LARAVEL Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Under GDPR, when a user requests deletion of their personal data in a Laravel application, which approach best fulfills the 'right to erasure' obligation?
- Soft-delete the user record using Laravel's SoftDeletes trait so data is retained for audits
- Hard-delete the user record and scrub or anonymize associated personal data across all related tables (Correct answer)
- Mark the account inactive and stop sending emails, leaving all stored data intact
- Archive the user data to cold storage for seven years before permanent deletion
Correct answer: Hard-delete the user record and scrub or anonymize associated personal data across all related tables
GDPR's right to erasure requires actually removing or anonymizing personal data, not merely hiding it with soft deletes.
Question 2: Which Laravel middleware is most commonly used to add HTTP security headers such as X-Frame-Options and Content-Security-Policy to meet compliance baselines like OWASP?
- \App\Http\Middleware\VerifyCsrfToken
- \Illuminate\Http\Middleware\SetCacheHeaders
- A custom middleware or a package like spatie/laravel-csp that injects security headers on every response (Correct answer)
- \Illuminate\Routing\Middleware\ThrottleRequests
Correct answer: A custom middleware or a package like spatie/laravel-csp that injects security headers on every response
Security headers are not added by Laravel's core middleware; a custom middleware or a dedicated package like spatie/laravel-csp is the standard approach.
Question 3: A Laravel application that processes credit card data must comply with PCI DSS. Which practice is mandatory when storing cardholder data?
- Storing the full 16-digit PAN in an encrypted database column using Laravel's Crypt facade
- Never storing the full PAN; tokenize card data and offload storage to a PCI-certified payment vault (Correct answer)
- Hashing the PAN with bcrypt so it cannot be reversed
- Storing the PAN in a separate PostgreSQL schema with restricted database user access
Correct answer: Never storing the full PAN; tokenize card data and offload storage to a PCI-certified payment vault
PCI DSS strongly advises not storing full PANs; tokenization via a certified payment provider removes the application from the highest PCI scope.
Question 4: Laravel's built-in `password_timeout` configuration option in `config/auth.php` serves which compliance-related purpose?
- It forces users to change their password after a set number of days
- It sets the idle session timeout before a user is logged out automatically
- It requires re-authentication before sensitive actions, reducing risk from unattended sessions (Correct answer)
- It controls the bcrypt cost factor used when hashing passwords
Correct answer: It requires re-authentication before sensitive actions, reducing risk from unattended sessions
`password_timeout` triggers a password confirmation prompt for privileged routes after a period of inactivity, satisfying step-up authentication requirements.
Question 5: To comply with CCPA's 'Do Not Sell My Personal Information' requirement in a Laravel app, what is the minimum technical action required?
- Display a privacy policy page explaining what data is collected
- Provide a mechanism for California residents to opt out and honor that preference by halting data sales/sharing with third parties (Correct answer)
- Encrypt all personal data stored in the database
- Require two-factor authentication for all California-based users
Correct answer: Provide a mechanism for California residents to opt out and honor that preference by halting data sales/sharing with third parties
CCPA mandates a clear opt-out mechanism and actual enforcement of that preference—not merely a disclosure or a security control.
Question 6: Which Laravel feature helps demonstrate compliance with audit trail requirements by automatically recording who changed a model and when?
- Laravel Telescope's request watcher
- Model observers or packages like owen-it/laravel-auditing that log model events to an audit table (Correct answer)
- The `updated_at` timestamp column added by Laravel's Schema builder
- Laravel Horizon's job failure logs
Correct answer: Model observers or packages like owen-it/laravel-auditing that log model events to an audit table
Model observers and dedicated auditing packages record create/update/delete events with user attribution, creating the audit trail required by many compliance frameworks.
Question 7: When deploying a Laravel application in a HIPAA-regulated environment, which configuration change is non-negotiable for log files that may contain PHI?
- Setting the log channel to 'stack' to aggregate all channels
- Ensuring log files are stored on an encrypted volume with access controls and are not written to publicly accessible directories (Correct answer)
- Switching from Monolog to a custom logger to avoid third-party code handling PHI
- Disabling debug mode in production using APP_DEBUG=false
Correct answer: Ensuring log files are stored on an encrypted volume with access controls and are not written to publicly accessible directories
HIPAA's Technical Safeguards require PHI at rest (including logs) to be encrypted and access-controlled; the storage location and encryption are the critical controls.
LARAVEL Regulatory Frameworks & Compliance 2
Under GDPR, when a user requests deletion of their personal data in a Laravel application, which approach best fulfills the 'right to erasure' obligation?