{
  "id": "08",
  "content": [
    {
      "type": "heading",
      "text": "Common Security Headers"
    },
    {
      "type": "text",
      "html": "Add headers to reduce common risks."
    },
    {
      "type": "text",
      "html": "<pre><code>&lt;IfModule mod_headers.c&gt;\nHeader set X-Content-Type-Options \"nosniff\"\nHeader set X-Frame-Options \"SAMEORIGIN\"\nHeader set Referrer-Policy \"strict-origin-when-cross-origin\"\nHeader set Permissions-Policy \"geolocation=(), camera=()\"\n# Content-Security-Policy must be tailored to your site\n# Header set Content-Security-Policy \"default-src 'self'\"\n&lt;/IfModule&gt;</code></pre>"
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "Which header prevents MIME sniffing?",
        "options": [
          {
            "id": "a",
            "text": "X-Content-Type-Options: nosniff"
          },
          {
            "id": "b",
            "text": "X-Frame-Options: SAMEORIGIN"
          },
          {
            "id": "c",
            "text": "Referrer-Policy"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "CSP should be:",
        "options": [
          {
            "id": "a",
            "text": "A generic one-size-fits-all"
          },
          {
            "id": "b",
            "text": "Tailored to your resources"
          },
          {
            "id": "c",
            "text": "Disabled on HTTPS"
          }
        ],
        "correct": [
          "b"
        ]
      }
    ]
  }
}