PHP Regulatory Frameworks & Compliance 2

Question 1

Under GDPR, what PHP session handling practice is required when a user withdraws consent?

Accepted Answer

Destroy the session and delete associated personal data

Answer

GDPR Article 17 (right to erasure) requires that when consent is withdrawn, associated personal data including session data must be deleted promptly.

Question 2

Which PHP function is most appropriate for generating a cryptographically secure token for CSRF protection in a compliance-focused application?

Accepted Answer

random_bytes(32)

Answer

random_bytes() uses a CSPRNG and is the PHP-recommended way to generate cryptographically secure tokens, meeting compliance standards.

Question 3

A PCI DSS compliant PHP application must ensure cardholder data is never stored in which location?

Accepted Answer

PHP session files on disk

Answer

PCI DSS prohibits storing sensitive authentication data including full card numbers in session files, logs, or any unencrypted temporary storage.

Question 4

Which HTTP header should a PHP application set to prevent MIME-type sniffing, as required by many security compliance frameworks?

Accepted Answer

X-Content-Type-Options: nosniff

Answer

The X-Content-Type-Options: nosniff header instructs browsers not to override the declared Content-Type, preventing MIME-sniffing attacks.

Question 5

Under HIPAA, a PHP application storing PHI must implement which logging requirement?

Accepted Answer

Maintain audit logs of all PHI access and modifications

Answer

HIPAA's Security Rule (45 CFR §164.312) requires audit controls that record and examine activity in systems containing PHI.

PHP - PHP Programming Language Practice Test