Which of the following methods of protection operates on server responses?

Dynamic parameter protection operates on incoming client requests by detecting and enforcing dynamically generated form field parameters, not on server responses.

Response code validation inspects the HTTP status codes returned by the back-end server and can alert or block when unexpected codes are returned, while response scrubbing masks or removes sensitive data such as credit card numbers or SSNs from server responses before they reach the client. Both mechanisms are applied to the outbound server traffic flow in F5 BIG-IP ASM, making them distinctly response-side protections.

HTTP method validation inspects the method (GET, POST, DELETE, etc.) in incoming client requests, so it is a request-side protection rather than a response-side one.

HTTP RFC compliancy checks and metacharacter enforcement are applied to incoming client requests to ensure conformance to protocol standards, not to outbound server responses.