PHP Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Under GDPR, what PHP session handling practice is required when a user withdraws consent?
- Destroy the session and delete associated personal data (Correct answer)
- Archive the session for 30 days before deletion
- Anonymize the session ID only
- Transfer the session to a cold storage system
Correct answer: Destroy the session and delete associated personal data
GDPR Article 17 (right to erasure) requires that when consent is withdrawn, associated personal data including session data must be deleted promptly.
Question 2: Which PHP function is most appropriate for generating a cryptographically secure token for CSRF protection in a compliance-focused application?
- rand()
- md5(uniqid())
- random_bytes(32) (Correct answer)
- sha1(time())
Correct answer: random_bytes(32)
random_bytes() uses a CSPRNG and is the PHP-recommended way to generate cryptographically secure tokens, meeting compliance standards.
Question 3: A PCI DSS compliant PHP application must ensure cardholder data is never stored in which location?
- Encrypted database columns
- PHP session files on disk (Correct answer)
- HSM-backed key stores
- Tokenized references
Correct answer: PHP session files on disk
PCI DSS prohibits storing sensitive authentication data including full card numbers in session files, logs, or any unencrypted temporary storage.
Question 4: Which HTTP header should a PHP application set to prevent MIME-type sniffing, as required by many security compliance frameworks?
- Content-Security-Policy
- X-Content-Type-Options: nosniff (Correct answer)
- X-Frame-Options: DENY
- Strict-Transport-Security
Correct answer: X-Content-Type-Options: nosniff
The X-Content-Type-Options: nosniff header instructs browsers not to override the declared Content-Type, preventing MIME-sniffing attacks.
Question 5: Under HIPAA, a PHP application storing PHI must implement which logging requirement?
- Log only failed login attempts
- Maintain audit logs of all PHI access and modifications (Correct answer)
- Log PHP errors to a public endpoint
- Record only database schema changes
Correct answer: Maintain audit logs of all PHI access and modifications
HIPAA's Security Rule (45 CFR §164.312) requires audit controls that record and examine activity in systems containing PHI.
Question 6: What PHP configuration directive must be disabled to comply with production security standards and prevent exposing server internals?
- display_errors = Off (Correct answer)
- error_reporting = E_ALL
- log_errors = On
- output_buffering = On
Correct answer: display_errors = Off
display_errors must be Off in production to prevent error messages from leaking server paths, SQL queries, or other sensitive information to end users.
Question 7: Which OWASP Top 10 vulnerability is directly addressed by PHP's prepared statements with PDO or MySQLi?
- Broken Access Control
- SQL Injection (Correct answer)
- Security Misconfiguration
- Insecure Deserialization
Correct answer: SQL Injection
Prepared statements separate SQL code from data, preventing SQL injection by ensuring user input is never interpreted as SQL commands.
PHP Regulatory Frameworks & Compliance 2
Under GDPR, what PHP session handling practice is required when a user withdraws consent?