Scenario: During application troubleshooting, a Citrix Engineer notices that response traffic received from a protected web application is NOT matching what the web server is sending out. The auditor is concerned that Man-In-The-Middle attack is in progress.
Which action is the Citrix Web App Firewall performing that would trigger this false positive?