NestJS Regulatory Frameworks & Compliance 2

Question 1

Which NestJS mechanism is best suited for enforcing HIPAA audit logging on every controller method without modifying each handler?

Accepted Answer

Interceptors

Answer

Interceptors wrap handler execution before and after, making them ideal for cross-cutting audit logging without touching business logic.

Question 2

A NestJS app must comply with GDPR's 'right to erasure'. What database strategy best supports this in a Drizzle ORM setup?

Accepted Answer

Encrypting PII columns with a per-user key then discarding the key

Answer

Discarding a per-user encryption key renders PII unreadable (cryptographic erasure), satisfying right-to-erasure even when hard deletes are impractical.

Question 3

Under SOC 2 Type II, which NestJS feature helps demonstrate that only authorized roles accessed sensitive endpoints over a defined audit period?

Accepted Answer

Role-based guards combined with structured access logs

Answer

Role-based guards enforce access control, and structured logs provide the evidence auditors need to verify controls operated continuously.

Question 4

Which HTTP header, easily set via the `helmet` package in NestJS, directly helps comply with PCI DSS requirements around preventing clickjacking attacks?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options (DENY or SAMEORIGIN) prevents iframe embedding, directly addressing clickjacking which PCI DSS considers a UI redress attack vector.

Question 5

A NestJS service stores tokens in Redis. To comply with FIPS 140-2, which encryption approach is required?

Accepted Answer

FIPS-validated cryptographic modules using approved algorithms like AES-256-GCM

Answer

FIPS 140-2 requires use of validated cryptographic modules implementing NIST-approved algorithms; AES-256-GCM is an approved mode.

NestJS Practice Test

NestJS Practice Test

NestJS Regulatory Frameworks & Compliance 2