Upload storage cards. Pick the card that matches the stated goal.

S1 Store the bytes outside the directory that the server executes as code.
S2 Trust the filename suffix and store the file beside the application.
S3 Trust the declared media type and display the file as that type.

The goal in this lesson is to keep an upload from becoming a program the server runs.
S1 matches that goal. S2 and S3 trust a claim.