Which statement about CORS is correct?

It protects your API from curl and from server-to-server calls
It is enforced by browsers; the server lists the allowed origins (Correct option)
It encrypts the traffic that moves between browser and server
It replaces authentication on the API for trusted websites

It is enforced by browsers; the server declares allowed origins via Access-Control-Allow-Origin

Browsers block a web page from reading responses from a different origin (domain/port) by default: the same-origin policy.

CORS is how a server says 'it's OK, pages from https://myapp.com may read my responses', via Access-Control-Allow-Origin.

Only browsers enforce it. curl, Postman or another server ignore CORS completely, so it is not a security wall for your API.

CORS is a browser rule, not API protection.