What is 'X-Content-Type-Options: nosniff' and what attack does it prevent?

• A.nosniff prevents the server from detecting the browser's content type capabilities
• B.nosniff prevents DNS-based sniffing of the server's hostname
• C.nosniff prevents the browser from MIME-type sniffing - guessing a file's content type by inspecting its contents rather than trusting the Content-Type header. Without nosniff, a browser might execute an uploaded text file as JavaScript if it looks like JS. With nosniff, the browser strictly uses the declared Content-Type, preventing attackers from uploading content as one type (image, text) that gets executed as another
• D.nosniff is only needed for legacy Internet Explorer and has no effect on modern browsers