Which statement best describes Content Security Policy in an XSS defense?

Which statement best describes Content Security Policy in an XSS defense?

1. It is an additional browser-enforced layer; safe sinks and contextual encoding still address the root cause.
2. It makes every use of innerHTML safe when default-src is set.
3. It authorizes users to access server-side objects.
4. One fixed nonce can be reused by every response indefinitely.