React Native Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which HTTP security header should a React Native app's backend enable to prevent MIME-type sniffing attacks on API responses?
- Strict-Transport-Security
- X-Content-Type-Options: nosniff (Correct answer)
- Content-Security-Policy
- X-Frame-Options
Correct answer: X-Content-Type-Options: nosniff
The X-Content-Type-Options: nosniff header prevents browsers and clients from interpreting responses as a different MIME type than declared.
Question 2: A React Native app targets users in Brazil. Which data protection law is equivalent to GDPR for Brazilian users?
- PIPEDA
- LGPD (Correct answer)
- PDPA
- POPIA
Correct answer: LGPD
Brazil's Lei Geral de Proteção de Dados (LGPD) is the Brazilian general data protection law, effective since 2021, modeled after GDPR.
Question 3: Under Apple's App Store guidelines, apps that monetize user data or sell it to third-party data brokers are:
- Allowed with a disclosure in Settings
- Allowed only for enterprise apps
- Prohibited (Correct answer)
- Allowed with user opt-in
Correct answer: Prohibited
Apple's App Store Review Guidelines explicitly prohibit apps from monetizing user data by selling it to third-party data brokers or advertisers.
Question 4: What is the purpose of a Data Processing Agreement (DPA) in the context of a React Native app using a third-party analytics SDK?
- To set the SDK's monthly pricing terms
- To define processor responsibilities and data protection obligations under GDPR (Correct answer)
- To grant the SDK provider ownership of collected data
- To satisfy Apple's App Store notarization requirements
Correct answer: To define processor responsibilities and data protection obligations under GDPR
A DPA is a GDPR-required contract between a data controller and processor that defines each party's data protection responsibilities.
Question 5: Which tool provided by Google helps React Native Android developers verify that their app complies with Play Store target API level requirements?
- Firebase App Distribution
- Android Vitals Dashboard
- Play Console's Pre-launch report (Correct answer)
- APK Analyzer in Android Studio
Correct answer: Play Console's Pre-launch report
Google Play's Pre-launch report automatically tests APKs on real devices and flags API-level compliance issues before the app goes live.
Question 6: A React Native app stores OAuth tokens in `expo-secure-store`. Why is this preferred over `AsyncStorage` from a compliance standpoint?
- It compresses data to reduce storage size
- It stores data in encrypted hardware-backed storage (Correct answer)
- It automatically expires tokens after 24 hours
- It uses blockchain for tamper-proof storage
Correct answer: It stores data in encrypted hardware-backed storage
expo-secure-store uses the device's hardware-backed Keychain (iOS) or Keystore (Android) for encrypted storage, meeting security compliance requirements for sensitive tokens.
Question 7: GDPR's data minimization principle requires React Native developers to:
- Store all user data in the EU only
- Collect only data that is adequate, relevant, and limited to what is necessary (Correct answer)
- Delete user data after 30 days
- Encrypt all data with AES-256
Correct answer: Collect only data that is adequate, relevant, and limited to what is necessary
GDPR Article 5(1)(c) mandates data minimization: only collect personal data that is necessary for the specified purpose.
React Native Regulatory Frameworks & Compliance 4
Which HTTP security header should a React Native app's backend enable to prevent MIME-type sniffing attacks on API responses?