NestJS Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A NestJS app is PCI DSS in scope. Which transport configuration is mandatory for all cardholder data environments?
- TLS 1.0 or higher
- TLS 1.2 or higher with strong cipher suites (Correct answer)
- SSL 3.0 with AES-128
- Any HTTPS configuration satisfies PCI DSS
Correct answer: TLS 1.2 or higher with strong cipher suites
PCI DSS v4.0 requires TLS 1.2 minimum (TLS 1.3 preferred) and prohibits older SSL/TLS versions and weak cipher suites.
Question 2: Under GDPR Article 25 (Data Protection by Design), which NestJS DTO pattern best demonstrates compliance?
- Accepting all fields with @IsOptional() to maximize flexibility
- Using whitelisting via @IsNotEmpty() only on required fields
- Using class-transformer with @Exclude() by default and @Expose() only on necessary fields (Correct answer)
- Defining DTOs with any type to defer validation to the database
Correct answer: Using class-transformer with @Exclude() by default and @Expose() only on necessary fields
Excluding all properties by default and explicitly exposing only necessary ones enforces data minimization at the API boundary, a core Design by Default principle.
Question 3: Which NestJS approach satisfies ISO 27001 A.12.4.1 (Event Logging) for a production API?
- console.log statements in each service method
- Structured JSON logging with correlation IDs, timestamps, severity, and user identity piped to a SIEM (Correct answer)
- Error-level only logging to reduce storage costs
- Logging request bodies for maximum audit detail
Correct answer: Structured JSON logging with correlation IDs, timestamps, severity, and user identity piped to a SIEM
ISO 27001 A.12.4.1 requires comprehensive, structured event logs that can be correlated and analyzed; a SIEM integration enables centralized monitoring.
Question 4: A GDPR DPA requests a record of processing activities (RoPA). Which NestJS metadata annotation strategy best supports generating this report?
- Using @ApiProperty() Swagger decorators on every DTO field with a 'purpose' description
- Adding custom @ProcessingActivity() decorators that document lawful basis and data categories per endpoint (Correct answer)
- Hardcoding the RoPA in a README file
- Using TypeORM column comments to document processing purpose
Correct answer: Adding custom @ProcessingActivity() decorators that document lawful basis and data categories per endpoint
Custom decorators that capture lawful basis and data categories per endpoint enable automated RoPA generation directly from code metadata.
Question 5: Which NestJS rate-limiting configuration best aligns with OWASP API Security Top 10 item API4:2023 (Unrestricted Resource Consumption)?
- Global ThrottlerGuard with per-user limits and a sliding window algorithm (Correct answer)
- IP-based blocking after 1000 requests per day
- No rate limiting if behind a WAF
- Rate limiting only unauthenticated endpoints
Correct answer: Global ThrottlerGuard with per-user limits and a sliding window algorithm
Per-user sliding-window throttling prevents resource exhaustion from authenticated abuse, which IP-only or static limits fail to address.
Question 6: A NestJS microservice handles PHI. Under HIPAA's Minimum Necessary Standard, which data-access pattern is most compliant?
- Returning full patient records and letting the client filter
- Projecting only the fields required for the specific use case per query (Correct answer)
- Caching full records in Redis for performance
- Delegating field filtering to the frontend
Correct answer: Projecting only the fields required for the specific use case per query
HIPAA's Minimum Necessary Standard requires limiting PHI access and disclosure to only what is needed for a specific purpose, enforced server-side.
Question 7: For FedRAMP compliance, a NestJS app's secrets must be rotated regularly. Which implementation pattern best automates this?
- Storing secrets in .env files and manually updating them quarterly
- Integrating with AWS Secrets Manager or HashiCorp Vault and rotating secrets on a schedule without redeployment (Correct answer)
- Hardcoding credentials in Docker environment variables
- Rotating secrets by rebuilding the Docker image monthly
Correct answer: Integrating with AWS Secrets Manager or HashiCorp Vault and rotating secrets on a schedule without redeployment
Vault/Secrets Manager integration enables automated rotation and dynamic credential injection without service restarts, meeting FedRAMP continuous monitoring requirements.
NestJS Regulatory Frameworks & Compliance 3
A NestJS app is PCI DSS in scope.
Which transport configuration is mandatory for all cardholder data environments?