LARAVEL Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Laravel's `config/session.php` includes a `secure` option. Which compliance scenario makes enabling this option mandatory?
- Any application using Redis as the session driver
- Applications that must comply with regulations requiring data in transit to be encrypted (e.g., PCI DSS, HIPAA), ensuring session cookies are only sent over HTTPS (Correct answer)
- Applications using database-backed sessions to prevent SQL injection
- Multi-tenant applications where session isolation between tenants is required
Correct answer: Applications that must comply with regulations requiring data in transit to be encrypted (e.g., PCI DSS, HIPAA), ensuring session cookies are only sent over HTTPS
Setting `secure => true` tells the browser to transmit session cookies only over HTTPS, satisfying encryption-in-transit requirements under PCI DSS and HIPAA.
Question 2: A fintech startup using Laravel must implement data residency controls requiring all EU user data to stay within the EU. Which architectural approach addresses this in Laravel?
- Setting `APP_LOCALE=eu` in the .env file
- Routing EU user requests to a separate Laravel instance connected to an EU-hosted database, using geographic routing at the infrastructure level (Correct answer)
- Using Laravel's multi-database support to prefix all EU tables with 'eu_'
- Encrypting EU user data with a key stored on an EU server
Correct answer: Routing EU user requests to a separate Laravel instance connected to an EU-hosted database, using geographic routing at the infrastructure level
Data residency is an infrastructure concern—data must physically reside in the correct region, requiring separate regional deployments or databases, not just encryption.
Question 3: Which Laravel artisan command would you run to verify that application encryption keys and environment variables are not accidentally committed to version control, a common compliance audit finding?
- `php artisan key:generate --show`
- `php artisan env:check`
- There is no built-in command; you must inspect `.gitignore` manually to ensure `.env` is excluded (Correct answer)
- `php artisan config:audit`
Correct answer: There is no built-in command; you must inspect `.gitignore` manually to ensure `.env` is excluded
Laravel has no built-in env audit command; compliance requires manually verifying that `.env` is listed in `.gitignore` and that secrets are not in version history.
Question 4: Under SOC 2 Type II, a Laravel application must demonstrate that access to administrative functions is restricted and logged. Which combination of Laravel features best satisfies this?
- Route groups with `auth` middleware and Laravel Telescope for request logging (Correct answer)
- Using `admin` as the route name prefix and database logging of all 500 errors
- Storing admin credentials in a separate `.env.admin` file with stricter file permissions
- Disabling all API routes for non-admin users in `routes/api.php`
Correct answer: Route groups with `auth` middleware and Laravel Telescope for request logging
Auth middleware enforces access restriction, and Telescope provides the request/action logs needed to demonstrate the control is operating effectively over time.
Question 5: Laravel's `Illuminate\Support\Facades\Crypt` uses AES-256-CBC by default. For compliance frameworks that mandate AES-256-GCM (authenticated encryption), what is the correct approach?
- Change the `cipher` key in `config/app.php` to `AES-256-GCM`
- Laravel only supports AES-128-CBC and AES-256-CBC natively; use a custom encryption implementation or a dedicated library for GCM mode (Correct answer)
- Pass a `'gcm'` flag to `Crypt::encrypt()` as the second argument
- Install the `laravel/cipher-gcm` official package from Packagist
Correct answer: Laravel only supports AES-128-CBC and AES-256-CBC natively; use a custom encryption implementation or a dedicated library for GCM mode
Laravel's Encrypter natively supports AES-128-CBC and AES-256-CBC; GCM mode requires a third-party library or custom implementation.
Question 6: Which practice is required when a Laravel application must provide GDPR-compliant data portability to users who request a copy of their data?
- Email the user their database row as a CSV attachment using Laravel Mail
- Provide an export of all personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) through a secure, authenticated endpoint (Correct answer)
- Grant the user read-only database access to their own rows
- Display all stored user data on their profile page within the application
Correct answer: Provide an export of all personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) through a secure, authenticated endpoint
GDPR Article 20 requires portability in a structured, machine-readable format delivered securely—a profile display page is not sufficient.
Question 7: A Laravel application uses third-party analytics scripts. Under GDPR's consent requirements, when must these scripts be loaded?
- Immediately on page load so analytics data is not lost before consent is gathered
- Only after obtaining explicit, informed user consent for non-essential cookies and tracking (Correct answer)
- After the user creates an account, implying consent through registration
- Scripts from reputable vendors like Google are exempt from GDPR consent requirements
Correct answer: Only after obtaining explicit, informed user consent for non-essential cookies and tracking
GDPR requires prior, freely given, informed consent before loading non-essential tracking scripts; no vendor is exempt.
LARAVEL Regulatory Frameworks & Compliance 3
Laravel's `config/session.php` includes a `secure` option.
Which compliance scenario makes enabling this option mandatory?