PHP Regulatory Frameworks & Compliance 5

Question 1

Under GDPR's 72-hour breach notification rule, what must a PHP application have in place to detect a data breach quickly?

Accepted Answer

Real-time logging and alerting systems that detect anomalous data access patterns

Answer

GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, which necessitates automated monitoring and alerting to detect incidents promptly.

Question 2

Which PHP configuration should be set to prevent directory traversal vulnerabilities in compliant file upload handling?

Accepted Answer

open_basedir restriction to the application directory

Answer

open_basedir restricts PHP's file operations to a specified directory tree, preventing path traversal attacks from accessing files outside the application root.

Question 3

In terms of GDPR data transfer compliance, what must a PHP application implement when sending personal data from the EU to a US-based third-party API?

Accepted Answer

Ensure the recipient has adequate protections via SCCs, BCRs, or adequacy decision

Answer

GDPR Chapter V restricts transfers to third countries — Standard Contractual Clauses (SCCs), Binding Corporate Rules, or an adequacy decision are the lawful transfer mechanisms.

Question 4

Which PHP practice violates the principle of least privilege, a core requirement in ISO 27001 and SOC 2 frameworks?

Accepted Answer

Connecting to the database with a root or superuser account in the application

Answer

Using a database superuser in the application grants far more permissions than needed, violating least privilege — a fundamental control in ISO 27001 and SOC 2.

Question 5

What does Content Security Policy (CSP) header in a PHP application primarily help prevent, as recommended by security compliance frameworks?

Accepted Answer

Cross-Site Scripting (XSS) by restricting resource loading origins

Answer

CSP instructs browsers to only load resources from whitelisted origins, significantly reducing XSS attack surface by blocking inline scripts and unauthorized sources.

PHP - PHP Programming Language Practice Test

PHP - PHP Programming Language Practice Test

PHP Regulatory Frameworks & Compliance 5