Bootstrap Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A developer uses Bootstrap's visually-hidden (.visually-hidden) class on a form label. Which WCAG 2.1 success criterion does this technique satisfy?
- 1.1.1 Non-text Content
- 1.3.1 Info and Relationships (Correct answer)
- 2.1.1 Keyboard
- 4.1.2 Name, Role, Value
Correct answer: 1.3.1 Info and Relationships
Hiding a label visually while keeping it in the DOM preserves the programmatic association between the label and input, satisfying WCAG 1.3.1 which requires that information conveyed through presentation also be available programmatically.
Question 2: Which HTTP security header is NOT directly related to Bootstrap CSS/JS delivery compliance but is frequently required by enterprise security audits of Bootstrap-powered sites?
- Content-Security-Policy
- X-Frame-Options
- Strict-Transport-Security (Correct answer)
- X-Content-Type-Options
Correct answer: Strict-Transport-Security
HSTS (Strict-Transport-Security) enforces HTTPS at the transport layer and is independent of Bootstrap assets, but enterprise security audits routinely flag its absence on any production site.
Question 3: When implementing Bootstrap's Content-Security-Policy (CSP), which directive is required if Bootstrap's JavaScript uses inline event handlers generated at runtime?
- script-src 'unsafe-eval'
- script-src 'unsafe-inline' (Correct answer)
- script-src 'nonce-{value}'
- script-src 'self'
Correct answer: script-src 'unsafe-inline'
'unsafe-inline' permits execution of inline scripts, which Bootstrap's older versions sometimes generate; however, using nonce-based CSP is the more secure compliant alternative.
Question 4: Under PCI-DSS (Payment Card Industry Data Security Standard), what Bootstrap practice is most critical when building a checkout page?
- Using Bootstrap's card component for the payment form layout
- Ensuring Bootstrap JS is loaded from a compliant SRI-verified CDN (Correct answer)
- Applying Bootstrap's form-control class to card number inputs
- Using Bootstrap's grid for responsive payment layout
Correct answer: Ensuring Bootstrap JS is loaded from a compliant SRI-verified CDN
PCI-DSS requires integrity verification of third-party scripts; Subresource Integrity (SRI) hashes on Bootstrap CDN links prevent loading tampered scripts that could skim card data.
Question 5: A government contractor's Bootstrap site must comply with FISMA. Which Bootstrap default feature most directly supports the system security plan's confidentiality requirements?
- Bootstrap's responsive breakpoints
- Bootstrap's support for HTTPS-only asset loading (Correct answer)
- Bootstrap's modal z-index management
- Bootstrap's form validation states
Correct answer: Bootstrap's support for HTTPS-only asset loading
FISMA compliance requires data in transit to be encrypted; Bootstrap itself is agnostic, but ensuring all Bootstrap assets load over HTTPS is a baseline control supporting confidentiality requirements.
Question 6: Which Bootstrap color utility class is known to FAIL WCAG AA contrast requirements when used as text on a white background?
- text-danger
- text-success
- text-warning (Correct answer)
- text-info
Correct answer: text-warning
Bootstrap's default 'text-warning' yellow (#ffc107) on white (#fff) produces a contrast ratio of approximately 2.5:1, well below the WCAG AA minimum of 4.5:1 for normal text.
Question 7: When a Bootstrap-powered site uses Subresource Integrity (SRI), what must a developer do if they upgrade from Bootstrap 5.2 to 5.3?
- Update only the version number in the CDN URL
- Update both the CDN URL and the integrity hash attribute (Correct answer)
- Remove the integrity attribute since it auto-updates
- Update only the crossorigin attribute value
Correct answer: Update both the CDN URL and the integrity hash attribute
Each Bootstrap release produces different file content and therefore a different cryptographic hash, so both the CDN URL version and the integrity attribute hash must be updated together.
Bootstrap Regulatory Frameworks & Compliance 3
A developer uses Bootstrap's visually-hidden (.visually-hidden) class on a form label.
Which WCAG 2.1 success criterion does this technique satisfy?