What is the primary security objective of the `Content-Security-Policy` (CSP) HTTP response header?

Compressing HTML, CSS, and JavaScript assets using the Brotli or Gzip algorithms

Enforcing that users must authenticate using an enterprise single sign-on provider

Encrypting client computer hard drives using operating system APIs

Restricting the resources (scripts, styles, images, frames) that the browser is permitted to load and execute for a given page

Why is including `'unsafe-inline'` in a `script-src` directive considered a critical security weakness?

It causes modern web browsers to completely refuse to render the web page

It doubles the memory consumed by the server's CPU cache

It forces the website to downgrade from HTTPS to cleartext HTTP

It allows the execution of inline ` ` tags, javascript: URIs, and inline event handlers, undermining primary defense against XSS

Why is including `'unsafe-eval'` in a `script-src` directive discouraged in production environments?

It permits the execution of dynamic string-to-code functions like `eval()`, `Function()`, `setTimeout(string)`, and `setInterval(string)`

It causes database servers to delete tables if a syntax error occurs

It prevents web pages from using responsive mobile CSS stylesheets

It exposes the website's root private TLS key to client browsers

How does a Cryptographic Nonce work in Content Security Policy (e.g., `script-src 'nonce-rAnd0m123'`)?

The client browser generates a static password that is emailed to the webmaster

The server generates a unique, unguessable cryptographic nonce per request; only ` ` tags carrying the matching `nonce` attribute are executed

The server encrypts all HTML tags using 4096-bit RSA keys

The browser formats the computer's hard drive if a script tag lacks a nonce

What critical rule must be followed when generating CSP Nonces on the web server?

The nonce must be identical to the company's public phone number

The nonce must remain static and unchanged for at least 10 years

The nonce must be a cryptographically secure random value generated freshly on every single HTTP response (never reused or cached)

The nonce must be hardcoded into the client-side JavaScript bundle

How does Cryptographic Hash whitelisting work in CSP (e.g., `script-src 'sha256-abc...'`)?

The browser hashes the user's password and compares it to the server's database

The server hashes the physical Ethernet cable connection speed

The browser encrypts the computer monitor display buffer using AES

The browser computes the SHA-256 hash of the inline script's exact text content; if it matches the hash declared in the header, execution is permitted

Why should modern Content Security Policies strictly configure `object-src 'none'`?

To prevent users from viewing digital JPEG photographs on the website

To completely disable obsolete and dangerous plugin technologies (Flash, Java Applets, Silverlight, ActiveX) via ` `, ` `, or ` `

To block all incoming telephone calls on corporate VoIP networks

To stop web servers from communicating with relational SQL databases

Cybersecurity / MEDIUM

Web Security & HTTP Headers Implementation Quiz: 100 Technical Questions

Test your web security deployment skills with 100 practice questions on Nginx and Apache header directives, TLS ciphers, SRI, and browser policies.

100Questions

90mDuration

+1Marks / Q

NoneNegative Marks

Web Security & HTTP Headers Implementation Practice Exam

Test your ability to configure, audit, and troubleshoot production web security headers across web servers, reverse proxies, and cloud delivery networks with this 100-question practice exam. Designed for system administrators, web architects, and security engineers, this assessment focuses on practical server directives in Nginx, Apache, and Cloudflare.

Server Implementation & Security Header Topics

The questions test practical server configuration and browser interaction:

Server Configuration Directives: Implementing headers in Nginx (add_header ... always), Apache (Header always set), and edge workers; understanding inheritance rules and why nested Nginx blocks can silently drop parent headers.
Subresource Integrity (SRI): Generating and validating cryptographic integrity hashes on