The custom headers can be removed by modifying the customHeaders section of the web.config as follows:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.web>
  </system.web>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By"/>
        <clear/>

        <!-- here we remove custom headers -->
        <add name="X-Frame-Options" value="SAMEORIGIN"/>
        <add name="X-Xss-Protection" value="1; mode=block"/>
        <add name="X-Content-Type-Options" value="nosniff"/>
        <!-- here we remove custom headers -->

        <add name="Referrer-Policy" value="strict-origin-when-cross-origin"/>
        <add name="Permissions-Policy" value="accelerometer=(self), camera=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), payment=(self), usb=(self)"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>]
</configuration>