PHP Regulatory Frameworks & Compliance 3

Question 1

Which PHP cookie flag combination is required for session cookies in a GDPR and PCI DSS compliant application?

Accepted Answer

Secure, HttpOnly, and SameSite=Strict

Answer

Combining Secure (HTTPS only), HttpOnly (no JS access), and SameSite=Strict (CSRF protection) provides the strongest cookie security posture required by compliance standards.

Question 2

A PHP application subject to SOC 2 Type II must demonstrate which capability regarding encryption keys?

Accepted Answer

Key rotation procedures exist and are documented

Answer

SOC 2 Type II requires demonstrating operational controls over time, including documented key rotation procedures to limit exposure from compromised keys.

Question 3

Under COPPA regulations, what must a PHP web application verify before collecting data from users who may be under 13?

Accepted Answer

Verifiable parental consent

Answer

COPPA (Children's Online Privacy Protection Act) requires websites to obtain verifiable parental consent before collecting personal information from children under 13.

Question 4

Which PHP function should be used to hash passwords in a NIST 800-63B compliant application?

Accepted Answer

password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID

Answer

NIST 800-63B recommends memory-hard algorithms; PHP's password_hash() with bcrypt or Argon2id meets these requirements and handles salting automatically.

Question 5

In a PHP application, what is the compliant approach to handling a data subject access request (DSAR) under GDPR?

Accepted Answer

Provide all personal data held about the individual within 30 days

Answer

GDPR Article 15 grants data subjects the right to access their personal data, and controllers must respond within one calendar month (approximately 30 days).

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP Regulatory Frameworks & Compliance 3