PHP Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Under GDPR's 72-hour breach notification rule, what must a PHP application have in place to detect a data breach quickly?
- Weekly manual database audits
- Real-time logging and alerting systems that detect anomalous data access patterns (Correct answer)
- Annual penetration tests only
- A printed incident response binder
Correct answer: Real-time logging and alerting systems that detect anomalous data access patterns
GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, which necessitates automated monitoring and alerting to detect incidents promptly.
Question 2: Which PHP configuration should be set to prevent directory traversal vulnerabilities in compliant file upload handling?
- open_basedir restriction to the application directory (Correct answer)
- allow_url_fopen = On
- disable_functions = exec only
- file_uploads = Off for all users
Correct answer: open_basedir restriction to the application directory
open_basedir restricts PHP's file operations to a specified directory tree, preventing path traversal attacks from accessing files outside the application root.
Question 3: In terms of GDPR data transfer compliance, what must a PHP application implement when sending personal data from the EU to a US-based third-party API?
- SHA-256 hash the data before transmission
- Ensure the recipient has adequate protections via SCCs, BCRs, or adequacy decision (Correct answer)
- Only transfer data during EU business hours
- Base64-encode all request payloads
Correct answer: Ensure the recipient has adequate protections via SCCs, BCRs, or adequacy decision
GDPR Chapter V restricts transfers to third countries — Standard Contractual Clauses (SCCs), Binding Corporate Rules, or an adequacy decision are the lawful transfer mechanisms.
Question 4: Which PHP practice violates the principle of least privilege, a core requirement in ISO 27001 and SOC 2 frameworks?
- Using a read-only database user for SELECT queries
- Connecting to the database with a root or superuser account in the application (Correct answer)
- Storing credentials in environment variables
- Using role-based access control in application logic
Correct answer: Connecting to the database with a root or superuser account in the application
Using a database superuser in the application grants far more permissions than needed, violating least privilege — a fundamental control in ISO 27001 and SOC 2.
Question 5: What does Content Security Policy (CSP) header in a PHP application primarily help prevent, as recommended by security compliance frameworks?
- SQL injection via HTTP headers
- Cross-Site Scripting (XSS) by restricting resource loading origins (Correct answer)
- Session hijacking via cookie theft
- Brute force attacks on login endpoints
Correct answer: Cross-Site Scripting (XSS) by restricting resource loading origins
CSP instructs browsers to only load resources from whitelisted origins, significantly reducing XSS attack surface by blocking inline scripts and unauthorized sources.
Question 6: Under accessibility compliance (WCAG 2.1 / Section 508), a PHP-generated web form must include which attribute on form inputs for screen reader compatibility?
- placeholder only, since it shows hint text
- associated <label> elements or aria-label attributes (Correct answer)
- readonly='true' on all inputs
- autocomplete='off' on every field
Correct answer: associated <label> elements or aria-label attributes
WCAG 2.1 Success Criterion 1.3.1 requires that form inputs have programmatically associated labels, either via <label for=''> or aria-label, for screen reader accessibility.
Question 7: A PHP application must retain audit logs for compliance. Which practice ensures log integrity so logs cannot be tampered with?
- Write logs to the same database the application uses
- Forward logs to an append-only, write-once external log aggregator or SIEM (Correct answer)
- Store logs as world-writable flat files on the web server
- Delete logs monthly to minimize storage costs
Correct answer: Forward logs to an append-only, write-once external log aggregator or SIEM
Sending logs to an external, append-only system prevents an attacker who compromises the application server from altering or deleting evidence of their activity.
PHP Regulatory Frameworks & Compliance 5
Under GDPR's 72-hour breach notification rule, what must a PHP application have in place to detect a data breach quickly?