According to Platform Security FAQS.
X-Content-Type-Options: no sniff
The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > Enable Content Sniffing Protection
.
Browsers may ignore the Content-Type header returned by the server and guess the content-type from the actual content of the body response. This can be leveraged to force the browser to execute malicious Javascript or CSS.
The HTTP header X-Content-Type-Options: nosniff prevents the browser from guessing the type of file based on its content or the embedding tag. The browser obeys the content-type sent by the server.
X-XSS-Protection
The HTTP header can be turned on or off by each organization under Setup > Security Controls > Session Settings > Enable XSS Protection
.
This header prevents some Reflected Cross-Site Scripting attacks. It works with the same way as the CSP directive reflected-XSS.
If the browser detects a reflected XSS, it will block the content and show a blank page instead.
So to test them I'd use something like the Chrome browsers developer tools Network tab to inspect the response headers that are coming back from each page in Salesforce. You are looking for the X-Content-Type-Options and X-XSS-Protection headers in the response.

Note from the same reference on the XSS Protection Headers (my emphasis).
We do not consider the browser level XSS protections as adequate to properly secure against XSS. Different browsers have different ways of handling/parsing HTML and Javascript and the protections behave differently across browsers. We consider it imperative to implement XSS protections on the application and be as browser agnostic as possible.