Ruby on Rails Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Rails helper method is commonly used to sanitize HTML output and prevent XSS vulnerabilities required by many compliance frameworks?
- html_escape
- sanitize (Correct answer)
- strip_tags
- raw
Correct answer: sanitize
The `sanitize` helper removes dangerous HTML tags and attributes while preserving safe markup, making it the preferred XSS-prevention tool.
Question 2: Under HIPAA compliance, what Rails configuration ensures that Protected Health Information (PHI) is never written to application log files?
- config.log_level = :error
- config.filter_parameters (Correct answer)
- config.log_formatter
- config.silence_logger
Correct answer: config.filter_parameters
`config.filter_parameters` in Rails masks specified parameter values in logs, preventing PHI like SSNs or dates of birth from being recorded.
Question 3: A Rails app must enforce GDPR's right to erasure. Which database strategy best supports hard deletion of user records while maintaining referential integrity?
- Soft delete with deleted_at column
- Cascade DELETE with foreign key constraints
- Nullify dependent records then delete the user (Correct answer)
- Archive records to a separate compliance table
Correct answer: Nullify dependent records then delete the user
Nullifying dependent foreign keys then deleting the user record removes PII while keeping aggregate data intact and satisfying GDPR erasure requirements.
Question 4: The PCI DSS standard prohibits storing full card numbers. Which ActiveRecord callback placement enforces this rule before data ever reaches the database?
- after_save
- before_validation (Correct answer)
- after_commit
- before_create
Correct answer: before_validation
`before_validation` runs earliest in the lifecycle, allowing you to truncate or tokenize card data before any persistence occurs.
Question 5: Which Rails security feature should be enabled to comply with OWASP recommendations against session fixation attacks?
- config.force_ssl
- reset_session after login (Correct answer)
- protect_from_forgery
- cookie_store encryption
Correct answer: reset_session after login
Calling `reset_session` immediately after successful authentication issues a new session ID, preventing session fixation attacks.
Question 6: For SOC 2 Type II compliance, a Rails app must demonstrate audit trails. Which gem is most commonly used to automatically track model changes?
- Devise
- PaperTrail (Correct answer)
- Pundit
- Cancancan
Correct answer: PaperTrail
PaperTrail records every create, update, and destroy event with timestamps and whodunnit data, satisfying SOC 2 audit trail requirements.
Question 7: Which HTTP security header, configured via Rails middleware like SecureHeaders gem, helps satisfy CSP requirements under compliance frameworks?
- X-Frame-Options
- Content-Security-Policy (Correct answer)
- Strict-Transport-Security
- X-Content-Type-Options
Correct answer: Content-Security-Policy
The Content-Security-Policy header restricts resource loading origins, directly addressing the CSP requirements in frameworks like PCI DSS and NIST.
Ruby on Rails Regulatory Frameworks & Compliance 2
Which Rails helper method is commonly used to sanitize HTML output and prevent XSS vulnerabilities required by many compliance frameworks?