A manager for a hospital billing system wants to display the last four digits of a credit card number when printing invoices. Which credit card security action does this?

The Web App Firewall “X-Out” action masks every digit of a detected credit-card number except the final four, enabling invoices or receipts to display the last four digits while preventing exposure of the full number.

B. Log only records the number in logs; it does not mask what is printed.
C. Transform replaces the number with a random token for the server, not partial display to users.
D. Block rejects the entire response when a credit-card pattern is found, so nothing is shown.

1. Citrix ADC 13.0 Web App Firewall Guide – “Credit Card Protection: X-Out masks all but the last four digits” (docs.citrix.com, Credit-Card Security, para 5).

2. Citrix ADC Security Best Practices – “Use X-Out when you must display the last four digits on receipts.” (Section 4.3).