Ruby on Rails Regulatory Frameworks & Compliance 4

Question 1

A Rails e-commerce app must comply with PCI DSS Requirement 6.4 by separating dev/test and production environments. Which Rails mechanism enforces this?

Accepted Answer

config/environments/ directory with per-environment files

Answer

The `config/environments/` directory provides completely separate configuration files for development, test, and production, enforcing PCI DSS environment separation.

Question 2

Under GDPR Article 25 (Privacy by Design), a new Rails user registration should collect the minimum viable data. Which Strong Parameters approach enforces this?

Accepted Answer

params.require(:user).permit(:email, :password)

Answer

Using `permit` with an explicit whitelist of only required fields implements data minimization at the controller boundary, embodying Privacy by Design.

Question 3

A healthcare Rails app must log all access to patient records per HIPAA's audit control requirement (§164.312(b)). Which approach is most appropriate?

Accepted Answer

after_action callback writing to a separate audit_logs table

Answer

An `after_action` callback writing to a dedicated `audit_logs` table captures who accessed which patient record with timestamps, satisfying HIPAA §164.312(b).

Question 4

Which Rails configuration prevents the BREACH attack, a concern under TLS compliance requirements, when using compressed responses?

Accepted Answer

Disabling gzip compression via config.middleware.delete Rack::Deflater

Answer

The BREACH attack exploits HTTP compression to extract secrets; removing `Rack::Deflater` from the middleware stack eliminates this attack vector.

Question 5

For CCPA compliance, a Rails app must honor 'Do Not Sell My Personal Information' requests. Which architecture pattern best implements this?

Accepted Answer

A boolean do_not_sell flag on the User model with scoped queries excluding flagged users from analytics exports

Answer

A `do_not_sell` flag allows the app to exclude opted-out users from third-party data sharing while retaining their account, matching CCPA's scope.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Regulatory Frameworks & Compliance 4