Content Security Policy (CSP) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of Content Security Policy (CSP)?

Choose the best description of what CSP is designed to do.

A To manage user authentication and sessions

B To prevent unauthorized scripts and resources from loading on a web page

C To speed up website loading by caching resources

D To encrypt all data sent between a browser and server

💡 Hint

Think about how CSP controls what content a browser can load.

CSP is a security feature that helps prevent attacks like cross-site scripting by restricting which scripts and resources can run or load on a web page.

📋 Factual

intermediate

Which HTTP header is used to implement Content Security Policy?

Select the correct HTTP header name that delivers CSP rules to browsers.

A X-Content-Security-Policy

B X-Frame-Options

C Strict-Transport-Security

D Content-Security-Policy

💡 Hint

Look for the header that directly mentions 'Content-Security-Policy'.

The standard header for CSP is 'Content-Security-Policy'. Older browsers used 'X-Content-Security-Policy', but it is deprecated.

🔍 Analysis

advanced

What will happen if a CSP rule includes script-src 'self' but the page tries to load an inline script?

Analyze the effect of this CSP directive on inline scripts.

A The inline script will run only if it has a nonce attribute

B The inline script will run normally without restrictions

C The inline script will be blocked and not executed

D The inline script will run only if it is loaded from an external trusted domain

💡 Hint

Consider what 'self' allows and how inline scripts are treated by default.

The directive script-src 'self' allows scripts only from the same origin but blocks inline scripts unless additional directives like 'unsafe-inline' or nonces are used.

❓ Comparison

advanced

Compare the difference between default-src and script-src directives in CSP.

Which statement correctly explains their relationship?

A <code>default-src</code> sets fallback rules for all resource types; <code>script-src</code> overrides it specifically for scripts

B <code>script-src</code> sets fallback rules for all resource types; <code>default-src</code> overrides it specifically for scripts

C Both directives control the same resources and have equal priority

D <code>default-src</code> only controls images; <code>script-src</code> controls scripts

💡 Hint

Think about how CSP applies general and specific rules.

default-src is a general fallback for all resource types. If a specific directive like script-src is present, it overrides default-src for scripts.

❓ Reasoning

expert

Given this CSP header: Content-Security-Policy: default-src 'none'; img-src https://images.example.com; script-src 'self' 'nonce-abc123', which of the following is true?

Analyze which resources are allowed to load or execute.

A Only images from https://images.example.com; scripts from the same origin or with nonce 'abc123' are allowed; all other resources are blocked

B All images and scripts from any source are allowed because of the nonce

C Scripts from any origin are allowed if they have the nonce; images from any source are allowed

D No resources are allowed because default-src is 'none'

💡 Hint

Consider how each directive limits resource loading and the role of 'none' in default-src.

The default-src 'none' blocks all resources by default. The img-src allows images only from the specified domain. The script-src allows scripts from the same origin ('self') or inline scripts with the specified nonce. All other resources are blocked.