Mobile App Design Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which accessibility standard do both Apple and Google recommend as the baseline for mobile app accessibility compliance in the US?
- WCAG 2.1 Level AA (Correct answer)
- Section 508 only
- ADA Title III exclusively
- ISO 9241-210
Correct answer: WCAG 2.1 Level AA
WCAG 2.1 Level AA is the globally accepted baseline that both Apple's Human Interface Guidelines and Google's Material Design reference for accessibility.
Question 2: A banking app stores session tokens in Android's SharedPreferences without encryption. This most directly violates:
- OWASP Mobile Top 10 — M2: Insecure Data Storage (Correct answer)
- GDPR Article 32 only
- PCI DSS Requirement 6 only
- CCPA data minimization principle
Correct answer: OWASP Mobile Top 10 — M2: Insecure Data Storage
OWASP Mobile Top 10 M2 specifically addresses insecure data storage, and SharedPreferences is not encrypted by default.
Question 3: Under the EU's Digital Services Act (DSA), very large online platforms must provide users the ability to:
- Opt out of recommender systems based on profiling (Correct answer)
- Request a full AI-generated explanation of every content decision
- Download all data in 24 hours upon request
- Disable all algorithmic content permanently
Correct answer: Opt out of recommender systems based on profiling
DSA Article 38 requires very large platforms to offer at least one recommender system option not based on profiling.
Question 4: An iOS app collects the device's advertising identifier (IDFA). Since iOS 14.5, what must the app do before accessing IDFA?
- Display an App Tracking Transparency (ATT) prompt and receive user permission (Correct answer)
- Include an entitlement in the app's provisioning profile
- Disclose IDFA use in the App Store description only
- Store IDFA in Keychain to comply with Apple's privacy framework
Correct answer: Display an App Tracking Transparency (ATT) prompt and receive user permission
Apple's ATT framework (iOS 14.5+) requires apps to request permission via NSUserTrackingUsageDescription before accessing IDFA.
Question 5: Which regulation mandates that mobile apps available to US federal employees must meet specific security and configuration requirements?
- FedRAMP (Federal Risk and Authorization Management Program)
- SOX (Sarbanes-Oxley Act)
- FISMA combined with NIST SP 800-163 (Correct answer)
- CISA Binding Operational Directive
Correct answer: FISMA combined with NIST SP 800-163
FISMA and NIST SP 800-163 together govern mobile app vetting and security requirements for federal government use.
Question 6: A health app sold as a Software as a Medical Device (SaMD) in the US must be reviewed by the FDA under which pathway for low-to-moderate risk devices?
- 510(k) Premarket Notification (Correct answer)
- Investigational Device Exemption (IDE)
- Humanitarian Device Exemption (HDE)
- De Novo classification request
Correct answer: 510(k) Premarket Notification
Most low-to-moderate risk SaMD products seek FDA clearance through the 510(k) premarket notification pathway by demonstrating substantial equivalence.
Question 7: When designing a subscription cancellation flow under the FTC's 'Click to Cancel' rule (2024), the cancellation mechanism must be:
- As easy to use as the sign-up mechanism (Correct answer)
- Available only via customer support phone call
- Completed within 3 business days of request
- Free but may include a mandatory retention survey
Correct answer: As easy to use as the sign-up mechanism
The FTC's 2024 'Click to Cancel' rule requires that cancellation be as simple and accessible as enrollment.
Mobile App Design Regulatory Frameworks & Compliance 3
Which accessibility standard do both Apple and Google recommend as the baseline for mobile app accessibility compliance in the US?