Front End Development Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which meta tag prevents browsers from performing MIME type sniffing, reducing certain injection risks?
- X-Content-Type-Options: nosniff (response header) (Correct answer)
- <meta http-equiv='Content-Type'>
- <meta name='robots' content='nosniff'>
- <meta charset='nosniff'>
Correct answer: X-Content-Type-Options: nosniff (response header)
The `X-Content-Type-Options: nosniff` response header instructs browsers to follow the declared MIME type and not to guess based on content.
Question 2: A front-end developer needs to store a user's JWT token client-side. Which storage method carries the greatest XSS risk?
- localStorage (Correct answer)
- HttpOnly cookie
- sessionStorage
- IndexedDB
Correct answer: localStorage
Tokens in `localStorage` are accessible to any JavaScript on the page; a successful XSS attack can exfiltrate them, unlike `HttpOnly` cookies which JavaScript cannot read.
Question 3: Under GDPR's 'right to portability,' in what format must user data be provided upon request?
- A structured, commonly used, machine-readable format (Correct answer)
- PDF only
- Plain text only
- Any format the company chooses
Correct answer: A structured, commonly used, machine-readable format
GDPR Article 20 requires that personal data be provided in a structured, commonly used, and machine-readable format such as JSON or CSV.
Question 4: Which WCAG principle states that user interface components must be operable by keyboard alone?
- Operable (Correct answer)
- Perceivable
- Understandable
- Robust
Correct answer: Operable
The second WCAG principle, Operable, requires that all functionality be accessible via keyboard, covering users who cannot use a mouse.
Question 5: What is required before embedding a third-party analytics script on a site under GDPR?
- Valid user consent or a lawful basis that covers the script's data processing (Correct answer)
- A privacy policy link in the footer
- An opt-out email address
- SSL/TLS on the host domain
Correct answer: Valid user consent or a lawful basis that covers the script's data processing
Embedding third-party scripts that set tracking cookies or collect personal data requires a GDPR-compliant legal basis — typically freely given, specific, informed consent.
Question 6: NIST SP 800-53 security controls are typically referenced when building front-end applications for which type of client?
- US federal government agencies (Correct answer)
- EU-based enterprises
- PCI-compliant retailers
- SOC 2 audited SaaS companies
Correct answer: US federal government agencies
NIST SP 800-53 provides the security and privacy control catalog required for US federal information systems, making it relevant for government-facing applications.
Question 7: What does a Voluntary Product Accessibility Template (VPAT) document?
- How a product conforms to accessibility standards such as Section 508 and WCAG (Correct answer)
- A vendor's GDPR data processing agreement
- A site's SSL certificate validity
- A product's COPPA parental consent workflow
Correct answer: How a product conforms to accessibility standards such as Section 508 and WCAG
A VPAT is an industry-standard document that describes how a product meets accessibility standards, used by procurement teams especially in government and education.
Front End Development Regulatory Frameworks & Compliance 5
Which meta tag prevents browsers from performing MIME type sniffing, reducing certain injection risks?