Front End Development Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Under GDPR, which legal basis allows a website to process user data without explicit consent?
- Legitimate interest (Correct answer)
- Implied consent
- Public notice
- Opt-out only
Correct answer: Legitimate interest
GDPR Article 6(1)(f) permits processing based on legitimate interest when it does not override the user's fundamental rights.
Question 2: Which HTTP response header helps prevent cross-site scripting (XSS) attacks by controlling resource loading?
- Content-Security-Policy (Correct answer)
- X-Frame-Options
- Strict-Transport-Security
- X-XSS-Protection
Correct answer: Content-Security-Policy
Content-Security-Policy (CSP) lets servers specify which sources browsers may load scripts, styles, and other resources from.
Question 3: COPPA applies to websites that collect personal information from children under which age?
- 13 (Correct answer)
- 16
- 18
- 21
Correct answer: 13
The Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting data from children under 13.
Question 4: A US healthcare web application that handles patient data must comply with which regulation?
- HIPAA (Correct answer)
- GDPR
- PCI DSS
- SOC 2
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) mandates security and privacy safeguards for protected health information (PHI).
Question 5: Which WCAG 2.1 success criterion requires text to have a contrast ratio of at least 4.5:1?
- 1.4.3 Contrast (Minimum) (Correct answer)
- 1.4.6 Contrast (Enhanced)
- 1.1.1 Non-text Content
- 1.4.4 Resize Text
Correct answer: 1.4.3 Contrast (Minimum)
WCAG 2.1 Success Criterion 1.4.3 specifies a minimum 4.5:1 contrast ratio for normal text at Level AA compliance.
Question 6: The California Consumer Privacy Act (CCPA) grants consumers the right to request that businesses do what with their data?
- Delete it (Correct answer)
- Encrypt it
- Archive it
- Anonymize it
Correct answer: Delete it
CCPA gives California residents the right to request deletion of their personal information held by covered businesses.
Question 7: Which attribute must be present on an `<iframe>` to prevent clickjacking attacks?
- sandbox (Correct answer)
- allow
- referrerpolicy
- loading
Correct answer: sandbox
The `sandbox` attribute restricts iframe capabilities and, when used with no `allow-same-origin`, prevents clickjacking by isolating the embedded content.
Front End Development Regulatory Frameworks & Compliance 2
Under GDPR, which legal basis allows a website to process user data without explicit consent?