LARAVEL Regulatory Frameworks & Compliance 3

Question 1

Laravel's `config/session.php` includes a `secure` option. Which compliance scenario makes enabling this option mandatory?

Accepted Answer

Applications that must comply with regulations requiring data in transit to be encrypted (e.g., PCI DSS, HIPAA), ensuring session cookies are only sent over HTTPS

Answer

Setting `secure => true` tells the browser to transmit session cookies only over HTTPS, satisfying encryption-in-transit requirements under PCI DSS and HIPAA.

Question 2

A fintech startup using Laravel must implement data residency controls requiring all EU user data to stay within the EU. Which architectural approach addresses this in Laravel?

Accepted Answer

Routing EU user requests to a separate Laravel instance connected to an EU-hosted database, using geographic routing at the infrastructure level

Answer

Data residency is an infrastructure concern—data must physically reside in the correct region, requiring separate regional deployments or databases, not just encryption.

Question 3

Which Laravel artisan command would you run to verify that application encryption keys and environment variables are not accidentally committed to version control, a common compliance audit finding?

Accepted Answer

There is no built-in command; you must inspect `.gitignore` manually to ensure `.env` is excluded

Answer

Laravel has no built-in env audit command; compliance requires manually verifying that `.env` is listed in `.gitignore` and that secrets are not in version history.

Question 4

Under SOC 2 Type II, a Laravel application must demonstrate that access to administrative functions is restricted and logged. Which combination of Laravel features best satisfies this?

Accepted Answer

Route groups with `auth` middleware and Laravel Telescope for request logging

Answer

Auth middleware enforces access restriction, and Telescope provides the request/action logs needed to demonstrate the control is operating effectively over time.

Question 5

Laravel's `Illuminate\Support\Facades\Crypt` uses AES-256-CBC by default. For compliance frameworks that mandate AES-256-GCM (authenticated encryption), what is the correct approach?

Accepted Answer

Laravel only supports AES-128-CBC and AES-256-CBC natively; use a custom encryption implementation or a dedicated library for GCM mode

Answer

Laravel's Encrypter natively supports AES-128-CBC and AES-256-CBC; GCM mode requires a third-party library or custom implementation.

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL Regulatory Frameworks & Compliance 3