PHP Regulatory Frameworks & Compliance 4

Question 1

A PHP application must comply with the California Consumer Privacy Act (CCPA). Which feature must be implemented for California residents?

Accepted Answer

A 'Do Not Sell My Personal Information' opt-out mechanism

Answer

CCPA (Cal. Civ. Code §1798.120) requires businesses to provide California consumers a clear mechanism to opt out of the sale of their personal information.

Question 2

Which PHP extension provides AES-256-GCM encryption suitable for encrypting sensitive data in FIPS 140-2 compliant applications?

Accepted Answer

openssl with openssl_encrypt()

Answer

PHP's openssl extension using openssl_encrypt() with 'aes-256-gcm' provides authenticated encryption that meets FIPS 140-2 approved algorithm requirements.

Question 3

Under PCI DSS Requirement 6, PHP applications must apply security patches within what timeframe for critical vulnerabilities?

Accepted Answer

Within 30 days for critical patches

Answer

PCI DSS Requirement 6.3.3 requires that all system components are protected from known vulnerabilities, with critical patches applied within one month of release.

Question 4

What PHP technique prevents XML External Entity (XXE) injection, which is flagged by compliance security scans?

Accepted Answer

Disabling external entity loading with libxml_disable_entity_loader(true)

Answer

libxml_disable_entity_loader(true) prevents the XML parser from loading external entities, which is the primary defense against XXE injection attacks.

Question 5

In a PHP application, which approach to storing API keys complies with security frameworks like NIST and ISO 27001?

Accepted Answer

Store keys in environment variables loaded from a secured .env file excluded from version control

Answer

Environment variables kept outside version control prevent secret exposure in code repositories, aligning with the principle of least privilege required by NIST and ISO 27001.

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP Regulatory Frameworks & Compliance 4