The response may be stored, but must be revalidated with the server before each use
no-cache means "check with the server first". The browser usually checks with ETag or Last-Modified. If the server answers 304 (Not Modified), the browser reuses the cached copy.
"The response must not be stored anywhere" is the tempting wrong answer, because of the name. The directive that forbids storing is no-store.
Read more