Ruby on Rails Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Rails test helper method verifies that a response includes a Content-Security-Policy header as required by your security compliance policy?
- assert_redirected_to
- assert_response :success
- assert_includes response.headers, 'Content-Security-Policy' (Correct answer)
- assert_select 'meta[http-equiv]'
Correct answer: assert_includes response.headers, 'Content-Security-Policy'
`assert_includes response.headers, 'Content-Security-Policy'` directly checks that the CSP header is present in controller test responses.
Question 2: Under ISO 27001, a Rails app must implement an Information Security Management System. Which tool generates a dependency vulnerability report as part of a compliance pipeline?
- rails stats
- bundle audit (Correct answer)
- rails notes
- rubocop --rails
Correct answer: bundle audit
`bundle audit` checks your Gemfile.lock against the Ruby Advisory Database, identifying gems with known CVEs for ISO 27001 vulnerability management.
Question 3: GDPR requires data portability under Article 20. Which Rails implementation pattern best supports exporting a user's data in a machine-readable format?
- A background job that queries all user-associated models and serializes to JSON/CSV (Correct answer)
- Devise's exportable module
- Direct database dump via pg_dump filtered by user_id
- ActiveRecord's to_yaml method on the user object
Correct answer: A background job that queries all user-associated models and serializes to JSON/CSV
A background job traversing all associated models and producing a structured JSON/CSV export provides a complete, portable dataset as required by GDPR Article 20.
Question 4: A Rails app must comply with ADA Section 508 accessibility requirements for federal contracts. Which tool is integrated into the Rails test suite to detect accessibility violations?
- RuboCop Accessibility
- axe-core via capybara-axe gem (Correct answer)
- Brakeman scanner
- lighthouse-ci rake task
Correct answer: axe-core via capybara-axe gem
The `capybara-axe` gem integrates the axe-core accessibility engine into Capybara feature specs, flagging WCAG/Section 508 violations automatically.
Question 5: For PCI DSS Requirement 10, a Rails app must retain logs for one year with three months immediately available. Which Rails logging configuration supports this?
- config.log_level = :debug
- Using a structured logger with log rotation and an external SIEM integration (Correct answer)
- config.logger = Logger.new(STDOUT)
- Rails.logger.tagged(:pci) { }
Correct answer: Using a structured logger with log rotation and an external SIEM integration
Structured logging shipped to an external SIEM (like Splunk or ELK) handles long-term retention and immediate availability requirements of PCI DSS Requirement 10.
Question 6: Which Brakeman scanner warning category is most directly relevant to OWASP Top 10 A03 (Injection) compliance in a Rails application?
- Cross-Site Request Forgery
- SQL Injection (Correct answer)
- Session Settings
- Mass Assignment
Correct answer: SQL Injection
Brakeman's SQL Injection warnings detect unsafe use of string interpolation in ActiveRecord queries, directly addressing OWASP A03 Injection vulnerabilities.
Question 7: A multi-tenant Rails SaaS must comply with GDPR's data residency requirements by storing EU user data only in EU regions. Which Active Record pattern enforces tenant-level database routing?
- STI (Single Table Inheritance) per tenant
- acts_as_tenant gem with database sharding per region
- Apartment gem (multi-tenancy via schemas) with region-aware connection switching (Correct answer)
- separate Rails instances per region with no shared DB
Correct answer: Apartment gem (multi-tenancy via schemas) with region-aware connection switching
The Apartment gem's schema-based multi-tenancy combined with region-aware connection switching lets you route EU tenants to EU-region databases at the ActiveRecord level.
Ruby on Rails Regulatory Frameworks & Compliance 5
Which Rails test helper method verifies that a response includes a Content-Security-Policy header as required by your security compliance policy?