Ruby on Rails Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A Rails e-commerce app must comply with PCI DSS Requirement 6.4 by separating dev/test and production environments. Which Rails mechanism enforces this?
- Rails.env checks in initializers
- config/environments/ directory with per-environment files (Correct answer)
- DATABASE_URL environment variable scoping
- Gemfile group :production separation
Correct answer: config/environments/ directory with per-environment files
The `config/environments/` directory provides completely separate configuration files for development, test, and production, enforcing PCI DSS environment separation.
Question 2: Under GDPR Article 25 (Privacy by Design), a new Rails user registration should collect the minimum viable data. Which Strong Parameters approach enforces this?
- params.require(:user).permit!
- params.require(:user).permit(:email, :password) (Correct answer)
- params.slice(:user)
- params.fetch(:user, {})
Correct answer: params.require(:user).permit(:email, :password)
Using `permit` with an explicit whitelist of only required fields implements data minimization at the controller boundary, embodying Privacy by Design.
Question 3: A healthcare Rails app must log all access to patient records per HIPAA's audit control requirement (§164.312(b)). Which approach is most appropriate?
- Rails.logger.info in every controller action
- ActiveSupport::Notifications subscriber on ActiveRecord queries
- Database-level audit trigger via PostgreSQL
- after_action callback writing to a separate audit_logs table (Correct answer)
Correct answer: after_action callback writing to a separate audit_logs table
An `after_action` callback writing to a dedicated `audit_logs` table captures who accessed which patient record with timestamps, satisfying HIPAA §164.312(b).
Question 4: Which Rails configuration prevents the BREACH attack, a concern under TLS compliance requirements, when using compressed responses?
- Disabling gzip compression via config.middleware.delete Rack::Deflater (Correct answer)
- Using per-request CSRF tokens
- Enabling HSTS preloading
- Setting SameSite=Strict on session cookies
Correct answer: Disabling gzip compression via config.middleware.delete Rack::Deflater
The BREACH attack exploits HTTP compression to extract secrets; removing `Rack::Deflater` from the middleware stack eliminates this attack vector.
Question 5: For CCPA compliance, a Rails app must honor 'Do Not Sell My Personal Information' requests. Which architecture pattern best implements this?
- A boolean do_not_sell flag on the User model with scoped queries excluding flagged users from analytics exports (Correct answer)
- Deleting all user records upon request
- Encrypting user data with a user-held key
- Anonymizing all fields to 'REDACTED'
Correct answer: A boolean do_not_sell flag on the User model with scoped queries excluding flagged users from analytics exports
A `do_not_sell` flag allows the app to exclude opted-out users from third-party data sharing while retaining their account, matching CCPA's scope.
Question 6: Which Rails Active Storage configuration is required when storing medical images to comply with HIPAA's encryption at rest requirement?
- config.active_storage.service = :local
- Using S3 service with server_side_encryption: 'aws:kms' (Correct answer)
- config.active_storage.variable_content_types whitelist
- Setting content_disposition: :inline
Correct answer: Using S3 service with server_side_encryption: 'aws:kms'
Configuring Active Storage's S3 service with `server_side_encryption: 'aws:kms'` ensures all uploaded files are encrypted at rest using AWS KMS, satisfying HIPAA.
Question 7: A Rails app must implement 'legitimate interest' documentation per GDPR Article 6(1)(f). Where in a Rails codebase is this best recorded programmatically?
- In model validations as comments
- As structured metadata in a DataProcessingActivity concern or registry (Correct answer)
- In the Gemfile as gem annotations
- In config/application.rb as constants
Correct answer: As structured metadata in a DataProcessingActivity concern or registry
A dedicated `DataProcessingActivity` concern or registry class documents each processing purpose, legal basis, and data categories in a machine-readable, auditable way.
Ruby on Rails Regulatory Frameworks & Compliance 4
A Rails e-commerce app must comply with PCI DSS Requirement 6.4 by separating dev/test and production environments.
Which Rails mechanism enforces this?