Full-Stack Development Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A company uses a CDN that logs user IP addresses for 90 days. Under GDPR, IP addresses are classified as:
- Anonymous data not subject to GDPR
- Personal data, since they can identify an individual (Correct answer)
- Pseudonymous data exempt from all GDPR obligations
- Sensitive special-category data
Correct answer: Personal data, since they can identify an individual
The CJEU ruled that IP addresses constitute personal data under GDPR when the controller can reasonably link them to an identified individual.
Question 2: Which security control does NIST recommend as part of its Cybersecurity Framework's 'Protect' function to limit the impact of a potential security event?
- Incident response planning
- Least privilege access control (Correct answer)
- Threat hunting
- Forensic analysis
Correct answer: Least privilege access control
Least privilege access control is a core Protect function control in the NIST CSF, limiting user and system permissions to only what is strictly required.
Question 3: An e-commerce platform must display a 'Do Not Sell My Personal Information' link. Which regulation requires this?
- GDPR
- HIPAA
- CCPA (Correct answer)
- COPPA
Correct answer: CCPA
CCPA requires businesses that sell personal information to provide a conspicuous 'Do Not Sell My Personal Information' opt-out link on their homepage.
Question 4: During a penetration test scoped under a Rules of Engagement document, a developer finds a vulnerability outside the agreed scope. The correct action is to:
- Exploit it immediately to demonstrate impact
- Ignore it since it's out of scope
- Document and report it to the client through proper channels without exploiting it (Correct answer)
- Delete evidence to avoid liability
Correct answer: Document and report it to the client through proper channels without exploiting it
Professional and legal ethics require reporting out-of-scope findings through proper channels without exploitation, respecting the agreed testing boundaries.
Question 5: A full-stack developer implements TLS 1.0 for backward compatibility. Under PCI DSS v4.0, this is:
- Acceptable if documented in the risk assessment
- Prohibited — PCI DSS v4.0 requires TLS 1.2 or higher (Correct answer)
- Allowed for internal-only traffic
- Acceptable if combined with HTTP Strict Transport Security
Correct answer: Prohibited — PCI DSS v4.0 requires TLS 1.2 or higher
PCI DSS v4.0 explicitly prohibits TLS 1.0 and 1.1, requiring a minimum of TLS 1.2 (with TLS 1.3 strongly recommended) for all cardholder data transmissions.
Question 6: Which GDPR principle requires that personal data not be kept longer than necessary for its original purpose?
- Data minimization
- Purpose limitation
- Storage limitation (Correct answer)
- Integrity and confidentiality
Correct answer: Storage limitation
The storage limitation principle under GDPR Article 5(1)(e) requires deleting or anonymizing personal data once it is no longer needed for its specified purpose.
Question 7: A developer creates a feature that makes fully automated decisions (no human review) about loan eligibility using user data. Under GDPR Article 22, users have the right to:
- Opt out only if they are EU citizens over 18
- Request human review of the decision and contest it (Correct answer)
- Receive a refund if denied
- Access the source code of the algorithm
Correct answer: Request human review of the decision and contest it
GDPR Article 22 gives individuals the right to not be subject to solely automated decisions with significant effects, and to request meaningful human review and contest outcomes.
Full-Stack Development Regulatory Frameworks & Compliance 5
A company uses a CDN that logs user IP addresses for 90 days.
Under GDPR, IP addresses are classified as: