Full-Stack Development Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A developer accidentally commits an AWS access key to a public GitHub repository. Under which framework's breach response procedures should the company notify affected parties if customer data was accessed?
- PCI DSS only, if payment data is involved
- No notification is required for key exposure
- GDPR if EU personal data was exposed, and applicable US state breach laws (Correct answer)
- Only HIPAA applies to all data breaches
Correct answer: GDPR if EU personal data was exposed, and applicable US state breach laws
A key exposure leading to personal data access triggers GDPR's 72-hour breach notification obligation for EU data, plus applicable US state breach notification laws.
Question 2: Which GDPR article establishes the requirement for 'privacy by design and by default'?
- Article 5
- Article 13
- Article 25 (Correct answer)
- Article 32
Correct answer: Article 25
Article 25 of GDPR mandates that data protection be integrated into system design from the outset and that privacy-protective settings be the default.
Question 3: In a multi-tenant SaaS application, which access control model most directly prevents one tenant from accessing another tenant's data?
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC)
- Tenant-scoped data isolation with row-level security (Correct answer)
- Attribute-Based Access Control (ABAC) using job titles
Correct answer: Tenant-scoped data isolation with row-level security
Row-level security combined with tenant-scoped queries ensures database queries automatically filter results to the authenticated tenant's data only.
Question 4: A healthcare app uses OAuth 2.0 to allow third-party apps to access patient records. Under HIPAA, what must be in place before sharing ePHI with the third party?
- A standard OAuth scope declaration
- A Business Associate Agreement (BAA) (Correct answer)
- A GDPR data processing addendum
- A public privacy policy statement
Correct answer: A Business Associate Agreement (BAA)
HIPAA requires a Business Associate Agreement (BAA) between covered entities and any business associate that creates, receives, or transmits ePHI on their behalf.
Question 5: What does the 'right to portability' under GDPR allow a user to do?
- Delete their data from all third-party systems
- Receive their data in a structured, machine-readable format and transfer it to another controller (Correct answer)
- Opt out of automated decision-making
- Access audit logs of who viewed their data
Correct answer: Receive their data in a structured, machine-readable format and transfer it to another controller
GDPR Article 20 grants users the right to receive their personal data in a structured, commonly-used format (e.g., JSON/CSV) and transmit it to another service.
Question 6: A developer uses `eval()` to process user-supplied JSON in a Node.js backend. Which OWASP Top 10 risk does this primarily introduce?
- Broken Authentication
- Injection (Correct answer)
- Insecure Deserialization
- Security Logging Failures
Correct answer: Injection
Using `eval()` on user input creates an Injection vulnerability, as attackers can supply malicious code that gets executed by the JavaScript engine.
Question 7: Under FedRAMP, what Authorization to Operate (ATO) level would a cloud service need to store classified federal data?
- FedRAMP Low
- FedRAMP Moderate
- FedRAMP High (Correct answer)
- FedRAMP Provisional
Correct answer: FedRAMP High
FedRAMP High authorization is required for cloud systems handling data where unauthorized disclosure could cause severe harm, including classified federal systems.
Full-Stack Development Regulatory Frameworks & Compliance 4
A developer accidentally commits an AWS access key to a public GitHub repository.
Under which framework's breach response procedures should the company notify affected parties if customer data was accessed?