Ruby on Rails Regulatory Frameworks & Compliance 5

Question 1

Which Rails test helper method verifies that a response includes a Content-Security-Policy header as required by your security compliance policy?

Accepted Answer

assert_includes response.headers, 'Content-Security-Policy'

Answer

`assert_includes response.headers, 'Content-Security-Policy'` directly checks that the CSP header is present in controller test responses.

Question 2

Under ISO 27001, a Rails app must implement an Information Security Management System. Which tool generates a dependency vulnerability report as part of a compliance pipeline?

Accepted Answer

bundle audit

Answer

`bundle audit` checks your Gemfile.lock against the Ruby Advisory Database, identifying gems with known CVEs for ISO 27001 vulnerability management.

Question 3

GDPR requires data portability under Article 20. Which Rails implementation pattern best supports exporting a user's data in a machine-readable format?

Accepted Answer

A background job that queries all user-associated models and serializes to JSON/CSV

Answer

A background job traversing all associated models and producing a structured JSON/CSV export provides a complete, portable dataset as required by GDPR Article 20.

Question 4

A Rails app must comply with ADA Section 508 accessibility requirements for federal contracts. Which tool is integrated into the Rails test suite to detect accessibility violations?

Accepted Answer

axe-core via capybara-axe gem

Answer

The `capybara-axe` gem integrates the axe-core accessibility engine into Capybara feature specs, flagging WCAG/Section 508 violations automatically.

Question 5

For PCI DSS Requirement 10, a Rails app must retain logs for one year with three months immediately available. Which Rails logging configuration supports this?

Accepted Answer

Using a structured logger with log rotation and an external SIEM integration

Answer

Structured logging shipped to an external SIEM (like Splunk or ELK) handles long-term retention and immediate availability requirements of PCI DSS Requirement 10.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Regulatory Frameworks & Compliance 5