Ruby on Rails Regulatory Frameworks & Compliance 2

Question 1

Which Rails helper method is commonly used to sanitize HTML output and prevent XSS vulnerabilities required by many compliance frameworks?

Accepted Answer

sanitize

Answer

The `sanitize` helper removes dangerous HTML tags and attributes while preserving safe markup, making it the preferred XSS-prevention tool.

Question 2

Under HIPAA compliance, what Rails configuration ensures that Protected Health Information (PHI) is never written to application log files?

Accepted Answer

config.filter_parameters

Answer

`config.filter_parameters` in Rails masks specified parameter values in logs, preventing PHI like SSNs or dates of birth from being recorded.

Question 3

A Rails app must enforce GDPR's right to erasure. Which database strategy best supports hard deletion of user records while maintaining referential integrity?

Accepted Answer

Nullify dependent records then delete the user

Answer

Nullifying dependent foreign keys then deleting the user record removes PII while keeping aggregate data intact and satisfying GDPR erasure requirements.

Question 4

The PCI DSS standard prohibits storing full card numbers. Which ActiveRecord callback placement enforces this rule before data ever reaches the database?

Accepted Answer

before_validation

Answer

`before_validation` runs earliest in the lifecycle, allowing you to truncate or tokenize card data before any persistence occurs.

Question 5

Which Rails security feature should be enabled to comply with OWASP recommendations against session fixation attacks?

Accepted Answer

reset_session after login

Answer

Calling `reset_session` immediately after successful authentication issues a new session ID, preventing session fixation attacks.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Regulatory Frameworks & Compliance 2