Content Security Policy quiz

Test your Content Security Policy knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.

How is a Content Security Policy typically delivered to the browser?

1. How is a Content Security Policy typically delivered to the browser?
2. What is a CSP "nonce," used as an alternative to 'unsafe-inline' for permitting specific inline scripts?
3. Why is a CSP that includes a wildcard like `script-src *` generally considered ineffective as a security control?
4. What does the `report-uri` (or its successor `report-to`) directive configure?
5. What is the primary purpose of a Content Security Policy (CSP)?
6. Why might a strict CSP unintentionally break a legitimate feature, such as a third-party embedded widget, if not carefully configured?
7. Why might a website using multiple third-party services (analytics, ads, fonts, a payment widget) find CSP configuration more challenging?
8. Why is CSP considered an important defense specifically against cross-site scripting (XSS) attacks?
9. Why is allowing `'unsafe-inline'` in a `script-src` directive generally discouraged from a security standpoint?
10. Why is CSP considered a "defense in depth" measure rather than a substitute for proper input sanitization and output encoding?
11. What is the difference between `style-src` and `style-src-elem`/`style-src-attr` in a more granular CSP configuration?
12. What does the CSP keyword `'self'` refer to when used in a directive value?

More quizzes