Full-Stack Development Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A startup's app targets children under 13 in the US and collects their email addresses. Which regulation requires verifiable parental consent before collection?
- FERPA
- COPPA (Correct answer)
- CCPA
- HIPAA
Correct answer: COPPA
COPPA (Children's Online Privacy Protection Act) requires verifiable parental consent before collecting personal information from children under 13.
Question 2: Which OWASP Top 10 category directly relates to storing sensitive data in plain text or using deprecated encryption algorithms?
- Broken Access Control
- Cryptographic Failures (Correct answer)
- Security Misconfiguration
- Injection
Correct answer: Cryptographic Failures
Cryptographic Failures (formerly 'Sensitive Data Exposure') covers inadequate protection of data at rest or in transit through weak or missing encryption.
Question 3: A California resident requests deletion of their personal data from a company's database. Under CCPA, what right are they exercising?
- Right to portability
- Right to opt-out
- Right to deletion (Correct answer)
- Right to correction
Correct answer: Right to deletion
CCPA grants California consumers the Right to Deletion, allowing them to request businesses delete personal information collected about them.
Question 4: In a zero-trust architecture compliant with NIST SP 800-207, what is the core principle governing access decisions?
- Trust is granted once per session after VPN login
- Never trust, always verify — every access request is authenticated regardless of network location (Correct answer)
- Internal network traffic is implicitly trusted
- Perimeter firewalls determine all access policies
Correct answer: Never trust, always verify — every access request is authenticated regardless of network location
NIST SP 800-207 defines zero trust as requiring continuous verification of every access request regardless of where it originates, even inside the network.
Question 5: Which HTTP security header helps prevent cross-site scripting (XSS) attacks by controlling which resources a browser is allowed to load?
- X-Frame-Options
- Content-Security-Policy (Correct answer)
- Strict-Transport-Security
- X-Content-Type-Options
Correct answer: Content-Security-Policy
Content-Security-Policy (CSP) allows developers to whitelist trusted sources of scripts, styles, and other resources, blocking unauthorized script execution.
Question 6: Under GDPR's data minimization principle, a developer should collect:
- All available data fields to enable future feature development
- Only data that is adequate, relevant, and limited to what is necessary for the specified purpose (Correct answer)
- Data up to a 5MB limit per user
- Any data if the privacy policy discloses it
Correct answer: Only data that is adequate, relevant, and limited to what is necessary for the specified purpose
GDPR's data minimization principle requires collecting only the data strictly necessary for the specific, declared processing purpose.
Question 7: A financial application must maintain immutable audit logs for 7 years per regulatory requirements. Which database strategy best supports this?
- Allowing UPDATE on log records for corrections
- Using append-only tables with write-once storage and cryptographic hashing (Correct answer)
- Storing logs in application memory for fast access
- Rotating logs to flat files every 30 days
Correct answer: Using append-only tables with write-once storage and cryptographic hashing
Append-only storage with cryptographic hashing ensures logs cannot be altered retroactively, satisfying immutability requirements for financial audits.
Full-Stack Development Regulatory Frameworks & Compliance 3
A startup's app targets children under 13 in the US and collects their email addresses.
Which regulation requires verifiable parental consent before collection?