PHP Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which PHP cookie flag combination is required for session cookies in a GDPR and PCI DSS compliant application?
- HttpOnly and SameSite=Lax only
- Secure, HttpOnly, and SameSite=Strict (Correct answer)
- Secure and Domain flags only
- HttpOnly and Path=/ only
Correct answer: Secure, HttpOnly, and SameSite=Strict
Combining Secure (HTTPS only), HttpOnly (no JS access), and SameSite=Strict (CSRF protection) provides the strongest cookie security posture required by compliance standards.
Question 2: A PHP application subject to SOC 2 Type II must demonstrate which capability regarding encryption keys?
- Keys are hardcoded in source code for reliability
- Key rotation procedures exist and are documented (Correct answer)
- Keys are stored in $_SERVER superglobal
- A single master key encrypts all data forever
Correct answer: Key rotation procedures exist and are documented
SOC 2 Type II requires demonstrating operational controls over time, including documented key rotation procedures to limit exposure from compromised keys.
Question 3: Under COPPA regulations, what must a PHP web application verify before collecting data from users who may be under 13?
- User's IP geolocation
- Verifiable parental consent (Correct answer)
- Browser version compatibility
- Email domain validity
Correct answer: Verifiable parental consent
COPPA (Children's Online Privacy Protection Act) requires websites to obtain verifiable parental consent before collecting personal information from children under 13.
Question 4: Which PHP function should be used to hash passwords in a NIST 800-63B compliant application?
- md5()
- sha256()
- password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID (Correct answer)
- base64_encode()
Correct answer: password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID
NIST 800-63B recommends memory-hard algorithms; PHP's password_hash() with bcrypt or Argon2id meets these requirements and handles salting automatically.
Question 5: In a PHP application, what is the compliant approach to handling a data subject access request (DSAR) under GDPR?
- Respond within 72 hours with all server logs
- Provide all personal data held about the individual within 30 days (Correct answer)
- Delete the account without confirmation
- Forward the request to a third-party processor indefinitely
Correct answer: Provide all personal data held about the individual within 30 days
GDPR Article 15 grants data subjects the right to access their personal data, and controllers must respond within one calendar month (approximately 30 days).
Question 6: Which PHP ini setting should be enabled in compliance environments to prevent session fixation attacks?
- session.use_strict_mode = 1 (Correct answer)
- session.save_path = /tmp
- session.gc_maxlifetime = 0
- session.cookie_lifetime = 86400
Correct answer: session.use_strict_mode = 1
session.use_strict_mode=1 causes PHP to reject uninitialized session IDs, preventing attackers from fixing a session ID before the user authenticates.
Question 7: What does the 'data minimization' principle under GDPR require of a PHP application's data collection forms?
- Collect as much data as possible for future analytics
- Collect only data that is adequate, relevant, and necessary for the stated purpose (Correct answer)
- Store all form submissions for 10 years by default
- Require users to provide government ID for all registrations
Correct answer: Collect only data that is adequate, relevant, and necessary for the stated purpose
GDPR Article 5(1)(c) requires data minimization: only personal data that is necessary for the specific purpose should be collected and processed.
PHP Regulatory Frameworks & Compliance 3
Which PHP cookie flag combination is required for session cookies in a GDPR and PCI DSS compliant application?