Full-Stack Development Regulatory Frameworks & Compliance 3

Question 1

A startup's app targets children under 13 in the US and collects their email addresses. Which regulation requires verifiable parental consent before collection?

Accepted Answer

COPPA

Answer

COPPA (Children's Online Privacy Protection Act) requires verifiable parental consent before collecting personal information from children under 13.

Question 2

Which OWASP Top 10 category directly relates to storing sensitive data in plain text or using deprecated encryption algorithms?

Accepted Answer

Cryptographic Failures

Answer

Cryptographic Failures (formerly 'Sensitive Data Exposure') covers inadequate protection of data at rest or in transit through weak or missing encryption.

Question 3

A California resident requests deletion of their personal data from a company's database. Under CCPA, what right are they exercising?

Accepted Answer

Right to deletion

Answer

CCPA grants California consumers the Right to Deletion, allowing them to request businesses delete personal information collected about them.

Question 4

In a zero-trust architecture compliant with NIST SP 800-207, what is the core principle governing access decisions?

Accepted Answer

Never trust, always verify — every access request is authenticated regardless of network location

Answer

NIST SP 800-207 defines zero trust as requiring continuous verification of every access request regardless of where it originates, even inside the network.

Question 5

Which HTTP security header helps prevent cross-site scripting (XSS) attacks by controlling which resources a browser is allowed to load?

Accepted Answer

Content-Security-Policy

Answer

Content-Security-Policy (CSP) allows developers to whitelist trusted sources of scripts, styles, and other resources, blocking unauthorized script execution.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Regulatory Frameworks & Compliance 3