Content Security Policy quiz

Test your Content Security Policy knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.

Why might a website using multiple third-party services (analytics, ads, fonts, a payment widget) find CSP configuration more challenging?

1. Why might a website using multiple third-party services (analytics, ads, fonts, a payment widget) find CSP configuration more challenging?
2. What does the CSP keyword `'self'` refer to when used in a directive value?
3. What does the `default-src` CSP directive do?
4. What is the purpose of running CSP in "report-only" mode (`Content-Security-Policy-Report-Only` header) before fully enforcing a policy?
5. How is a Content Security Policy typically delivered to the browser?
6. What is the difference between `style-src` and `style-src-elem`/`style-src-attr` in a more granular CSP configuration?
7. Why is allowing `'unsafe-inline'` in a `script-src` directive generally discouraged from a security standpoint?
8. Why is CSP considered a "defense in depth" measure rather than a substitute for proper input sanitization and output encoding?
9. What is the purpose of the `upgrade-insecure-requests` CSP directive?
10. Why is CSP considered an important defense specifically against cross-site scripting (XSS) attacks?
11. What does `object-src 'none'` typically aim to prevent?
12. Why is a CSP that includes a wildcard like `script-src *` generally considered ineffective as a security control?

More quizzes