Front End Development Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Under WCAG 2.1, what is the minimum focus indicator requirement at Level AA?
- Visible focus must not be removed by CSS (Correct answer)
- A 3:1 contrast ratio focus ring is required
- Focus must be shown as a dotted outline
- Focus indicators must be at least 2px wide
Correct answer: Visible focus must not be removed by CSS
WCAG 2.1 AA requires that any keyboard focus indicator provided by the user agent is not suppressed — its specific appearance is tightened only in WCAG 2.2.
Question 2: Which cookie attribute restricts a cookie to HTTPS connections only?
- Secure (Correct answer)
- HttpOnly
- SameSite=Strict
- Path=/
Correct answer: Secure
The `Secure` cookie attribute instructs the browser to only send the cookie over encrypted HTTPS connections.
Question 3: Section 508 of the US Rehabilitation Act primarily applies to web content produced by which entities?
- Federal agencies and contractors (Correct answer)
- All US businesses
- Publicly traded companies
- Non-profit organizations only
Correct answer: Federal agencies and contractors
Section 508 requires that electronic and information technology developed, procured, or used by US federal agencies be accessible to people with disabilities.
Question 4: What does the `SameSite=Lax` cookie attribute primarily protect against?
- Cross-site request forgery (CSRF) (Correct answer)
- Cross-site scripting (XSS)
- Clickjacking
- Session hijacking via HTTP
Correct answer: Cross-site request forgery (CSRF)
`SameSite=Lax` prevents cookies from being sent with cross-site POST requests, mitigating most CSRF attack vectors.
Question 5: Under GDPR, within how many hours must a personal data breach be reported to the supervisory authority?
- 72 hours (Correct answer)
- 24 hours
- 48 hours
- 96 hours
Correct answer: 72 hours
GDPR Article 33 requires notification to the relevant data protection authority within 72 hours of becoming aware of a personal data breach.
Question 6: A payment form on a US e-commerce site must comply with which security standard to handle card data?
- PCI DSS (Correct answer)
- SOC 2 Type II
- ISO 27001
- FedRAMP
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is the mandatory compliance framework for any entity that stores, processes, or transmits cardholder data.
Question 7: Which HTML element and attribute pairing is required for an accessible form input under WCAG 2.1?
- <label for='id'> matching the input's id (Correct answer)
- <input placeholder='description'>
- <input title='description'>
- <div aria-label='description'>
Correct answer: <label for='id'> matching the input's id
WCAG Success Criterion 1.3.1 requires form controls to have a programmatically associated label, which `<label for>` provides via the matching `id`.
Front End Development Regulatory Frameworks & Compliance 3
Under WCAG 2.1, what is the minimum focus indicator requirement at Level AA?