Regulatory Frameworks & Compliance Flashcards
7 cards from real Front End Development practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Frameworks & Compliance flashcards as text
Which meta tag prevents browsers from performing MIME type sniffing, reducing certain injection risks?
Answer: X-Content-Type-Options: nosniff (response header)
The `X-Content-Type-Options: nosniff` response header instructs browsers to follow the declared MIME type and not to guess based on content.
A front-end developer needs to store a user's JWT token client-side. Which storage method carries the greatest XSS risk?
Answer: localStorage
Tokens in `localStorage` are accessible to any JavaScript on the page; a successful XSS attack can exfiltrate them, unlike `HttpOnly` cookies which JavaScript cannot read.
Under GDPR's 'right to portability,' in what format must user data be provided upon request?
Answer: A structured, commonly used, machine-readable format
GDPR Article 20 requires that personal data be provided in a structured, commonly used, and machine-readable format such as JSON or CSV.
Which WCAG principle states that user interface components must be operable by keyboard alone?
Answer: Operable
The second WCAG principle, Operable, requires that all functionality be accessible via keyboard, covering users who cannot use a mouse.
What is required before embedding a third-party analytics script on a site under GDPR?
Answer: Valid user consent or a lawful basis that covers the script's data processing
Embedding third-party scripts that set tracking cookies or collect personal data requires a GDPR-compliant legal basis — typically freely given, specific, informed consent.
NIST SP 800-53 security controls are typically referenced when building front-end applications for which type of client?
Answer: US federal government agencies
NIST SP 800-53 provides the security and privacy control catalog required for US federal information systems, making it relevant for government-facing applications.
What does a Voluntary Product Accessibility Template (VPAT) document?
Answer: How a product conforms to accessibility standards such as Section 508 and WCAG
A VPAT is an industry-standard document that describes how a product meets accessibility standards, used by procurement teams especially in government and education.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy