Security headers and practices MCQs

The "X-Content-Type-Options" header with the value "nosniff" prevents the browser from rendering a page if MIME types are not specified, helping to mitigate MIME-based attacks.

The "Content Security Policy" (CSP) HTTP header defines the allowed sources of content that the browser may load, helping to prevent cross-site scripting (XSS) and other code injection attacks.

The "X-Frame-Options" HTTP header helps prevent clickjacking attacks by controlling who can embed the web page in an iframe.

The "Strict-Transport-Security" (HSTS) HTTP header forces the browser to load resources over HTTPS, helping to ensure secure communication.

The "Content-Security-Policy" (CSP) HTTP header can be used to instruct the browser to block mixed content, enhancing security for HTTPS pages.

The "X-XSS-Protection" header with the value "1; mode=block" helps block JavaScript code injection attempts, enhancing security against cross-site scripting (XSS) attacks.

Clickjacking is an attack that tricks users into clicking on hidden malicious elements by overlaying them on top of legitimate content.

The "Access-Control-Allow-Origin" header allows you to specify who can make cross-origin requests to your web server, helping to prevent cross-origin issues.

The "Referrer-Policy" HTTP header controls how the browser handles the "Referer" header in requests, helping to protect user privacy.

The "Expect-CT" HTTP header instructs the browser to check that certificates are valid and issued by trusted Certificate Authorities (CAs), enhancing certificate transparency.

The "Content-Encoding" header is used to specify the preferred content encoding for the response, such as gzip or deflate compression.

SQL Injection is an attack that exploits vulnerabilities in SQL queries to manipulate a database, potentially gaining unauthorized access.

The "Cross-Origin Embedder Policy" (COEP) HTTP header controls how cross-origin content is embedded in a page, enhancing security.

The "Cross-Origin-Embedder-Policy" header is used to control how cross-origin content is embedded in a page, enhancing security.

The primary goal of a Security Assessment is to identify and evaluate security risks and vulnerabilities in a system or application.

Cross-Site Scripting (XSS) is an attack that injects malicious scripts into web pages viewed by other users, potentially leading to various security risks.

The "Referrer-Policy" HTTP header controls how the browser handles the "Referer" header in requests, helping to protect user privacy.

The Cross-Site Request Forgery (CSRF) attack executes malicious actions on behalf of an authenticated user without their consent.

The primary goal of a Penetration Test is to evaluate the security of a system by simulating attacks and identifying vulnerabilities.

The "X-Content-Type-Options" header helps prevent MIME-based attacks by specifying the preferred content type for the response.

Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to perform actions without their consent.

The "Strict-Transport-Security" (HSTS) HTTP header enforces the use of HTTPS for secure user authentication.

The "Expect-CT" header instructs the browser to check that certificates are valid and issued by trusted Certificate Authorities (CAs), enhancing certificate transparency.

The "Strict-Transport-Security" (HSTS) header enforces the use of HTTPS, ensuring secure user authentication.

"MIME" stands for Multipurpose Internet Mail Extensions and is used to define the types of files that can be included as email attachments and displayed in web browsers.