NestJS Regulatory Frameworks & Compliance 5

Question 1

Which NestJS module configuration correctly implements GDPR's purpose limitation principle when using a single database?

Accepted Answer

Using separate bounded-context modules where each module's repository only accesses data needed for its declared processing purpose

Answer

Bounded-context modules with purpose-specific repositories enforce purpose limitation at the code level, preventing data from being used for undeclared purposes.

Question 2

Under HIPAA's Security Rule (45 CFR §164.312), which NestJS session configuration satisfies the workstation timeout requirement?

Accepted Answer

Automatic session expiration after a defined inactivity period with server-side token invalidation

Answer

HIPAA requires automatic logoff after inactivity; server-side token invalidation ensures the session is truly terminated, not just the client-side token.

Question 3

A NestJS microservice architecture must comply with ISO 27001 A.13.1.3 (Segregation of Networks). Which deployment pattern supports this?

Accepted Answer

Placing internal services in a private VPC subnet, exposing only the API gateway publicly with strict security group rules

Answer

Network segregation via VPC subnets and security groups implements ISO 27001 A.13.1.3 at the infrastructure level, limiting lateral movement.

Question 4

For ADA/WCAG 2.1 compliance in a NestJS-served web application, which server-side practice is most impactful?

Accepted Answer

Serving semantic HTML with proper ARIA attributes and ensuring API responses include accessible text alternatives for media content

Answer

Semantic HTML and ARIA attributes from the server ensure assistive technologies can interpret content regardless of the client framework.

Question 5

A NestJS app is audited under NIST CSF (Cybersecurity Framework) Identify function. Which implementation provides asset inventory evidence?

Accepted Answer

A Swagger/OpenAPI spec auto-generated from NestJS decorators documenting all endpoints, data types, and dependencies

Answer

Auto-generated OpenAPI specs provide a machine-readable, always-current inventory of API assets and data flows, satisfying NIST CSF ID.AM requirements.

NestJS Practice Test

NestJS Practice Test

NestJS Regulatory Frameworks & Compliance 5