What is the purpose of the "Content-Security-Policy" HTTP header?

The correct answer is C. To restrict the sources of content that can be loaded by the browser. Content-Security-Policy (CSP) is a browser security mechanism that lets web servers declare which sources - domains, scripts, stylesheets, images, etc. - are trusted and allowed to load on a page. By restricting these sources, CSP prevents attacks like Cross-Site Scripting…

Question

Options

ATo enable directory browsing
BTo enforce client-side encryption
CTo restrict the sources of content that can be loaded by the browser
DTo allow cross-origin resource sharing

How the community answered

(34 responses)

A
18% (6)
B
3% (1)
C
74% (25)
D
6% (2)

Explanation

Content-Security-Policy (CSP) is a browser security mechanism that lets web servers declare which sources - domains, scripts, stylesheets, images, etc. - are trusted and allowed to load on a page. By restricting these sources, CSP prevents attacks like Cross-Site Scripting (XSS) where attackers inject malicious scripts from unauthorized origins, making C correct.

Why the distractors are wrong:

A (directory browsing) is controlled by server configuration, not HTTP headers like CSP.
B (client-side encryption) is handled by HTTPS/TLS at the transport layer, not CSP.
D (cross-origin resource sharing) is the purpose of the Access-Control-Allow-Origin (CORS) header - a common and tempting mix-up.

Memory tip: Think of CSP as a guest list at the door - only content from approved sources gets in. The word "Policy" signals it's about rules/restrictions, not enabling features like CORS or encryption.

Community Discussion

No community discussion yet for this question.

Full GWAPT Practice