42 Web Security Headers questions from the Security bank, written for Indian campus drives and tech interviews. Every question has a verified answer and an AI-tutor explanation on placd.
Free to start: the 2-minute IT readiness check — six questions and a result.
A.header controlling how much referrer information browsers send with requests
B.CSP mode that reports violations without blocking, used to tune a policy before enforcing
C.Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
D.header restricting which sources of scripts, styles, and other content a page may load
Answer + AI explanation with Pro
2. Which term means: "header restricting which sources of scripts, styles, and other content a page may load"?
Junior
A.X-Content-Type-Options
B.Content-Security-Policy (CSP)
C.SameSite cookie attribute
D.Same-origin policy
Answer + AI explanation with Pro
3. Which statement is correct?
Junior
A.Content-Security-Policy (CSP) — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
B.Content-Security-Policy (CSP) — header restricting which sources of scripts, styles, and other content a page may load
C.Content-Security-Policy (CSP) — integrity attribute letting browsers verify a fetched script/style matches an expected hash
D.Content-Security-Policy (CSP) — HSTS header instructing browsers to only connect over HTTPS for a set duration
Answer + AI explanation with Pro
4. What is X-Frame-Options?
Junior
A.header controlling whether a page can be framed, defending against clickjacking
B.cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
C.header restricting which sources of scripts, styles, and other content a page may load
D.HSTS header instructing browsers to only connect over HTTPS for a set duration
Answer + AI explanation with Pro
5. Which term means: "header controlling whether a page can be framed, defending against clickjacking"?
Junior
A.Subresource Integrity (SRI)
B.X-Frame-Options
C.Strict-Transport-Security
D.Same-origin policy
Answer + AI explanation with Pro
6. Which statement is correct?
Junior
A.X-Frame-Options — header controlling how much referrer information browsers send with requests
B.X-Frame-Options — header controlling whether a page can be framed, defending against clickjacking
C.X-Frame-Options — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
D.X-Frame-Options — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
Answer + AI explanation with Pro
7. What is Strict-Transport-Security?
Junior
A.flag ensuring a cookie is only sent over HTTPS connections
B.HSTS header instructing browsers to only connect over HTTPS for a set duration
C.CSP mode that reports violations without blocking, used to tune a policy before enforcing
D.browser rule restricting how a document from one origin can interact with resources from another
Answer + AI explanation with Pro
8. Which term means: "HSTS header instructing browsers to only connect over HTTPS for a set duration"?
Junior
A.Secure cookie flag
B.CSP nonce
C.Strict-Transport-Security
D.X-Frame-Options
Answer + AI explanation with Pro
9. Which statement is correct?
Junior
A.Strict-Transport-Security — CSP mode that reports violations without blocking, used to tune a policy before enforcing
B.Strict-Transport-Security — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
C.Strict-Transport-Security — header controlling whether a page can be framed, defending against clickjacking
D.Strict-Transport-Security — HSTS header instructing browsers to only connect over HTTPS for a set duration
Answer + AI explanation with Pro
10. What is X-Content-Type-Options?
Junior
A.flag preventing JavaScript from reading a cookie, reducing token theft via XSS
B.header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
C.header controlling which browser features (camera, geolocation, etc.) a page may use
D.per-response random token allowing only matching inline scripts to execute under CSP
Answer + AI explanation with Pro
11. Which term means: "header set to nosniff to stop browsers from MIME-sniffing responses to a different content type"?
Junior
A.Content-Security-Policy (CSP)
B.X-Content-Type-Options
C.Permissions-Policy
D.CSP report-only mode
Answer + AI explanation with Pro
12. Which statement is correct?
Junior
A.X-Content-Type-Options — integrity attribute letting browsers verify a fetched script/style matches an expected hash
B.X-Content-Type-Options — browser rule restricting how a document from one origin can interact with resources from another
C.X-Content-Type-Options — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
D.X-Content-Type-Options — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
Answer + AI explanation with Pro
13. What is Referrer-Policy?
Junior
A.header controlling how much referrer information browsers send with requests
B.integrity attribute letting browsers verify a fetched script/style matches an expected hash
C.flag ensuring a cookie is only sent over HTTPS connections
D.Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
Answer + AI explanation with Pro
14. Which term means: "header controlling how much referrer information browsers send with requests"?
Junior
A.Secure cookie flag
B.CSP nonce
C.Subresource Integrity (SRI)
D.Referrer-Policy
Answer + AI explanation with Pro
15. Which statement is correct?
Junior
A.Referrer-Policy — header controlling which browser features (camera, geolocation, etc.) a page may use
B.Referrer-Policy — browser rule restricting how a document from one origin can interact with resources from another
C.Referrer-Policy — flag ensuring a cookie is only sent over HTTPS connections
D.Referrer-Policy — header controlling how much referrer information browsers send with requests
Answer + AI explanation with Pro
16. What is SameSite cookie attribute?
Mid
A.cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
B.browser rule restricting how a document from one origin can interact with resources from another
C.flag ensuring a cookie is only sent over HTTPS connections
D.header controlling how much referrer information browsers send with requests
Answer + AI explanation with Pro
17. Which term means: "cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF"?
Mid
A.X-Frame-Options
B.Permissions-Policy
C.X-Content-Type-Options
D.SameSite cookie attribute
Answer + AI explanation with Pro
18. Which statement is correct?
Mid
A.SameSite cookie attribute — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
B.SameSite cookie attribute — per-response random token allowing only matching inline scripts to execute under CSP
C.SameSite cookie attribute — flag ensuring a cookie is only sent over HTTPS connections
D.SameSite cookie attribute — HSTS header instructing browsers to only connect over HTTPS for a set duration
Answer + AI explanation with Pro
19. What is HttpOnly cookie flag?
Mid
A.header controlling which browser features (camera, geolocation, etc.) a page may use
B.per-response random token allowing only matching inline scripts to execute under CSP
C.browser rule restricting how a document from one origin can interact with resources from another
D.flag preventing JavaScript from reading a cookie, reducing token theft via XSS
Answer + AI explanation with Pro
20. Which term means: "flag preventing JavaScript from reading a cookie, reducing token theft via XSS"?
Mid
A.X-Content-Type-Options
B.Strict-Transport-Security
C.HttpOnly cookie flag
D.X-Frame-Options
Answer + AI explanation with Pro
21. Which statement is correct?
Mid
A.HttpOnly cookie flag — header controlling how much referrer information browsers send with requests
B.HttpOnly cookie flag — integrity attribute letting browsers verify a fetched script/style matches an expected hash
C.HttpOnly cookie flag — flag preventing JavaScript from reading a cookie, reducing token theft via XSS
D.HttpOnly cookie flag — flag ensuring a cookie is only sent over HTTPS connections
Answer + AI explanation with Pro
22. What is Secure cookie flag?
Mid
A.header controlling which browser features (camera, geolocation, etc.) a page may use
B.flag ensuring a cookie is only sent over HTTPS connections
C.integrity attribute letting browsers verify a fetched script/style matches an expected hash
D.header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
Answer + AI explanation with Pro
23. Which term means: "flag ensuring a cookie is only sent over HTTPS connections"?
Mid
A.HttpOnly cookie flag
B.Permissions-Policy
C.Secure cookie flag
D.Strict-Transport-Security
Answer + AI explanation with Pro
24. Which statement is correct?
Mid
A.Secure cookie flag — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
B.Secure cookie flag — flag ensuring a cookie is only sent over HTTPS connections
C.Secure cookie flag — header set to nosniff to stop browsers from MIME-sniffing responses to a different content type
D.Secure cookie flag — header controlling whether a page can be framed, defending against clickjacking
Answer + AI explanation with Pro
25. What is CORS?
Mid
A.header controlling whether a page can be framed, defending against clickjacking
B.HSTS header instructing browsers to only connect over HTTPS for a set duration
C.Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
D.header restricting which sources of scripts, styles, and other content a page may load
Answer + AI explanation with Pro
26. Which term means: "Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way"?
Mid
A.X-Frame-Options
B.HttpOnly cookie flag
C.Strict-Transport-Security
D.CORS
Answer + AI explanation with Pro
27. Which statement is correct?
Mid
A.CORS — per-response random token allowing only matching inline scripts to execute under CSP
B.CORS — browser rule restricting how a document from one origin can interact with resources from another
C.CORS — Cross-Origin Resource Sharing, headers that relax the same-origin policy in a controlled way
D.CORS — header controlling how much referrer information browsers send with requests
Answer + AI explanation with Pro
28. What is Permissions-Policy?
Mid
A.browser rule restricting how a document from one origin can interact with resources from another
B.header controlling which browser features (camera, geolocation, etc.) a page may use
C.HSTS header instructing browsers to only connect over HTTPS for a set duration
D.integrity attribute letting browsers verify a fetched script/style matches an expected hash
Answer + AI explanation with Pro
29. Which term means: "header controlling which browser features (camera, geolocation, etc.) a page may use"?
Mid
A.CSP report-only mode
B.Permissions-Policy
C.HttpOnly cookie flag
D.CSP nonce
Answer + AI explanation with Pro
30. Which statement is correct?
Mid
A.Permissions-Policy — header controlling which browser features (camera, geolocation, etc.) a page may use
B.Permissions-Policy — browser rule restricting how a document from one origin can interact with resources from another
C.Permissions-Policy — header controlling how much referrer information browsers send with requests
D.Permissions-Policy — cookie flag (Lax/Strict/None) limiting cross-site sending to mitigate CSRF
Answer + AI explanation with Pro
Showing 30 of 42 Web Security Headers questions — the full set, with answers, explanations and an AI tutor on every question, is inside.
Free to start
Start with a free readiness check
Sign up free for the 2-minute IT readiness check and a scored result. Answers, explanations and the AI tutor on every Web Security Headers question come with Pro.