X-Content-Type-Options
Stops browsers from guessing a response's content type, closing off a class of MIME-sniffing attacks.
What it does
Browsers sometimes try to be helpful by inspecting a response's bytes and "sniffing" what type of content it actually is, even if that disagrees with the declared Content-Type. X-Content-Type-Options: nosniff turns that behaviour off, forcing the browser to trust the declared type exactly.
Why it matters
MIME-sniffing becomes dangerous when a server serves user-uploaded content, an image upload, for instance, with a generic or missing Content-Type. Without nosniff, a browser might decide a "harmless" uploaded file is actually HTML or JavaScript and execute it, turning a file upload feature into a stored XSS vector.
Recommended value
This is a single, non-configurable value: there's no tuning involved, and essentially no legitimate reason to omit it. Every response should carry it.