1. What is Content-Security-Policy (CSP) ? Junior A. header controlling how much referrer information browsers send with requests B. CSP mode that reports violations without blocking, used to tune a policy before enforcing C. Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way D. header restricting which sources of scripts, styles, and other content a page may load
2. Which term means: "header restricting which sources of scripts, styles, and other content a page may load"? Junior A. X-Content-Type-Options B. Content-Security-Policy (CSP) C. SameSite cookie attribute D. Same-origin policy
3. Which statement is correct? Junior A. Content-Security-Policy (CSP) — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type B. Content-Security-Policy (CSP) — header restricting which sources of scripts, styles, and other content a page may load C. Content-Security-Policy (CSP) — integrity attribute letting browsers verify a fetched script/style matches an expected hash D. Content-Security-Policy (CSP) — HSTS header instructing browsers to only connect over HTTPS for a set duration
4. What is X-Frame-Options ? Junior A. header controlling whether a page can be framed, defending against clickjacking B. cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF C. header restricting which sources of scripts, styles, and other content a page may load D. HSTS header instructing browsers to only connect over HTTPS for a set duration
5. Which term means: "header controlling whether a page can be framed, defending against clickjacking"? Junior A. Subresource Integrity (SRI) B. X-Frame-Options C. Strict-Transport-Security D. Same-origin policy
6. Which statement is correct? Junior A. X-Frame-Options — header controlling how much referrer information browsers send with requests B. X-Frame-Options — header controlling whether a page can be framed, defending against clickjacking C. X-Frame-Options — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way D. X-Frame-Options — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
7. What is Strict-Transport-Security ? Junior A. flag ensuring a cookie is only sent over HTTPS connections B. HSTS header instructing browsers to only connect over HTTPS for a set duration C. CSP mode that reports violations without blocking, used to tune a policy before enforcing D. browser rule restricting how a document from one origin can interact with resources from another
8. Which term means: "HSTS header instructing browsers to only connect over HTTPS for a set duration"? Junior A. Secure cookie flag B. CSP nonce C. Strict-Transport-Security D. X-Frame-Options
9. Which statement is correct? Junior A. Strict-Transport-Security — CSP mode that reports violations without blocking, used to tune a policy before enforcing B. Strict-Transport-Security — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way C. Strict-Transport-Security — header controlling whether a page can be framed, defending against clickjacking D. Strict-Transport-Security — HSTS header instructing browsers to only connect over HTTPS for a set duration
10. What is X-Content-Type-Options ? Junior A. flag preventing JavaScript from reading a cookie, reducing token theft via XSS B. header set to nosniff to stop browsers from MIME-sniffing responses to a different content type C. header controlling which browser features (camera, geolocation, etc.) a page may use D. per-response random token allowing only matching inline scripts to execute under CSP
11. Which term means: "header set to nosniff to stop browsers from MIME-sniffing responses to a different content type"? Junior A. Content-Security-Policy (CSP) B. X-Content-Type-Options C. Permissions-Policy D. CSP report-only mode
12. Which statement is correct? Junior A. X-Content-Type-Options — integrity attribute letting browsers verify a fetched script/style matches an expected hash B. X-Content-Type-Options — browser rule restricting how a document from one origin can interact with resources from another C. X-Content-Type-Options — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF D. X-Content-Type-Options — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
13. What is Referrer-Policy ? Junior A. header controlling how much referrer information browsers send with requests B. integrity attribute letting browsers verify a fetched script/style matches an expected hash C. flag ensuring a cookie is only sent over HTTPS connections D. Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
14. Which term means: "header controlling how much referrer information browsers send with requests"? Junior A. Secure cookie flag B. CSP nonce C. Subresource Integrity (SRI) D. Referrer-Policy
15. Which statement is correct? Junior A. Referrer-Policy — header controlling which browser features (camera, geolocation, etc.) a page may use B. Referrer-Policy — browser rule restricting how a document from one origin can interact with resources from another C. Referrer-Policy — flag ensuring a cookie is only sent over HTTPS connections D. Referrer-Policy — header controlling how much referrer information browsers send with requests
16. What is SameSite cookie attribute ? Mid A. cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF B. browser rule restricting how a document from one origin can interact with resources from another C. flag ensuring a cookie is only sent over HTTPS connections D. header controlling how much referrer information browsers send with requests
17. Which term means: "cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF"? Mid A. X-Frame-Options B. Permissions-Policy C. X-Content-Type-Options D. SameSite cookie attribute
18. Which statement is correct? Mid A. SameSite cookie attribute — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF B. SameSite cookie attribute — per-response random token allowing only matching inline scripts to execute under CSP C. SameSite cookie attribute — flag ensuring a cookie is only sent over HTTPS connections D. SameSite cookie attribute — HSTS header instructing browsers to only connect over HTTPS for a set duration
19. What is HttpOnly cookie flag ? Mid A. header controlling which browser features (camera, geolocation, etc.) a page may use B. per-response random token allowing only matching inline scripts to execute under CSP C. browser rule restricting how a document from one origin can interact with resources from another D. flag preventing JavaScript from reading a cookie, reducing token theft via XSS
20. Which term means: "flag preventing JavaScript from reading a cookie, reducing token theft via XSS"? Mid A. X-Content-Type-Options B. Strict-Transport-Security C. HttpOnly cookie flag D. X-Frame-Options
21. Which statement is correct? Mid A. HttpOnly cookie flag — header controlling how much referrer information browsers send with requests B. HttpOnly cookie flag — integrity attribute letting browsers verify a fetched script/style matches an expected hash C. HttpOnly cookie flag — flag preventing JavaScript from reading a cookie, reducing token theft via XSS D. HttpOnly cookie flag — flag ensuring a cookie is only sent over HTTPS connections
22. What is Secure cookie flag ? Mid A. header controlling which browser features (camera, geolocation, etc.) a page may use B. flag ensuring a cookie is only sent over HTTPS connections C. integrity attribute letting browsers verify a fetched script/style matches an expected hash D. header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
23. Which term means: "flag ensuring a cookie is only sent over HTTPS connections"? Mid A. HttpOnly cookie flag B. Permissions-Policy C. Secure cookie flag D. Strict-Transport-Security
24. Which statement is correct? Mid A. Secure cookie flag — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF B. Secure cookie flag — flag ensuring a cookie is only sent over HTTPS connections C. Secure cookie flag — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type D. Secure cookie flag — header controlling whether a page can be framed, defending against clickjacking
25. What is CORS ? Mid A. header controlling whether a page can be framed, defending against clickjacking B. HSTS header instructing browsers to only connect over HTTPS for a set duration C. Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way D. header restricting which sources of scripts, styles, and other content a page may load
26. Which term means: "Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way"? Mid A. X-Frame-Options B. HttpOnly cookie flag C. Strict-Transport-Security D. CORS
27. Which statement is correct? Mid A. CORS — per-response random token allowing only matching inline scripts to execute under CSP B. CORS — browser rule restricting how a document from one origin can interact with resources from another C. CORS — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way D. CORS — header controlling how much referrer information browsers send with requests
28. What is Permissions-Policy ? Mid A. browser rule restricting how a document from one origin can interact with resources from another B. header controlling which browser features (camera, geolocation, etc.) a page may use C. HSTS header instructing browsers to only connect over HTTPS for a set duration D. integrity attribute letting browsers verify a fetched script/style matches an expected hash
29. Which term means: "header controlling which browser features (camera, geolocation, etc.) a page may use"? Mid A. CSP report-only mode B. Permissions-Policy C. HttpOnly cookie flag D. CSP nonce
30. Which statement is correct? Mid A. Permissions-Policy — header controlling which browser features (camera, geolocation, etc.) a page may use B. Permissions-Policy — browser rule restricting how a document from one origin can interact with resources from another C. Permissions-Policy — header controlling how much referrer information browsers send with requests D. Permissions-Policy — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF Showing 30 of 42 Web Security Headers questions — the full set, with answers, explanations and an AI tutor on every question, is inside.