TypeScript Regulatory Compliance & Legal Framework 3 — Questions and Answers
Question 1: Which TypeScript compiler option, when enabled, helps prevent accidental exposure of sensitive fields by making all class members private by default?
- strictNullChecks
- noImplicitAny
- useDefineForClassFields
- There is no such option; visibility must be declared manually (Correct answer)
Correct answer: There is no such option; visibility must be declared manually
TypeScript has no compiler flag that defaults class members to private; developers must explicitly annotate each member with `private` or use `#` private fields.
Question 2: Under SOC 2 Trust Service Criteria, which principle most directly applies to ensuring a TypeScript API never returns data it is not authorized to return?
- Availability
- Confidentiality (Correct answer)
- Processing Integrity
- Privacy
Correct answer: Confidentiality
SOC 2 Confidentiality criteria govern controls that protect information designated as confidential from unauthorized disclosure.
Question 3: A TypeScript application logs user IP addresses for debugging. Under GDPR, IP addresses are considered:
- Anonymous data, not subject to GDPR
- Personal data, subject to GDPR (Correct answer)
- Sensitive personal data requiring explicit consent
- Pseudonymous data exempt from all GDPR requirements
Correct answer: Personal data, subject to GDPR
The European Court of Justice has confirmed that IP addresses are personal data under GDPR because they can be used to identify individuals.
Question 4: Which legal doctrine allows a developer to study and interoperate with a proprietary TypeScript library without infringing its copyright?
- Fair use / interoperability exception (Correct answer)
- Patent exhaustion
- Trademark nominative use
- Contributory infringement defense
Correct answer: Fair use / interoperability exception
Fair use and statutory interoperability exceptions (e.g., in the EU Software Directive and US case law) permit reverse engineering for the purpose of achieving interoperability.
Question 5: An organization wants to deploy a TypeScript app that processes payment card data. Which standard mandates specific security controls for this?
- ISO/IEC 27001
- NIST SP 800-53
- PCI DSS (Correct answer)
- FedRAMP
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) defines security requirements for all systems that store, process, or transmit cardholder data.
Question 6: A TypeScript function returns user data as `any`. What regulatory risk does this introduce?
- None, since TypeScript types are erased at runtime and have no legal significance
- It bypasses compile-time checks, increasing the risk of inadvertently exposing fields that should be redacted (Correct answer)
- It violates the MIT license terms of the TypeScript compiler
- It automatically triggers a GDPR audit
Correct answer: It bypasses compile-time checks, increasing the risk of inadvertently exposing fields that should be redacted
Returning `any` disables TypeScript's type safety, making it easier to accidentally include sensitive fields (e.g., passwords, SSNs) in API responses without a compiler warning.
Question 7: Which US law governs the privacy of health information held by healthcare providers and their business associates, requiring technical safeguards in software systems?
- FERPA
- COPPA
- HIPAA (Correct answer)
- GLBA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) and its Security Rule require administrative, physical, and technical safeguards for electronic protected health information.
TypeScript Regulatory Compliance & Legal Framework 3
Which TypeScript compiler option, when enabled, helps prevent accidental exposure of sensitive fields by making all class members private by default?