Refer to the exhibit. Where is the MIME type that should be followed indicated?

The correct answer is B. x-content-type-options. X-Content-Type-Options (option B) is the HTTP response header that instructs browsers to follow (not override) the declared MIME type in the Content-Type header. When set to nosniff, it prevents browsers from "MIME-sniffing" a response away from the declared content type, which…

Web Application Security

Question

Refer to the exhibit. Where is the MIME type that should be followed indicated?

Options

Ax-xss-protection
Bx-content-type-options
Cx-test-debug
Dstrict-transport-security

How the community answered

(30 responses)

A
3% (1)
B
87% (26)
C
7% (2)
D
3% (1)

Explanation

X-Content-Type-Options (option B) is the HTTP response header that instructs browsers to follow (not override) the declared MIME type in the Content-Type header. When set to nosniff, it prevents browsers from "MIME-sniffing" a response away from the declared content type, which closes a class of content-injection attacks.

Why the distractors are wrong:

A. X-XSS-Protection - Controls the browser's built-in cross-site scripting filter; unrelated to MIME types.
C. X-Test-Debug - Not a real HTTP security header; a fabricated distractor.
D. Strict-Transport-Security - Enforces HTTPS connections (HSTS); has nothing to do with MIME types.

Memory tip: The header name literally contains "Content-Type" - the same term used for MIME types - making it the only option that could logically govern MIME type behavior.

Topics

#HTTP Security Headers#MIME Type Enforcement#Browser Security#Content-Type

Community Discussion

No community discussion yet for this question.

Full 350-201(NEW-127Q) Practice