Question 1 of 30
In a web application that handles sensitive user data, the development team is implementing a Content Security Policy (CSP) to mitigate risks associated with cross-site scripting (XSS) attacks. They decide to allow scripts only from the same origin and a trusted third-party domain. However, they also want to ensure that inline scripts are blocked unless they are explicitly allowed. Which of the following CSP directives should the team use to achieve this configuration effectively?
`default-src 'self' https://trusted-third-party.com; script-src 'self' https://trusted-third-party.com; script-src-elem 'none';`
`default-src 'self'; script-src 'self' https://trusted-third-party.com; script-src-elem 'unsafe-inline';`
`default-src 'self' https://trusted-third-party.com; script-src 'unsafe-inline';`
`default-src 'self'; script-src 'self' https://trusted-third-party.com; script-src-elem 'self';`

Preparing for SalesForce Certified JavaScript Developer I Certified JavaScript Developer I? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free