# Akamai is an edge property factory. Hostname, then stamps.

Source: https://ai.techclick.in/blog_akamai_session_factory
Markdown: https://ai.techclick.in/blog_akamai_session_factory.md
Publisher: Techclick Infosec Pvt Ltd

Akamai is an edge property factory: hostname → property activation → WAF/behaviors → origin. Prove the live version on a named network before you touch a rule.

Quick answer

   Akamai is an  edge property factory , not one switch. Official: a  property hostname  is the FQDN users type. You CNAME it to an  edge hostname  ( *.edgekey.net  on Enhanced TLS). The edge loads the  property version that is active on that network . App & API Protector is a separate  security configuration version .  Save  writes a draft.  Activate  pushes a version onto  staging  (Edge Staging Network, no end-user traffic) or  production  (customer-facing, phased). A deny stops before origin. A cache HIT never reaches origin. Quote both live versions, the network, then the rule or  X-Cache  header.

   Say this out loud

   I do not start with features. I ask whether the hostname CNAMEs to the edge, which property version is production-active, which security config version is production-active, and whether cache or origin answered. Save is not activate. Staging is not production. A 403 with a healthy origin is a stamp, not a down origin.

## 1. Why “Akamai blocked us” is not a diagnosis

  Concept:  Every other blog starts with “open App & API Protector.” That is why students freeze. The real object is the  request that entered a property hostname . Features are only stamps the factory puts on that ticket.

 Official Key concepts: when users visit your site, their browsers do a DNS lookup. To serve traffic through Akamai you replace the origin  A  record with a  CNAME  to the  edge hostname . Akamai mapping then returns the IP of the best edge server. That edge server opens the property configuration file — hostnames plus rules — and delivers according to the behaviors you set. One property at a time applies to any given hostname.

 Users collapse four failures into one sentence. A 403 from an API schema control, a Bot monitor that never blocked, a stale cache HIT after a release, and a saved-but-not-activated property v19 all look like “Akamai is down.” They are four desks. The live version on a named network is how you stop guessing.

   Hero · the factory floor

   Notice: the client talks to the edge, not straight to origin, only after the property hostname CNAMEs to the edge hostname.

#### What the ticket asked

 “Akamai blocked the API.” That sentence is a hypothesis. The factory may have denied, cached, or never received the CNAME. Origin may already be healthy.

#### What you prove first

 Hostname → edge hostname, then which property version is production-active, then which security config fired. The  evidence desk  is the night-shift version of this order.

#### Path

 Property hostname CNAME → activated property version → WAF / behaviors → cache lookup or origin fetch.

#### Do

 Quote both live versions and the network. Name the desk. Clone, do not edit the active version. Re-test on the network you activated.

   The lie every L1 repeats

   “Disable App & API Protector so we can see if it’s us.” That takes the protection stamp off the whole hostname. Official first-config help is blunt: you must have a delivery configuration active on at least staging before you even create a security configuration. You have not named the control, the version, or the network yet. A schema 403, a cache HIT, and a saved draft all survive that disable for different reasons — and you just opened the origin to the internet.

   Lab values only

   Property hostname  app.example.test , edge hostname  app.example.test.edgekey.net , origin  origin.example.test:443 , CP code  12345 , property v17 production-active / v19 saved, security config  CFG-LAB-01  v17, request  REQ-LAB-1042 . Nothing here is a live tenant. Never paste a customer activation note with PII into a public ticket.

## 2. Mental model — door, ticket, stamps, answer

 Hold four parts. Interviews fail when people mix them.

#### 1. The door is the hostname

     Official: three names.  Property hostname  = what users type ( app.example.test ).  Edge hostname  = CNAME target ( app.example.test.edgekey.net  on Enhanced TLS).  Origin server hostname  = where the edge fetches ( origin.example.test ). Mix those three and the factory never starts.

#### 2. The ticket is the activated version

     A property has snapshot versions. You can edit a version until you activate it. After activation you create a new version. The same version can be active on staging and a different version on production.  Save  is not a ticket.  Activate v# on Production  is.

#### 3. The stamps are WAF and behaviors

      Behaviors  are the THENs on the property (Origin Server, Content Provider Code, Caching).  Security configuration  is WAF, Bot, API constraints, rate, IP/Geo. They version independently. Matching numbers do not couple them.

#### 4. The answer is origin or cache

     A deny never reaches origin. A cacheable HIT never reaches origin. Official Origin Server is mandatory on the Default Rule — you cannot delete it. Proof is a request sample plus  X-Cache  / origin health, not a Save toast.

   Flow 1 · one ticket, four desks

       Browser to property hostname to edge to WAF and behaviors to cache or origin

- Property factory · app.example.test · production v17 Browser asks /api/orders Hostname door CNAME → edgekey.net Activated property v17 production · not v19 draft Origin or cache only if not deny / not HIT Behavior stamp origin · CP code · cache Default Rule THENs WAF stamp security config version CFG-LAB-01 v17 Bot / API / rate same security object Alert is not Deny Answer origin.example.test or X-Cache TCP_HIT Lab objects — dummy dashboard only app.example.test → app.example.test.edgekey.net · property v17 production=active CFG-LAB-01 v17 · cpcode=12345 · origin.example.test:443 · REQ-LAB-1042 v19 is saved and staging-active. Production still serves v17. That is not a bug. That is two networks. Read left → right, then the four stamp cards. The gradient box is the ticket. A saved draft never sits in that box. Official wording you will quote in interviews. A property is the most granular object in the hierarchy — a container for how edge servers respond to requests for a set of hostnames. Versions let you modify one instance while another is activated. Activations deploy a specific version to staging or production. Once activated, settings distribute as XML metadata. You cannot edit a property that is already active on either network — create a new version, then save, review, and activate to replace the live configuration. App & API Protector is a second factory line on the same hostname. Official: a security configuration is versioned; one hostname is covered by only one active security configuration at a time; you cannot edit an activated configuration — create a new version, then Activate and pick Network (Staging to test, or Production to go live). Delivery must already be active on at least staging before you create that first security configuration. Pre-train the three hostnames Property hostname = address users type + Host header. Edge hostname = CNAME target that puts the request on Akamai ( edgesuite.net Standard TLS, edgekey.net Enhanced TLS). Origin hostname = a new DNS name you create so the edge can still find the box after the public name points at Akamai. Pointing the origin hostname at the same name as the property hostname is a loop. ## 3. Factory path — hostname to origin The first question is not “is the property saved.” The first question is “did this hostname enter the factory, which version is live on this network, and which stamp fired.” Path · which fork is this ticket Notice: the diamond is not allow/deny. It is “which object is live on which network?” Delivery and protection are two version counters. Flow 2 · official factory order Hostname CNAME to activated property to WAF and behaviors to origin or deny DNS → edge → version lookup → stamps → answer 1 DNS CNAME? On edge? edgekey.net yes 2 Load the version active on THIS network staging ≠ production · save ≠ this box 3 Hostnames property file 4 Default Rule origin + CP code 5 Child rules matches → behaviors 6 Security config version 7 WAF / Bot / API / rate deny stops here 8 ANSWER — cache key or origin.example.test:443 HIT never fetches origin · MISS / no-store does · origin health is a different fact from rule action no → origin A record · no edge ticket Official facts students invert 1. Staging does not serve end-user traffic. Activations there usually finish in 2–3 minutes and skip phased rollout. 2. Production is two phases: live-traffic servers (usually under 4 minutes), then Pending - Full Rollout (up to 15 minutes). 3. Fast Fallback reactivates the last active property version for 60 minutes after full rollout — property only, not the WAF. 4. You cannot edit an active property or an activated security configuration. Clone a version. Then activate a named network. 5. One hostname, one active property, one active security configuration. Version numbers matching is coincidence. Source: How activation works · Key concepts and terms · Mitigate threats against your web applications Default Rule always carries Origin Server + Content Provider Code. Child rules override with match criteria, up to five levels. Read left → right, then the green answer bar. Decision diamond = “does DNS send this hostname to the edge?” Red dashed = A record to origin, no factory. #1 student trap — I saved it, so it’s live Official: you freely modify a property version, along with its hostnames and rules, up until you activate it . Following activation you create a new version. v19 sitting in the editor with a green Save does not replace production v17. Staging-active v19 does not replace production v17 either. Quote the network on the Activate tab before you tell the business the TTL change is live. ## 4. How to choose the desk you touch You are not choosing a product. You are choosing which object the factory is allowed to rewrite on this hostname. Choice Use when Do not use when Proof you were right Property version Origin hostname, Forward Host Header, cache TTL, CP code, property hostname, Enhanced TLS / edge hostname. A 403 names a WAF / Bot / API rule. Those are not Default Rule behaviors. Activation History = Active on the network you meant. X-Cache or origin host matches the new behavior. Activate on Staging Every property or security change, first. ESN is the test network. You tell the business “it’s live.” Staging does not serve end users. X-Akamai-Staging on a staging-pointed client. Production Activation History unchanged. Activate on Production Staging tests passed. Change window open. Notes + notify email filled. You only clicked Save, or you only staged. Activate tab shows this version on Production. Status leaves Pending - Full Rollout. Security config version WAF, custom rules, API request constraints, Bot, rate, IP/Geo. Clone, do not edit the activated one. Wrong origin, TLS, hostname, or cache TTL. That is the property. Request sample: rule + action + status. Dummy: REQ-LAB-1042 / API-Schema-Mismatch / deny / 403. Network list New office NAT, shared allow/block. Official shared resource — one edit updates every policy that uses it. You clone the property to add a CIDR. List members + last-update. HQ still works; the new NAT now matches. Cache / purge Stale HTML or JS after a release. HIT is the edge copy, not a failed deploy. You roll back the WAF to “refresh the page.” Pragma akamai-x-cache-on then a new MISS → HIT on that URL. Fast Fallback Inside 60 minutes of a completed production property activation, previous version was good. A security-config mistake, or you missed the window. Then activate the older property version yourself. Activate tab → Fast Fallback to last active version. Property only. Official Default Rule always carries two mandatory behaviors you cannot delete: Origin Server and Content Provider Code . Child rules add match criteria (the IFs) and extra behaviors (the THENs), arranged up to five levels deep. Changing the Cache Key Hostname on a new version invalidates the existing cache key — official warning: edge servers will re-fetch from origin at a level that can spike bandwidth. Do not “fix a 403” by rotating the cache key. Operator tip — quote these two sentences Official Property Manager: you cannot edit a property that is already active on staging or production — create a new version. Official security config: you cannot edit an activated configuration either — create a new version, then click Activate and pick Network (Staging to test, or Production to go live). Put both sentences in the ticket before you touch a control. ## 5. Runbook Side A → B → C Goal: stand up lab hostname app.example.test the same way production is drawn, stamp it, then prove both live versions. All values are documentation / lab only. ### Prerequisites A delivery configuration (property) that can activate on at least staging. Official first-config help: you must have a delivery configuration active on the platform, on at least the staging environment, before you create the security configuration.

- Property hostname you are allowed to protect. Official: one hostname is covered by only one active security configuration at a time. One property at a time applies to any given hostname.

- DNS you can change: CNAME app.example.test → app.example.test.edgekey.net . Origin hostname origin.example.test already resolves to the box.

- Change window if you will activate production. Staging is the test network.

- Lab-only notify email ops@lab.example . No customer tenant IDs.

### Side A — hostname and the property (building the factory floor)

 Primary source:  Key concepts and terms  +  Create a brand-new property . Path:  Content delivery › CDN › Properties .

     https://control.akamai.com/apps/property-manager/#/property/app.example.test/version/19

     Training mock · not live

       Content delivery › CDN › Properties › app.example.test › Version 19

### Property Manager Editor

        Property hostnames  Default Rule  Activate

          Property hostname  app.example.test

          Edge hostname  app.example.test.edgekey.net

          Secure Network  Enhanced TLS

          IP version  IPv4 + IPv6 (dual stack)

          Origin Server Hostname  mandatory   origin.example.test

          Forward Host Header  Incoming Host Header (Default)

          Content Provider Code  mandatory   12345 · app-example-test

          Caching  Cache · TTL honor origin

       Official: Origin Server and Content Provider Code cannot be deleted from the Default Rule. Property hostname change increments the version and needs its own activation.

         Save
         Save · then Activate tab

    Source:  Key concepts and terms — property hostname, edge hostname, origin hostname. Origin Server + Content Provider Code are mandatory Default Rule behaviors. Dummy values only.  Click next:  Save is a draft. Open the Activate tab.

- #### Create or clone — never edit the live version Content delivery › CDN › Properties . Filter by Property or Hostname app.example.test . Click the Property Name. Official: if the version is currently active or has been deactivated on either network, the view is read-only. Edit new version from the last production version (lab: v17 → v19). First-time path: +Create › Property or +New Property , pick the product, name it, pick the group.

- #### Bind the three hostnames Property hostname app.example.test associates to edge hostname app.example.test.edgekey.net (Enhanced TLS — PCI-compliant HTTPS, edgekey.net suffix). Default Rule → Origin Server = Your Origin, Origin Server Hostname origin.example.test . Forward Host Header = Incoming Host Header (Default) unless the origin listens for the origin hostname. Do not set the origin hostname equal to the property hostname.

- #### Stamp the mandatory behaviors Content Provider Code 12345 — official: CP codes identify usage, reporting, and billing; the behavior cannot be deleted from the Default Rule. Review Caching. Child rules are for path-specific overrides, not a second origin for “just this API” unless you have match criteria and a change window. Changing Cache Key Hostname on an already-cached site will invalidate the key and re-pull origin.

- #### Save, then stop Save writes the draft. Side B stamps protection. Side C activates a named network. A green Save is not production.

### Side B — behaviors then WAF stamps (printing the ticket)

 Primary source:  Mitigate threats against your web applications . Path:  Security › Web app & API protection › Web Security . This is a different version counter from the property.

     https://control.akamai.com/apps/securitycenter/#/config/CFG-LAB-01/17/activate

     Training mock · not live

       Security › Web app & API protection › Web Security › CFG-LAB-01 › Activate

### Activate security configuration

        Policies  Match targets  Activate

          Security Configuration  CFG-LAB-01

          Security Configuration version  17

          Network  Production (go live)

          Hostnames  app.example.test

          WAF  stamp   On · first-config Alert

          Bot  stamp   On · monitor

          API request constraints  On · api-protectors

          Notification email  ops@lab.example

        Activation notes  Lab only — INC-8814 scoped exception for X-App-Build. Not a customer note.

        Staging to test  Activate

       Official first-config: Activate → Select Network (Staging to test, or Production to go live) → notes → Activate. This does not activate the property.

    Source:  Mitigate threats against your web applications — Create New Security Configuration, Use recommended presets, Activate + Network dropdown. Dummy values only.  Click next:  confirm version number and Network before Activate.

- #### Create or clone the security version First-time: Create New Security Configuration → Use recommended presets → Create. Existing: create a new version from the last production version. You cannot edit the activated one. Hostnames on this config must include app.example.test . Official: one security configuration can cover many hostnames; a single hostname is covered by only one active security configuration at a time.

- #### Set protections, then set the action A Security Policy holds WAF (web application attacks), custom rules, API request constraints, rate policies, IP/Geo (network lists), and Bot. Official first-config starts protections in Alert so you can tune. Deny / Block is a later, change-controlled action. Match targets (Advanced Security Management) decide which policy applies to which hostname or path. Official: nothing is protected without a match target when that model applies; order more specific match criteria last.

- #### Know the shared resources Official shared resources update in one place: Network Lists (IP / geo), Rate Policies (too fast to be human), Client Reputation Profiles (ASM). A new office NAT is a network-list edit, not a property clone. Rate slowdown on /login is not a 403.

- #### Activate the security version on a named network Upper right: Activate . Select Network (Staging to test, or Production to go live). Enter notes. Click Activate. This does not activate the property. Property v17 can stay production-active while security v17 rolls independently — or the reverse. Quote both.

  Dummy lab — same allowlist as the practice dashboard
 show property app.example.test
show security-config
show request REQ-LAB-1042
show origin forward
show denied-request-count
show network-list NL-OFFICE

### Side C — activate named networks and prove origin

 Primary source:  Activate on staging  +  Activate on production  +  How activation works .

     https://control.akamai.com/apps/property-manager/#/property/app.example.test/version/19/activate

     Training mock · not live

       Content delivery › CDN › Properties › app.example.test › Version 19 › Activate

### Activate v19

        Property details  Activate  Activation History

          Currently Active — Staging  v19

          Currently Active — Production  v17

          Fast activation  Enabled (default)

          Cancel activation if error rate increases  Selected (keep on)

          Override block of hostname moves  Off

          Notify via email  ops@lab.example

        Notes  Lab only — INC-8814 cache TTL. Not a customer note.

        Activate v19 on Staging  Activate v19 on Production

       Two buttons. Staging is already v19. Production is still v17. Save already happened. Production activate has not.

    Source:  Activate on staging / Activate on production — Fast activation, Cancel activation if error rate increases, Validation details, Override block of hostname moves, Notes, Notify via email.  Click next:  do not press Production until staging tests pass.

- #### Activate v# on Staging first Open the version → Activate tab → Activate v# on Staging . Official fields: Fast activation (on by default), Cancel activation if error rate increases, Validation details, Override block of hostname moves, Notes, Notify via email. Staging (ESN) is smaller, serves no end-user traffic, skips phased rollout, usually finishes in 2–3 minutes. Errors block activation; warnings can be acknowledged.

- #### Point a test client at staging, then prove Official test help returns X-Akamai-Staging when you are on the staging network. Use Pragma debugging: Staging proof — dummy hostname only curl -sI "https://app.example.test/health" \ -H "Pragma: akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-get-request-id, akamai-x-get-cache-key" # expect on a staging-pointed client: # X-Akamai-Staging: ESSL # X-Cache: TCP_MISS from ... # X-Akamai-Request-ID: ... If X-Akamai-Staging is absent you are not on ESN. Do not call that production proof.

- #### Activate v# on Production only after tests Official assumes the property is already staging-active. Same popup fields. Phase 1 updates live-traffic servers (usually under 4 minutes, 90% in 3–4). Phase 2 is Pending - Full Rollout (up to 15 minutes). New users hitting cold geos may still see the previous version until those servers update. Cancel restores the last active version. Fast Fallback is available for 60 minutes after full rollout — Fast Fallback to last active version .

- #### CNAME go-live, then prove both objects Official go-live: replace the existing DNS record with a CNAME whose value is the edge hostname you assigned. Dummy: app.example.test CNAME app.example.test.edgekey.net . Then:

  Live factory — dummy lab, not a customer tenant
 show property app.example.test
# version=17 production=active staging=19
# cpcode=12345 secure-network=enhanced-tls
# edge-hostname=app.example.test.edgekey.net
# origin=origin.example.test

show security-config
# config=CFG-LAB-01 version=17
# waf=on bot=on api=on mode=production

show request REQ-LAB-1042
# path=/api/orders action=deny rule=API-Schema-Mismatch
# policy=api-protectors status=403

show origin forward
# health=ok last-error=none

   Proof · Activation History cockpit

   Notice: juniors stare at Save. Seniors stare at Activation History — Active on Production — then the request sample.

   Green success on this runbook

   Property version quoted with network (dummy: v17 production=active). Security config version quoted with mode (dummy: CFG-LAB-01 v17 production). One request sample with rule, action, status. Origin forward health named if someone blamed origin. Activation History shows  Active , not only Pending - Full Rollout, and not only staging. Pilot client on the intended network gets the new behavior. Staging-only proof is not production proof.

   Error-rate cancel is a safety rail, not a mystery rollback

   Official HTTP error rate limit (properties that are not exceptions, and that average at least 1000 hits/s): activation can auto-cancel if 2xx/total drops 90%, if 2xx+3xx/total drops 90%, or if 4xx+5xx/total increases more than 10×. If you  expect  more 4xx because you turned WAF to deny or added geo-blocking, deselect  Cancel activation if error rate increases  on purpose. Do not deselect it because “activations keep failing” and you have not read Validation details.

## 6. Runtime after go-live

 After both objects are production-active, one client request walks the factory. DNS CNAMEs the property hostname to the edge hostname. Mapping picks an edge. The edge loads the property version that is production-active — not the highest-numbered draft. Match target / hostname association selects the security policy. Protections evaluate. A deny stops before origin. An Alert / monitor logs and continues. Cache is a property behavior after (or instead of) origin.

   Flow 3 · runtime after go-live

       Client to hostname to activated property to WAF stamps to origin or cache

- client → app.example.test → v17 + CFG-LAB-01 → origin.example.test Client CNAME door Property v17 Security v17 Origin or cache 1 Browser looks up app.example.test. CNAME to app.example.test.edgekey.net puts the request on Enhanced TLS edge. 2 Edge loads the property version that is production-active. Staging edge is a different network. A v19 draft is invisible here. 3 Default Rule applies Origin Server + CP code. Child rules add matches. Behaviors are THENs. This is delivery, not WAF. 4 Match target selects CFG-LAB-01. Policy evaluates IP/Geo, rate, Bot, WAF, API constraints. Deny stops — origin never sees the body. 5 Alert / monitor logs and continues. Dummy Bot category Web Scrapers is monitor — that is not your 403. 6 Allow → cache key or origin.example.test:443 with Forward Host Header. Origin health ≠ rule action. HIT ≠ failed deploy. Save ≠ activate trap: v19 sits in Property Manager while production still serves v17 Customers never saw the TTL change. Activate Production, or stop claiming the edit is live. Deny never reaches origin. Monitor does. Cache is a property behavior. Do not mix those three sentences on the bridge. Includes are a related factory: official snippets of a property you can version and activate independently of the parent. They have no hostnames of their own. If a behavior lives in an include, activating the parent property is not enough — the include needs its own activation. Hostname buckets (SaaS/PaaS) let you add or remove thousands of property hostnames without incrementing the property version. This lesson’s lab hostname is a normal versioned hostname, not a bucket. Night shift: do not re-architect the factory. Open the evidence desk and pick the first tool — Activation History, Web Security Analytics Samples, CP code / hostname, GREP, or Edge CURL / Pragma. ## 7. Traps + proof checklist Symptom Looks like Actually First move 403 after a client release Roll the property or the app Security stamp — WAF / Bot / API schema Request sample + security version + network. Dummy: REQ-LAB-1042 Edit saved, customers unchanged Akamai ignores cache headers Save is not activate. Production still serves the last activated version Activate tab — which version is production-active Staging OK, production old “I activated it” Two networks. Staging (ESN) does not serve end users Activate v# on Production. Quote the network Login slow, no 403 WAF block / restart origin Rate slowdown or origin time. Slowdown is not a 403 Rate policy action, then origin time One new office blocked Missing property hostname Network list — shared security resource List members and last-update. Do not clone the property Stale page after deploy Failed origin release Cache HIT on the old object Pragma X-Cache, then purge that key — not the WAF Activation auto-cancelled Platform bug Error-rate limit, or Validation details errors Read the cancel reason. Do not blindly deselect the safety check Origin loop / 301 storm WAF redirect Origin hostname = property hostname, or Forward Host Header wrong Three-hostname check on the Default Rule No edge headers at all Akamai is down DNS still an A record to origin. Factory door closed CNAME to the edge hostname before you open Protector Matching version numbers Property 17 = security 17, so they shipped together Two objects, two Activate buttons Quote both, then the network Do not ship with these mistakes Treating property version and security config version as the same number.

- Activating staging and telling the business production is done.

- Disabling App & API Protector to “prove” a 403.

- Restarting origin for a schema deny while origin health is ok.

- Editing the live version instead of cloning — the UI will not let you, and fighting that is wasted time.

- Rotating Cache Key Hostname to “clear a 403.” Official: that invalidates cache and can spike origin.

- Using Fast Fallback for a WAF mistake. Fast Fallback is a property-version revert.

   Proof checklist — the factory is actually working

- Property hostname CNAMEs to the edge hostname you assigned ( app.example.test.edgekey.net in lab).

- Property version quoted with network (dummy: v17 production=active). Activate tab and Activation History agree.

- Security config version quoted with mode (dummy: CFG-LAB-01 v17 production).

- One request sample with rule, action, status (dummy: REQ-LAB-1042 / API-Schema-Mismatch / deny / 403) — or a 200 with X-Cache matching intent.

- Origin Server Hostname + Forward Host Header + CP code on the Default Rule are the values you think they are.

- Origin forward health named if someone blamed origin.

- If you activated production: Activation History shows Active , not only Pending - Full Rollout, and not only staging.

- Pilot client on the intended network gets the new behavior. Staging-only proof is not production proof.

- Change is a scoped version + named-network activate — not “disable Protector.”

   Interview close you can steal

   Akamai is an edge property factory. The property hostname CNAME is the door. Activation on a named network prints the ticket. WAF and Property Manager behaviors stamp it. Origin or cache answers. I quote property version and security config version separately, then the rule, then the network. Save is not activate. Staging is not production. I would not disable Protector to prove a 403.

 Related:  Evidence desk — first tool + proof field  ·  Akamai practice dashboard  ·  WAAP ASE policy tuning  ·  App & API Protector Hybrid runbook

## Knowledge check

   Six judgment questions. Map each miss back to the section named in the reason.

       Q1
       You edited property v19 and hit Save. Production still serves old cache headers. Why?

           Akamai ignores cache headers on Enhanced TLS
           Save is not activate — production still serves the last activated version
           You must disable the WAF before cache changes apply
           Property versions cannot change cache TTLs

       Correct:  b . Official: you can modify a version until you activate it. Production serves the last activated version. Re-read Mental model and Side C.

       Q2
       A user types  app.example.test . What actually puts that request onto the Akamai factory?

           An A record pointing at origin.example.test
           Saving the property in Property Manager
           Activating the security configuration on staging
           A CNAME from the property hostname to the edge hostname (lab: app.example.test.edgekey.net on Enhanced TLS)

       Correct:  d . Official Key concepts: replace the origin A record with a CNAME to the edge hostname. An A record to origin never prints an edge ticket. Re-read Why and Mental model — the door.

       Q3
       Mobile app release today.  /api/orders  returns 403. Origin team says the box is fine. First question?

           Which control fired (WAF / Bot / API schema) and which security config version is production-active
           Rollback the property to v16 immediately
           Disable App & API Protector to prove it
           Purge the whole CP code

       Correct:  a . A 403 with a healthy origin is a stamp, not a delivery rollback. Fix the payload or stage a scoped exception. Re-read How to choose and Side B.

       Q4
       You activated property v19 on staging. Product owner says “it’s live.” What do you say?

           Staging and production share one network, so yes
           Staging is not production — two networks; I will quote which one I activated
           Wait 60 minutes and it promotes itself
           Only security configs need a production activate

       Correct:  b . Official: two networks. Staging (ESN) does not serve end-user traffic. Fast Fallback is a 60-minute property revert after production, not a promotion. Re-read Factory path and Side C.

       Q5
       When do you change the property instead of the security config?

           Whenever any 403 appears
           To add a WAF exception for a new header
           To add a new office IP to an allowlist
           Delivery: origin, cache, hostnames, CP code, TLS — not WAF / Bot / API rules

       Correct:  d . Property = delivery behaviors. Security config = protection stamps. Network lists are shared security resources. Re-read How to choose.

       Q6
       What proves  app.example.test  is actually running the factory you think it is?

           A green Save toast on property v19
           A staging activation email, because staging mirrors production
           Activation History Active on Production for the intended property version, the security config version on Production, plus a request sample (or X-Cache) that matches intent
           Property version and security config version happen to share the same number

       Correct:  c . Save is a draft. Staging is a different network. Matching numbers are coincidence. Re-read Side C and the proof checklist.

       Check answers
       Reset

## Sources

- Key concepts and terms — property / origin / edge hostnames, CNAME door, versions, activations, rules, matches, behaviors, Default Rule

- How activation works — staging vs production, phases, times, Fast Fallback 60 minutes, error-rate limit, cannot edit active

- Activate on staging — Content delivery › CDN › Properties › Version › Activate tab › Activate v# on Staging

- Activate on production — Activate v# on Production, then CNAME the property hostname to the edge hostname

- Create a brand-new property — +Create / +New Property, product, group, version 1 editor

- Origin Server — mandatory Default Rule behavior, Origin Server Hostname, Forward Host Header, Cache Key Hostname warning

- Content Provider Code — mandatory Default Rule behavior, reporting and billing

- Property configuration logic — obligatory Default Rule settings include CP codes and origin behaviors

- Enhanced Debug — Pragma akamai-x-cache-on , akamai-x-get-request-id , X-Cache , X-Akamai-Request-ID

- Test your property — X-Akamai-Staging on ESN, Pragma debug curl

- Mitigate threats against your web applications — first security config, Alert presets, Activate + Network, one hostname / one active security config

 Related:  Akamai evidence desk  ·  Akamai practice dashboard  ·  Run dummy lab  ·  WAAP ASE policy tuning

 Dummy lab: every command on this page matches the allowlist on  /interview/akamai-app-api-security#simulator  (simulator key  akamai ). Confirm live syntax before you type on a real tenant. Official sources are techdocs.akamai.com only.

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt