How does an attacker bypass CSP Content Security Policy

Question

I am researching web security and want to understand how attackers bypass Content Security Policy (CSP) protections. My questions are:

• What are common CSP misconfigurations that lead to bypasses?
• How attackers use techniques like JSONP, DOM-based XSS, and CSP bypass payloads.
• How to properly configure CSP to mitigate bypass attempts.
  Real-world examples of CSP bypasses and fixes would be useful.