PHP Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A PHP application must comply with the California Consumer Privacy Act (CCPA). Which feature must be implemented for California residents?
- Mandatory two-factor authentication
- A 'Do Not Sell My Personal Information' opt-out mechanism (Correct answer)
- Automatic account deletion after 90 days
- IP-based geofencing of all content
Correct answer: A 'Do Not Sell My Personal Information' opt-out mechanism
CCPA (Cal. Civ. Code §1798.120) requires businesses to provide California consumers a clear mechanism to opt out of the sale of their personal information.
Question 2: Which PHP extension provides AES-256-GCM encryption suitable for encrypting sensitive data in FIPS 140-2 compliant applications?
- mcrypt (deprecated)
- openssl with openssl_encrypt() (Correct answer)
- gzip with zlib
- hash_hmac with SHA1
Correct answer: openssl with openssl_encrypt()
PHP's openssl extension using openssl_encrypt() with 'aes-256-gcm' provides authenticated encryption that meets FIPS 140-2 approved algorithm requirements.
Question 3: Under PCI DSS Requirement 6, PHP applications must apply security patches within what timeframe for critical vulnerabilities?
- Within 1 month
- Within 30 days for critical patches (Correct answer)
- Within 6 months
- Only during scheduled quarterly maintenance
Correct answer: Within 30 days for critical patches
PCI DSS Requirement 6.3.3 requires that all system components are protected from known vulnerabilities, with critical patches applied within one month of release.
Question 4: What PHP technique prevents XML External Entity (XXE) injection, which is flagged by compliance security scans?
- Using json_encode() instead of XML
- Disabling external entity loading with libxml_disable_entity_loader(true) (Correct answer)
- Validating XML with md5 checksums
- Storing XML in session variables
Correct answer: Disabling external entity loading with libxml_disable_entity_loader(true)
libxml_disable_entity_loader(true) prevents the XML parser from loading external entities, which is the primary defense against XXE injection attacks.
Question 5: In a PHP application, which approach to storing API keys complies with security frameworks like NIST and ISO 27001?
- Hardcode keys in PHP source files checked into git
- Store keys in environment variables loaded from a secured .env file excluded from version control (Correct answer)
- Encode keys in base64 and store in a public config file
- Store keys as PHP comments in the codebase
Correct answer: Store keys in environment variables loaded from a secured .env file excluded from version control
Environment variables kept outside version control prevent secret exposure in code repositories, aligning with the principle of least privilege required by NIST and ISO 27001.
Question 6: Which PHP output encoding function should be used to prevent XSS when rendering user-supplied data in HTML, as required by OWASP secure coding guidelines?
- strip_tags()
- htmlspecialchars() with ENT_QUOTES and the correct charset (Correct answer)
- addslashes()
- urlencode()
Correct answer: htmlspecialchars() with ENT_QUOTES and the correct charset
htmlspecialchars() with ENT_QUOTES converts special characters to HTML entities, neutralizing XSS payloads when outputting user data into HTML context.
Question 7: A PHP application must implement rate limiting to comply with OWASP and prevent credential stuffing attacks. Which approach is most appropriate?
- Block all requests after 1000/day per server IP
- Track failed login attempts per user/IP and implement exponential backoff with account lockout (Correct answer)
- Disable login endpoints after business hours
- Require CAPTCHA only on the registration page
Correct answer: Track failed login attempts per user/IP and implement exponential backoff with account lockout
Per-user and per-IP tracking with exponential backoff and temporary lockout defends against credential stuffing while minimizing impact on legitimate users.
PHP Regulatory Frameworks & Compliance 4
A PHP application must comply with the California Consumer Privacy Act (CCPA).
Which feature must be implemented for California residents?