LARAVEL Regulatory Frameworks & Compliance 5

Question 1

Under GDPR's data minimization principle, which Laravel practice best aligns with only collecting what is necessary?

Accepted Answer

Using `$request->only(['name', 'email'])` or Form Request validation rules that explicitly allow only required fields

Answer

Using `only()` or strict validation allow-lists ensures the application never processes or stores fields beyond what is needed, directly implementing data minimization.

Question 2

Which Laravel logging configuration best supports a compliance requirement for tamper-evident, centralized log management (e.g., for SOC 2 or PCI DSS log integrity)?

Accepted Answer

Using the `stack` channel that ships logs to an external SIEM or log management service (e.g., via a `syslog` or HTTP channel), where logs are immutable and access-controlled

Answer

PCI DSS and SOC 2 require logs to be sent to a separate, access-controlled system to prevent tampering—local-only log files can be altered by anyone with server access.

Question 3

A Laravel API handles sensitive personal data and must comply with GDPR. Which HTTP method and endpoint design principle reduces unnecessary data exposure compared to a non-compliant alternative?

Accepted Answer

Returning only the fields the consuming client needs (sparse fieldsets) rather than full model serialization, and using API Resources to control the output

Answer

API Resources with explicit field control prevent over-exposure of personal data, supporting GDPR's data minimization and purpose limitation principles at the API layer.

Question 4

Laravel's `Illuminate\Cookie\Middleware\EncryptCookies` middleware is relevant to which compliance concern?

Accepted Answer

Satisfying requirements that session and application cookies not leak sensitive data in transit or be tampered with by the client, as required by PCI DSS and HIPAA

Answer

Encrypting cookies ensures that even if intercepted or inspected by the client, cookie values reveal no sensitive data and cannot be forged, satisfying integrity and confidentiality controls.

Question 5

A healthcare Laravel application stores patient appointment notes. Under HIPAA, which database-level control is required for PHI at rest?

Accepted Answer

Encrypting the database tablespace or individual sensitive columns using at-rest encryption, with key management separate from the data

Answer

HIPAA's Technical Safeguards require encryption of PHI at rest; separate credentials alone or hashing (which makes data unreadable) do not satisfy this requirement properly.

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL - Laravel PHP Framework Practice Test

LARAVEL Regulatory Frameworks & Compliance 5