An organization has several APIs that accept JSON data over HTTP POST. The APIs are all publicly available and are associated with several mobile…

The JSON Threat Protection policy is an out-of-the-box security policy designed specifically to mitigate content-level threats within JSON payloads. It protects against common threat vectors such as oversized documents, excessive nesting depth, and overly long string values, which can lead to denial-of-service (DoS) attacks or server instability. Since the organization's primary concern is malicious payloads compromising their applications without implementing authentication, this policy directly addresses the risk by inspecting and validating the structure and size of incoming JSON data before it reaches the backend implementation.

A. This is an authentication policy. The question explicitly states the organization does not want to use authentication, making this option a direct contradiction to the requirements.

B. An IP blacklist is reactive and difficult to maintain. A bad actor can easily change their IP address, rendering the policy ineffective against new or sophisticated attacks.

C. The Header Injection and Removal policy operates on HTTP headers, not the request body. It cannot inspect or detect malicious content within the JSON payload itself.

1. MuleSoft Documentation, "JSON Threat Protection Policy": "The JSON threat protection policy protects your API from malicious JSON code that can cause a JSON parser to crash or consume a large amount of memory, resulting in a denial of service (DoS) attack." This document details the specific configurations like Maximum container depth, Maximum string value length, and Maximum object entry name length that directly address the threat described in the question.

Source: MuleSoft Docs > Anypoint Platform > API Manager > Policies > JSON threat protection policy.

2. MuleSoft Documentation, "IP Blacklist Policy": "The IP Blacklist policy enables you to deny access to your API from a specific list of IP addresses and address ranges." This confirms the policy's function is to block based on source IP, not payload content.

Source: MuleSoft Docs > Anypoint Platform > API Manager > Policies > IP blacklist policy.

3. MuleSoft Documentation, "Header Injection and Removal Policies": "The Header Injection policy enables you to inject headers into the incoming request... The Header Removal policy enables you to remove headers from the incoming request." This clarifies that the policy's scope is limited to HTTP headers.

Source: MuleSoft Docs > Anypoint Platform > API Manager > Policies > Header injection and removal policies.

4. MuleSoft Documentation, "Mutual Authentication Policy": "The Mutual Authentication policy enables you to configure an API proxy or API to enforce two-way TLS authentication." This identifies the policy as a form of authentication, which the requirements explicitly exclude.

Source: MuleSoft Docs > Anypoint Platform > API Manager > Policies > Mutual Authentication policy.