Ruby on Rails Regulatory Frameworks & Compliance 3

Question 1

A Rails application handling EU user data must implement data minimization under GDPR. Which ActiveRecord technique limits which fields are fetched from the database?

Accepted Answer

select(:id, :email)

Answer

`select` limits the SQL query to specific columns, ensuring unnecessary PII fields are never loaded into memory, supporting GDPR data minimization.

Question 2

Under COPPA regulations, a US Rails app serving children must obtain parental consent before collecting data. Which Rails pattern best enforces this at the controller level?

Accepted Answer

before_action :verify_age_consent

Answer

A `before_action` callback halts the request pipeline if consent is absent, ensuring no data collection occurs before the legal prerequisite is met.

Question 3

FedRAMP compliance requires encryption in transit. Which Rails configuration line enforces HTTPS for all requests?

Accepted Answer

config.force_ssl = true

Answer

`config.force_ssl = true` enables the `ActionDispatch::SSL` middleware that redirects HTTP to HTTPS and sets HSTS headers.

Question 4

A compliance audit requires that your Rails API returns a 403 (not 401) when an authenticated user lacks permission. Which authorization gem makes this distinction easiest?

Accepted Answer

Pundit

Answer

Pundit raises `Pundit::NotAuthorizedError` which you can rescue and render as 403 Forbidden, separating authentication (401) from authorization (403).

Question 5

NIST 800-63B password guidelines require no composition rules but mandate breach-list checking. Which approach integrates this into Rails user model validation?

Accepted Answer

Custom validator checking against HaveIBeenPwned API

Answer

A custom validator querying the HaveIBeenPwned k-anonymity API checks passwords against known breach lists as required by NIST 800-63B.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Regulatory Frameworks & Compliance 3