Certified Ethical Hacker (CEH) Practice Question

The HTTP Strict-Transport-Security (HSTS) response header tells a browser to remember that the site must only be contacted over TLS for a specified max-age (and optionally for all sub-domains). Once cached, the browser will automatically convert any future http requests to https and will reject attempts to downgrade, defeating SSL-strip style attacks. Content-Security-Policy with the upgrade-insecure-requests directive only upgrades sub-resources when the page is already loaded over HTTPS; it does not enforce an initial secure connection. X-Frame-Options prevents click-jacking by controlling framing, and X-Content-Type-Options: nosniff stops MIME sniffing-neither addresses protocol downgrades.