Bootstrap Regulatory Frameworks & Compliance 3

Question 1

A developer uses Bootstrap's visually-hidden (.visually-hidden) class on a form label. Which WCAG 2.1 success criterion does this technique satisfy?

Accepted Answer

1.3.1 Info and Relationships

Answer

Hiding a label visually while keeping it in the DOM preserves the programmatic association between the label and input, satisfying WCAG 1.3.1 which requires that information conveyed through presentation also be available programmatically.

Question 2

Which HTTP security header is NOT directly related to Bootstrap CSS/JS delivery compliance but is frequently required by enterprise security audits of Bootstrap-powered sites?

Accepted Answer

Strict-Transport-Security

Answer

HSTS (Strict-Transport-Security) enforces HTTPS at the transport layer and is independent of Bootstrap assets, but enterprise security audits routinely flag its absence on any production site.

Question 3

When implementing Bootstrap's Content-Security-Policy (CSP), which directive is required if Bootstrap's JavaScript uses inline event handlers generated at runtime?

Accepted Answer

script-src 'unsafe-inline'

Answer

'unsafe-inline' permits execution of inline scripts, which Bootstrap's older versions sometimes generate; however, using nonce-based CSP is the more secure compliant alternative.

Question 4

Under PCI-DSS (Payment Card Industry Data Security Standard), what Bootstrap practice is most critical when building a checkout page?

Accepted Answer

Ensuring Bootstrap JS is loaded from a compliant SRI-verified CDN

Answer

PCI-DSS requires integrity verification of third-party scripts; Subresource Integrity (SRI) hashes on Bootstrap CDN links prevent loading tampered scripts that could skim card data.

Question 5

A government contractor's Bootstrap site must comply with FISMA. Which Bootstrap default feature most directly supports the system security plan's confidentiality requirements?

Accepted Answer

Bootstrap's support for HTTPS-only asset loading

Answer

FISMA compliance requires data in transit to be encrypted; Bootstrap itself is agnostic, but ensuring all Bootstrap assets load over HTTPS is a baseline control supporting confidentiality requirements.

Bootstrap Practice Test

Bootstrap Practice Test

Bootstrap Regulatory Frameworks & Compliance 3