Full-Stack Development Regulatory Frameworks & Compliance 5

Question 1

A company uses a CDN that logs user IP addresses for 90 days. Under GDPR, IP addresses are classified as:

Accepted Answer

Personal data, since they can identify an individual

Answer

The CJEU ruled that IP addresses constitute personal data under GDPR when the controller can reasonably link them to an identified individual.

Question 2

Which security control does NIST recommend as part of its Cybersecurity Framework's 'Protect' function to limit the impact of a potential security event?

Accepted Answer

Least privilege access control

Answer

Least privilege access control is a core Protect function control in the NIST CSF, limiting user and system permissions to only what is strictly required.

Question 3

An e-commerce platform must display a 'Do Not Sell My Personal Information' link. Which regulation requires this?

Accepted Answer

CCPA

Answer

CCPA requires businesses that sell personal information to provide a conspicuous 'Do Not Sell My Personal Information' opt-out link on their homepage.

Question 4

During a penetration test scoped under a Rules of Engagement document, a developer finds a vulnerability outside the agreed scope. The correct action is to:

Accepted Answer

Document and report it to the client through proper channels without exploiting it

Answer

Professional and legal ethics require reporting out-of-scope findings through proper channels without exploitation, respecting the agreed testing boundaries.

Question 5

A full-stack developer implements TLS 1.0 for backward compatibility. Under PCI DSS v4.0, this is:

Accepted Answer

Prohibited — PCI DSS v4.0 requires TLS 1.2 or higher

Answer

PCI DSS v4.0 explicitly prohibits TLS 1.0 and 1.1, requiring a minimum of TLS 1.2 (with TLS 1.3 strongly recommended) for all cardholder data transmissions.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Regulatory Frameworks & Compliance 5