Front End Development Regulatory Frameworks & Compliance 5

Question 1

Which meta tag prevents browsers from performing MIME type sniffing, reducing certain injection risks?

Accepted Answer

X-Content-Type-Options: nosniff (response header)

Answer

The `X-Content-Type-Options: nosniff` response header instructs browsers to follow the declared MIME type and not to guess based on content.

Question 2

A front-end developer needs to store a user's JWT token client-side. Which storage method carries the greatest XSS risk?

Accepted Answer

localStorage

Answer

Tokens in `localStorage` are accessible to any JavaScript on the page; a successful XSS attack can exfiltrate them, unlike `HttpOnly` cookies which JavaScript cannot read.

Question 3

Under GDPR's 'right to portability,' in what format must user data be provided upon request?

Accepted Answer

A structured, commonly used, machine-readable format

Answer

GDPR Article 20 requires that personal data be provided in a structured, commonly used, and machine-readable format such as JSON or CSV.

Question 4

Which WCAG principle states that user interface components must be operable by keyboard alone?

Accepted Answer

Operable

Answer

The second WCAG principle, Operable, requires that all functionality be accessible via keyboard, covering users who cannot use a mouse.

Question 5

What is required before embedding a third-party analytics script on a site under GDPR?

Accepted Answer

Valid user consent or a lawful basis that covers the script's data processing

Answer

Embedding third-party scripts that set tracking cookies or collect personal data requires a GDPR-compliant legal basis — typically freely given, specific, informed consent.

Front End Development Practice Test

Front End Development Practice Test

Front End Development Regulatory Frameworks & Compliance 5