Ruby on Rails Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A Rails application handling EU user data must implement data minimization under GDPR. Which ActiveRecord technique limits which fields are fetched from the database?
- select(:id, :email) (Correct answer)
- only(:permitted)
- permit(:fields)
- pluck(:column)
Correct answer: select(:id, :email)
`select` limits the SQL query to specific columns, ensuring unnecessary PII fields are never loaded into memory, supporting GDPR data minimization.
Question 2: Under COPPA regulations, a US Rails app serving children must obtain parental consent before collecting data. Which Rails pattern best enforces this at the controller level?
- before_action :verify_age_consent (Correct answer)
- after_filter :check_parental_approval
- skip_before_action :authenticate
- around_action :log_consent
Correct answer: before_action :verify_age_consent
A `before_action` callback halts the request pipeline if consent is absent, ensuring no data collection occurs before the legal prerequisite is met.
Question 3: FedRAMP compliance requires encryption in transit. Which Rails configuration line enforces HTTPS for all requests?
- config.assets.ssl = true
- config.force_ssl = true (Correct answer)
- config.middleware.use Rack::SSL
- config.ssl_options = { hsts: true }
Correct answer: config.force_ssl = true
`config.force_ssl = true` enables the `ActionDispatch::SSL` middleware that redirects HTTP to HTTPS and sets HSTS headers.
Question 4: A compliance audit requires that your Rails API returns a 403 (not 401) when an authenticated user lacks permission. Which authorization gem makes this distinction easiest?
- Devise
- Pundit (Correct answer)
- Warden
- OmniAuth
Correct answer: Pundit
Pundit raises `Pundit::NotAuthorizedError` which you can rescue and render as 403 Forbidden, separating authentication (401) from authorization (403).
Question 5: NIST 800-63B password guidelines require no composition rules but mandate breach-list checking. Which approach integrates this into Rails user model validation?
- validates :password, format: { with: /[A-Z]/ }
- Custom validator checking against HaveIBeenPwned API (Correct answer)
- Devise's :password_complexity module
- bcrypt minimum cost factor of 12
Correct answer: Custom validator checking against HaveIBeenPwned API
A custom validator querying the HaveIBeenPwned k-anonymity API checks passwords against known breach lists as required by NIST 800-63B.
Question 6: For SOX compliance, a financial Rails app must prevent unauthorized changes to audit records. Which Rails technique enforces immutability on closed accounting period records?
- before_update :raise_if_locked (Correct answer)
- validates :period, uniqueness: true
- attr_readonly :amount
- after_commit :freeze_record
Correct answer: before_update :raise_if_locked
A `before_update` callback that raises an error when the accounting period is closed prevents any modification to finalized records.
Question 7: Which Rails feature helps comply with GDPR's requirement to document and disclose third-party data processors in your data processing agreements?
- ApplicationRecord concerns
- Initializer files listing third-party gems and their data access
- ActiveSupport::Notifications instrumentation (Correct answer)
- Rack middleware stack inspection
Correct answer: ActiveSupport::Notifications instrumentation
ActiveSupport::Notifications can instrument third-party service calls, providing an audit trail of what external processors received your users' data.
Ruby on Rails Regulatory Frameworks & Compliance 3
A Rails application handling EU user data must implement data minimization under GDPR.
Which ActiveRecord technique limits which fields are fetched from the database?