What is 'X-Content-Type-Options: nosniff' and what attack does it prevent?

• A.nosniff prevents the browser from MIME-type sniffing - guessing a file's content type by inspecting its contents rather than trusting the Content-Type header. Without nosniff, a browser might execute an uploaded text file as JavaScript if it looks like JS. With nosniff, the browser strictly uses the declared Content-Type, preventing attackers from uploading content as one type (image, text) that gets executed as another
• B.nosniff prevents the server from detecting the browser's content type capabilities
• C.nosniff prevents DNS-based sniffing of the server's hostname
• D.nosniff is only needed for legacy Internet Explorer and has no effect on modern browsers; Trusted Types stop DOM XSS by encrypting sink inputs, which the browser decrypts only for whitelisted scripts; secure contexts are defined by the presence of a login form rather than HTTPS, letting http:// pages use WebCrypto after login; extension content scripts share the page's JavaScript heap, letting page code call extension APIs directly; typosquatting is blocked at the browser level by edit-distance checks against the user's bookmark list