Exam AD0-E725 Topic 1 Question 7 Discussion

Comprehensive and Detailed Explanation (with official references):
The correct answer is C. Restrict which resources (scripts, styles, images) are allowed to load on the website.
Adobe Commerce supports Content Security Policy (CSP), a browser-level security feature that mitigates certain types of attacks such as Cross-Site Scripting (XSS) and data injection attacks.
By defining a CSP in Adobe Commerce, developers can control:
* Which scripts can be executed (script-src).
* Which stylesheets can be applied (style-src).
* Which images and media can be loaded (img-src, media-src).
* Whether inline scripts or styles are allowed.
This does not sanitize user input (A) nor restrict user access based on IP addresses (B). Instead, it focuses on restricting the sources of content that the browser can load.
Official Documentation Extracts:
* "Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. CSP works by restricting the sources from which content can be loaded."- Adobe Commerce DevDocs: Content Security Policy
* "A CSP allows developers to define approved sources of content that browsers can load. These policies help reduce the risk of malicious content injection in Magento storefronts."- Adobe Commerce Security Guide