NestJS Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which NestJS mechanism is best suited for enforcing HIPAA audit logging on every controller method without modifying each handler?
- Middleware
- Interceptors (Correct answer)
- Guards
- Pipes
Correct answer: Interceptors
Interceptors wrap handler execution before and after, making them ideal for cross-cutting audit logging without touching business logic.
Question 2: A NestJS app must comply with GDPR's 'right to erasure'. What database strategy best supports this in a Drizzle ORM setup?
- Soft deletes with a deleted_at column
- Hard deletes with cascading foreign keys
- Archiving rows to a cold storage table
- Encrypting PII columns with a per-user key then discarding the key (Correct answer)
Correct answer: Encrypting PII columns with a per-user key then discarding the key
Discarding a per-user encryption key renders PII unreadable (cryptographic erasure), satisfying right-to-erasure even when hard deletes are impractical.
Question 3: Under SOC 2 Type II, which NestJS feature helps demonstrate that only authorized roles accessed sensitive endpoints over a defined audit period?
- Helmet middleware
- Role-based guards combined with structured access logs (Correct answer)
- CORS configuration
- Rate limiting interceptors
Correct answer: Role-based guards combined with structured access logs
Role-based guards enforce access control, and structured logs provide the evidence auditors need to verify controls operated continuously.
Question 4: Which HTTP header, easily set via the `helmet` package in NestJS, directly helps comply with PCI DSS requirements around preventing clickjacking attacks?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- Strict-Transport-Security
- X-Content-Type-Options
Correct answer: X-Frame-Options
X-Frame-Options (DENY or SAMEORIGIN) prevents iframe embedding, directly addressing clickjacking which PCI DSS considers a UI redress attack vector.
Question 5: A NestJS service stores tokens in Redis. To comply with FIPS 140-2, which encryption approach is required?
- AES-128-CBC with a static IV
- FIPS-validated cryptographic modules using approved algorithms like AES-256-GCM (Correct answer)
- MD5 hashing for token verification
- Base64 encoding for obfuscation
Correct answer: FIPS-validated cryptographic modules using approved algorithms like AES-256-GCM
FIPS 140-2 requires use of validated cryptographic modules implementing NIST-approved algorithms; AES-256-GCM is an approved mode.
Question 6: To comply with CCPA, a NestJS API receives a 'Do Not Sell' request. Which architectural response is most appropriate?
- Set a cookie flag and block ad network pixels on subsequent responses
- Delete the user's account immediately
- Return a 403 Forbidden on all future requests
- Store the opt-out preference and propagate it to downstream data processors (Correct answer)
Correct answer: Store the opt-out preference and propagate it to downstream data processors
CCPA requires honoring opt-out preferences and ensuring third-party data processors also respect the user's choice.
Question 7: Which NestJS configuration practice directly supports NIST SP 800-53 SC-28 (Protection of Information at Rest)?
- Using ConfigModule with environment variables for database URLs
- Encrypting the database volume and NestJS config secrets using a KMS (Correct answer)
- Enabling CORS with specific origins
- Using class-validator to validate DTOs
Correct answer: Encrypting the database volume and NestJS config secrets using a KMS
SC-28 requires encrypting sensitive data at rest; using a KMS for both the storage layer and application secrets satisfies this control.
NestJS Regulatory Frameworks & Compliance 2
Which NestJS mechanism is best suited for enforcing HIPAA audit logging on every controller method without modifying each handler?