Which action is the Citrix Web App Firewall performing that would trigger this false positive?

Scenario: During application troubleshooting, a Citrix Engineer notices that response traffic received from a protected web application is NOT matching what the web server is sending out. The auditor is concerned that Man-In-The-Middle attack is in progress.

Which action is the Citrix Web App Firewall performing that would trigger this false positive?
A . Removing the Last-Modified header
B . Inserting a hidden form field
C . Removing the Accept-Encoding header
D . Modifying and adding cookies in the response

View Answer

Answer: D