Front End Development Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which GDPR principle requires that personal data be kept only as long as necessary for its purpose?
- Storage limitation (Correct answer)
- Data minimisation
- Purpose limitation
- Integrity and confidentiality
Correct answer: Storage limitation
GDPR Article 5(1)(e) states that personal data should be kept in a form that permits identification for no longer than necessary (storage limitation).
Question 2: An EU cookie consent banner must include which element to be legally compliant?
- An equally prominent 'Reject All' option (Correct answer)
- A pre-ticked acceptance checkbox
- Consent via scrolling
- A 30-day implied consent window
Correct answer: An equally prominent 'Reject All' option
Under GDPR and ePrivacy guidance, consent must be as easy to withdraw as to give, so a 'Reject All' option must be as accessible as 'Accept All'.
Question 3: What is the purpose of a robots.txt file in the context of regulatory compliance?
- It can direct crawlers away from pages containing sensitive or regulated data (Correct answer)
- It encrypts page content from unauthorized bots
- It prevents users from accessing private pages
- It stores GDPR consent records
Correct answer: It can direct crawlers away from pages containing sensitive or regulated data
robots.txt instructs compliant crawlers not to index specified paths, which can help prevent sensitive data from appearing in search results.
Question 4: Under ADA Title III as applied to websites, which standard do US courts most frequently reference for compliance?
- WCAG 2.1 Level AA (Correct answer)
- Section 508 VPAT
- ISO 9241-171
- EN 301 549
Correct answer: WCAG 2.1 Level AA
US courts and the DOJ consistently reference WCAG 2.1 Level AA as the practical accessibility benchmark for Title III ADA web compliance.
Question 5: Which HTTP header prevents a browser from rendering a page inside a frame, protecting against clickjacking?
- X-Frame-Options: DENY (Correct answer)
- Content-Security-Policy: no-frame
- X-Content-Type-Options: noframe
- Referrer-Policy: no-referrer
Correct answer: X-Frame-Options: DENY
`X-Frame-Options: DENY` instructs the browser to refuse to render the page within any `<frame>` or `<iframe>`, blocking clickjacking.
Question 6: CCPA requires a 'Do Not Sell My Personal Information' link for businesses that meet which threshold?
- Annual gross revenue over $25 million OR data on 100,000+ consumers (Correct answer)
- More than 50 employees
- Revenue over $1 million from California residents
- Any business with a California domain
Correct answer: Annual gross revenue over $25 million OR data on 100,000+ consumers
CCPA applies to for-profit businesses meeting at least one of three thresholds: $25M+ revenue, data on 100,000+ consumers/households, or 50%+ revenue from selling personal data.
Question 7: What does ARIA attribute `aria-live='polite'` instruct assistive technologies to do?
- Announce dynamic content updates after the user finishes their current action (Correct answer)
- Immediately interrupt the user to announce updates
- Suppress all announcements for the region
- Read the region only on initial page load
Correct answer: Announce dynamic content updates after the user finishes their current action
`aria-live='polite'` causes screen readers to queue the announcement until the user is idle, avoiding interrupting their current task.
Front End Development Regulatory Frameworks & Compliance 4
Which GDPR principle requires that personal data be kept only as long as necessary for its purpose?