NestJS Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A NestJS app must pass a SOC 2 vulnerability management audit. Which CI/CD integration directly satisfies this control?
- Running `npm audit` in CI and failing the build on high/critical CVEs (Correct answer)
- Manually reviewing npm packages monthly
- Using only well-known packages with many GitHub stars
- Pinning all dependency versions in package.json
Correct answer: Running `npm audit` in CI and failing the build on high/critical CVEs
Automated `npm audit` in CI with a high/critical failure gate provides continuous, auditable vulnerability scanning required by SOC 2 CC7.1.
Question 2: Which NestJS guard implementation correctly enforces the principle of least privilege for a multi-tenant SaaS application?
- A guard that checks JWT role claims against a static roles array
- A guard that validates the JWT subject matches the resource's tenant_id in the database before allowing access (Correct answer)
- A guard that allows access if any valid JWT is present
- A guard that restricts access by IP address
Correct answer: A guard that validates the JWT subject matches the resource's tenant_id in the database before allowing access
Validating the JWT subject against the resource's tenant ownership in the database prevents cross-tenant data access, enforcing least privilege at the resource level.
Question 3: Under GDPR, a NestJS app receives a Subject Access Request (SAR). What must the API response include within 30 days?
- Only the user's email and name
- All personal data held, the processing purposes, retention periods, and any third parties data is shared with (Correct answer)
- A confirmation that data exists but not the data itself
- Only data created in the last 12 months
Correct answer: All personal data held, the processing purposes, retention periods, and any third parties data is shared with
GDPR Article 15 requires a complete copy of all personal data plus metadata about processing purposes, retention, and recipients.
Question 4: A NestJS app uses JWT for authentication. Which claim must be validated on every request to comply with OWASP API Security Top 10 item API2:2023 (Broken Authentication)?
- Only the signature using the secret key
- Signature, expiration (exp), issuer (iss), and audience (aud) claims (Correct answer)
- Only the user ID (sub) claim
- Only the issued-at (iat) claim
Correct answer: Signature, expiration (exp), issuer (iss), and audience (aud) claims
Full JWT validation requires verifying the signature, expiration, issuer, and audience to prevent token replay, misuse across services, and expired token acceptance.
Question 5: Which NestJS ExceptionFilter configuration helps meet GDPR's requirement to avoid leaking personal data in error responses?
- Returning the full stack trace with database error details
- A global filter that maps internal exceptions to generic messages, logging sensitive details server-side only (Correct answer)
- Disabling all error responses to prevent any leakage
- Returning raw database constraint errors to help the client debug
Correct answer: A global filter that maps internal exceptions to generic messages, logging sensitive details server-side only
A global exception filter sanitizes responses, preventing PII in error messages from reaching clients while preserving details in server-side logs.
Question 6: For COPPA compliance, a NestJS registration endpoint must verify user age before collecting personal data. Which implementation is most defensible?
- Trusting the client-submitted age field without server-side validation
- Server-side age gate using date-of-birth, blocking registration and deleting any collected data for users under 13 (Correct answer)
- Adding a checkbox 'I am over 13' with no further verification
- Only enforcing age verification in the frontend
Correct answer: Server-side age gate using date-of-birth, blocking registration and deleting any collected data for users under 13
COPPA requires verifiable age gates; a server-side DOB check that rejects and purges data for under-13 users is the minimum defensible implementation.
Question 7: A NestJS app handling credit card data must comply with PCI DSS Requirement 3.5 (protect stored account data). Which approach is correct?
- Storing the full PAN encrypted with AES-256 in the database
- Storing only a tokenized reference from a PCI-compliant payment processor, never the PAN (Correct answer)
- Hashing the PAN with SHA-256 for storage
- Storing the last 4 digits and expiry date only
Correct answer: Storing only a tokenized reference from a PCI-compliant payment processor, never the PAN
The best practice is to never store PAN data at all; tokenization via a PCI-compliant processor moves the compliance burden off your application.
NestJS Regulatory Frameworks & Compliance 4
A NestJS app must pass a SOC 2 vulnerability management audit.
Which CI/CD integration directly satisfies this control?