Dashboards showing detected threats, sources, and patterns |
| Abuse detection rules | Pre-built rules for credential stuffing, data scraping, fake account creation |
| Automated blocking | Optionally block or flag identified bot traffic automatically |
<!-- Advanced API Security actions can be attached to Apigee proxy flows to act on detected threats. Example: deny request if Advanced API Security identifies it as bot traffic: Condition in a ConditionalFlow or FaultRule: apigee.bot.action = "deny" Alternatively, add the 'apigee-bot-protection' shared flow from the Apigee catalogue --> <!-- Security report categories: - Anomalous traffic: unusual volume spikes - Bot patterns: scripted/automated request signatures - Credential stuffing: many failed auth attempts - Data scraping: systematic data extraction - Geographic anomalies: traffic from unexpected regions Available in Apigee UI: Analyze > Security Reports > Advanced API Security -->
What makes Advanced API Security different from Apigee's standard rate limiting policies like SpikeArrest and Quota?
What is a 'credential stuffing' attack that Advanced API Security helps detect?
More Related questions...
