LARAVEL Regulatory Frameworks & Compliance 2

Question 1

Under GDPR, when a user requests deletion of their personal data in a Laravel application, which approach best fulfills the 'right to erasure' obligation?

Accepted Answer

Hard-delete the user record and scrub or anonymize associated personal data across all related tables

Answer

GDPR's right to erasure requires actually removing or anonymizing personal data, not merely hiding it with soft deletes.

Question 2

Which Laravel middleware is most commonly used to add HTTP security headers such as X-Frame-Options and Content-Security-Policy to meet compliance baselines like OWASP?

Accepted Answer

A custom middleware or a package like spatie/laravel-csp that injects security headers on every response

Answer

Security headers are not added by Laravel's core middleware; a custom middleware or a dedicated package like spatie/laravel-csp is the standard approach.

Question 3

A Laravel application that processes credit card data must comply with PCI DSS. Which practice is mandatory when storing cardholder data?

Accepted Answer

Never storing the full PAN; tokenize card data and offload storage to a PCI-certified payment vault

Answer

PCI DSS strongly advises not storing full PANs; tokenization via a certified payment provider removes the application from the highest PCI scope.

Question 4

Laravel's built-in `password_timeout` configuration option in `config/auth.php` serves which compliance-related purpose?

Accepted Answer

It requires re-authentication before sensitive actions, reducing risk from unattended sessions

Answer

`password_timeout` triggers a password confirmation prompt for privileged routes after a period of inactivity, satisfying step-up authentication requirements.

Question 5

To comply with CCPA's 'Do Not Sell My Personal Information' requirement in a Laravel app, what is the minimum technical action required?

Accepted Answer

Provide a mechanism for California residents to opt out and honor that preference by halting data sales/sharing with third parties

Answer

CCPA mandates a clear opt-out mechanism and actual enforcement of that preference—not merely a disclosure or a security control.

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL Regulatory Frameworks & Compliance 2