NestJS Regulatory Frameworks & Compliance 4

Question 1

A NestJS app must pass a SOC 2 vulnerability management audit. Which CI/CD integration directly satisfies this control?

Accepted Answer

Running `npm audit` in CI and failing the build on high/critical CVEs

Answer

Automated `npm audit` in CI with a high/critical failure gate provides continuous, auditable vulnerability scanning required by SOC 2 CC7.1.

Question 2

Which NestJS guard implementation correctly enforces the principle of least privilege for a multi-tenant SaaS application?

Accepted Answer

A guard that validates the JWT subject matches the resource's tenant_id in the database before allowing access

Answer

Validating the JWT subject against the resource's tenant ownership in the database prevents cross-tenant data access, enforcing least privilege at the resource level.

Question 3

Under GDPR, a NestJS app receives a Subject Access Request (SAR). What must the API response include within 30 days?

Accepted Answer

All personal data held, the processing purposes, retention periods, and any third parties data is shared with

Answer

GDPR Article 15 requires a complete copy of all personal data plus metadata about processing purposes, retention, and recipients.

Question 4

A NestJS app uses JWT for authentication. Which claim must be validated on every request to comply with OWASP API Security Top 10 item API2:2023 (Broken Authentication)?

Accepted Answer

Signature, expiration (exp), issuer (iss), and audience (aud) claims

Answer

Full JWT validation requires verifying the signature, expiration, issuer, and audience to prevent token replay, misuse across services, and expired token acceptance.

Question 5

Which NestJS ExceptionFilter configuration helps meet GDPR's requirement to avoid leaking personal data in error responses?

Accepted Answer

A global filter that maps internal exceptions to generic messages, logging sensitive details server-side only

Answer

A global exception filter sanitizes responses, preventing PII in error messages from reaching clients while preserving details in server-side logs.

NestJS Practice Test

NestJS Practice Test

NestJS Regulatory Frameworks & Compliance 4