NestJS Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which NestJS module configuration correctly implements GDPR's purpose limitation principle when using a single database?
- Using a single repository for all data access to simplify queries
- Using separate bounded-context modules where each module's repository only accesses data needed for its declared processing purpose (Correct answer)
- Granting all services read/write access to all tables for flexibility
- Using views with no access restrictions
Correct answer: Using separate bounded-context modules where each module's repository only accesses data needed for its declared processing purpose
Bounded-context modules with purpose-specific repositories enforce purpose limitation at the code level, preventing data from being used for undeclared purposes.
Question 2: Under HIPAA's Security Rule (45 CFR §164.312), which NestJS session configuration satisfies the workstation timeout requirement?
- No session timeout to improve user experience
- Automatic session expiration after a defined inactivity period with server-side token invalidation (Correct answer)
- Client-side token deletion on browser close only
- A 24-hour JWT expiration regardless of activity
Correct answer: Automatic session expiration after a defined inactivity period with server-side token invalidation
HIPAA requires automatic logoff after inactivity; server-side token invalidation ensures the session is truly terminated, not just the client-side token.
Question 3: A NestJS microservice architecture must comply with ISO 27001 A.13.1.3 (Segregation of Networks). Which deployment pattern supports this?
- Deploying all microservices on the same network with no firewall rules
- Placing internal services in a private VPC subnet, exposing only the API gateway publicly with strict security group rules (Correct answer)
- Using a single port for all inter-service communication
- Relying on application-level authentication without network segregation
Correct answer: Placing internal services in a private VPC subnet, exposing only the API gateway publicly with strict security group rules
Network segregation via VPC subnets and security groups implements ISO 27001 A.13.1.3 at the infrastructure level, limiting lateral movement.
Question 4: For ADA/WCAG 2.1 compliance in a NestJS-served web application, which server-side practice is most impactful?
- Serving semantic HTML with proper ARIA attributes and ensuring API responses include accessible text alternatives for media content (Correct answer)
- Using CSS animations on all interactive elements
- Returning binary data formats for all API responses
- Minifying HTML to reduce payload size
Correct answer: Serving semantic HTML with proper ARIA attributes and ensuring API responses include accessible text alternatives for media content
Semantic HTML and ARIA attributes from the server ensure assistive technologies can interpret content regardless of the client framework.
Question 5: A NestJS app is audited under NIST CSF (Cybersecurity Framework) Identify function. Which implementation provides asset inventory evidence?
- A Swagger/OpenAPI spec auto-generated from NestJS decorators documenting all endpoints, data types, and dependencies (Correct answer)
- A manually maintained Word document listing services
- PM2 process list exported monthly
- A README listing the tech stack
Correct answer: A Swagger/OpenAPI spec auto-generated from NestJS decorators documenting all endpoints, data types, and dependencies
Auto-generated OpenAPI specs provide a machine-readable, always-current inventory of API assets and data flows, satisfying NIST CSF ID.AM requirements.
Question 6: Which NestJS strategy best satisfies GDPR's data breach notification requirement (Article 33) from a technical readiness perspective?
- Sending breach notifications manually after the security team discovers an incident
- Implementing automated anomaly detection with alerting that triggers a documented incident response runbook within the 72-hour window (Correct answer)
- Logging all errors to a file that is reviewed weekly
- Relying on the cloud provider's security notifications alone
Correct answer: Implementing automated anomaly detection with alerting that triggers a documented incident response runbook within the 72-hour window
GDPR Article 33 requires notifying the DPA within 72 hours; automated detection and a tested runbook ensure the timeline is met.
Question 7: A NestJS application is subject to LGPD (Brazil's data protection law). Which feature mirrors GDPR's consent requirement that LGPD also mandates?
- Implied consent based on terms of service acceptance
- Freely given, specific, informed, and unambiguous consent with a server-side consent record tied to the user's account (Correct answer)
- Pre-checked opt-in boxes
- Consent obtained once at registration covering all future processing purposes
Correct answer: Freely given, specific, informed, and unambiguous consent with a server-side consent record tied to the user's account
LGPD Article 8 requires consent to be free, informed, specific, and unambiguous, with records maintained — mirroring GDPR's consent standard.
NestJS Regulatory Frameworks & Compliance 5
Which NestJS module configuration correctly implements GDPR's purpose limitation principle when using a single database?