LARAVEL Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Under GDPR's data minimization principle, which Laravel practice best aligns with only collecting what is necessary?
- Using `$request->all()` to capture every submitted field and filter later in the controller
- Using `$request->only(['name', 'email'])` or Form Request validation rules that explicitly allow only required fields (Correct answer)
- Storing all submitted data in a `raw_submissions` JSON column for later analysis
- Encrypting all form fields before storage to reduce the risk of collecting excess data
Correct answer: Using `$request->only(['name', 'email'])` or Form Request validation rules that explicitly allow only required fields
Using `only()` or strict validation allow-lists ensures the application never processes or stores fields beyond what is needed, directly implementing data minimization.
Question 2: Which Laravel logging configuration best supports a compliance requirement for tamper-evident, centralized log management (e.g., for SOC 2 or PCI DSS log integrity)?
- Using the `single` log channel writing to `storage/logs/laravel.log` on the local disk
- Using the `stack` channel that ships logs to an external SIEM or log management service (e.g., via a `syslog` or HTTP channel), where logs are immutable and access-controlled (Correct answer)
- Rotating logs daily with the `daily` driver and archiving them to S3 with versioning enabled
- Disabling the `deprecations` log channel to reduce log volume
Correct answer: Using the `stack` channel that ships logs to an external SIEM or log management service (e.g., via a `syslog` or HTTP channel), where logs are immutable and access-controlled
PCI DSS and SOC 2 require logs to be sent to a separate, access-controlled system to prevent tampering—local-only log files can be altered by anyone with server access.
Question 3: A Laravel API handles sensitive personal data and must comply with GDPR. Which HTTP method and endpoint design principle reduces unnecessary data exposure compared to a non-compliant alternative?
- Using POST instead of GET for all requests to prevent data appearing in server logs
- Returning only the fields the consuming client needs (sparse fieldsets) rather than full model serialization, and using API Resources to control the output (Correct answer)
- Using HTTPS to encrypt all API responses so exposure does not matter
- Caching API responses in Redis to reduce the number of database reads containing personal data
Correct answer: Returning only the fields the consuming client needs (sparse fieldsets) rather than full model serialization, and using API Resources to control the output
API Resources with explicit field control prevent over-exposure of personal data, supporting GDPR's data minimization and purpose limitation principles at the API layer.
Question 4: Laravel's `Illuminate\Cookie\Middleware\EncryptCookies` middleware is relevant to which compliance concern?
- Preventing cross-site request forgery by signing cookies
- Satisfying requirements that session and application cookies not leak sensitive data in transit or be tampered with by the client, as required by PCI DSS and HIPAA (Correct answer)
- Implementing cookie consent banners required by GDPR's ePrivacy provisions
- Blocking third-party cookies from being set by embedded analytics scripts
Correct answer: Satisfying requirements that session and application cookies not leak sensitive data in transit or be tampered with by the client, as required by PCI DSS and HIPAA
Encrypting cookies ensures that even if intercepted or inspected by the client, cookie values reveal no sensitive data and cannot be forged, satisfying integrity and confidentiality controls.
Question 5: A healthcare Laravel application stores patient appointment notes. Under HIPAA, which database-level control is required for PHI at rest?
- Indexing the patient_id column for fast retrieval to minimize exposure time
- Encrypting the database tablespace or individual sensitive columns using at-rest encryption, with key management separate from the data (Correct answer)
- Hashing appointment notes with SHA-256 before storage
- Storing appointment notes in a separate database schema with a distinct username and password
Correct answer: Encrypting the database tablespace or individual sensitive columns using at-rest encryption, with key management separate from the data
HIPAA's Technical Safeguards require encryption of PHI at rest; separate credentials alone or hashing (which makes data unreadable) do not satisfy this requirement properly.
Question 6: Which Laravel approach supports the NIST Cybersecurity Framework's 'Respond' function by enabling rapid incident detection in a compromised application?
- Using `php artisan down` to put the application in maintenance mode as soon as an incident is suspected
- Integrating Laravel event listeners and notification channels (Slack, PagerDuty) triggered on anomalous events such as repeated failed logins or unexpected privilege escalation attempts (Correct answer)
- Running `composer outdated` to identify packages that may have introduced vulnerabilities
- Keeping a manual incident response checklist in the project's README
Correct answer: Integrating Laravel event listeners and notification channels (Slack, PagerDuty) triggered on anomalous events such as repeated failed logins or unexpected privilege escalation attempts
Automated alerting via Laravel events and notifications enables the rapid detection and response capability that the NIST CSF 'Respond' function requires.
Question 7: When a Laravel application must retain financial records for 7 years to comply with IRS regulations while also honoring GDPR deletion requests, what is the correct approach?
- Prioritize GDPR and delete all data immediately upon request, informing the IRS if audited
- Retain required financial records for the legally mandated period but pseudonymize or remove non-essential personal identifiers, relying on a lawful retention basis to override the deletion request for those specific records (Correct answer)
- Deny all GDPR deletion requests from US customers since IRS rules take precedence globally
- Store a copy of all financial records in an escrow service outside both US and EU jurisdictions
Correct answer: Retain required financial records for the legally mandated period but pseudonymize or remove non-essential personal identifiers, relying on a lawful retention basis to override the deletion request for those specific records
Competing legal obligations allow retention under a separate lawful basis (legal obligation), but the application should minimize personal data within retained records as much as possible.
LARAVEL Regulatory Frameworks & Compliance 5
Under GDPR's data minimization principle, which Laravel practice best aligns with only collecting what is necessary?