TypeScript Regulatory Compliance & Legal Framework 5 — Questions and Answers
Question 1: A TypeScript SaaS application retains deleted user records for 2 years 'just in case'. Which GDPR principle does this most likely violate?
- Accuracy
- Storage Limitation (Correct answer)
- Data Minimization
- Lawfulness of Processing
Correct answer: Storage Limitation
GDPR's storage limitation principle requires that personal data be kept no longer than necessary for the specified purpose; indefinite retention after account deletion requires a specific legal basis.
Question 2: Which TypeScript technique can help ensure audit log entries cannot be tampered with after they are written?
- Using `Object.freeze()` on log objects in memory
- Appending a cryptographic hash or HMAC chaining each log entry to the previous one (Correct answer)
- Storing logs as TypeScript `const` declarations
- Using `readonly` properties on the log entry interface
Correct answer: Appending a cryptographic hash or HMAC chaining each log entry to the previous one
HMAC-chaining or hash-linking log entries means any modification to a previous entry breaks the chain, making tampering detectable—a common requirement for compliance audit trails.
Question 3: Which license would be most appropriate for a TypeScript project that must guarantee users always receive source code, even when accessed as a web service (SaaS)?
- MIT License
- Apache License 2.0
- GNU Affero General Public License (AGPL) (Correct answer)
- BSD 3-Clause License
Correct answer: GNU Affero General Public License (AGPL)
The AGPL closes the 'SaaS loophole' by requiring that source code be provided to users who interact with the software over a network, not just those who receive a binary.
Question 4: A TypeScript API inadvertently returns a field named `ssn` in its JSON response. Which approach best prevents this at the type level?
- Use `Omit<User, 'ssn'>` as the return type of the API handler (Correct answer)
- Add a runtime `delete response.ssn` before sending
- Set `strict: true` in tsconfig.json
- Use `never` as the type of the `ssn` field on the User interface
Correct answer: Use `Omit<User, 'ssn'>` as the return type of the API handler
Using `Omit<User, 'ssn'>` as the return type makes the TypeScript compiler enforce that the `ssn` field is absent, catching accidental inclusion at compile time.
Question 5: Under PCI DSS, which requirement most directly applies to a TypeScript application that logs API requests containing full credit card numbers?
- Requirement 1: Install and maintain network security controls
- Requirement 3: Protect stored account data (prohibits storing sensitive authentication data) (Correct answer)
- Requirement 6: Develop and maintain secure systems
- Requirement 10: Log and monitor all access to system components
Correct answer: Requirement 3: Protect stored account data (prohibits storing sensitive authentication data)
PCI DSS Requirement 3 explicitly prohibits storing sensitive authentication data (including full card numbers unmasked) after authorization, making log entries containing PANs a violation.
Question 6: A TypeScript open-source project contributor assigns copyright to the project's foundation via a Contributor License Agreement (CLA). What does this primarily enable?
- The contributor gains ownership of the entire project
- The foundation can relicense the project or defend copyright claims in court without involving every contributor (Correct answer)
- The contribution automatically becomes public domain
- The CLA exempts the contribution from any open-source license terms
Correct answer: The foundation can relicense the project or defend copyright claims in court without involving every contributor
A CLA gives the receiving entity rights to relicense contributions and to litigate copyright infringement without needing consent from every individual contributor.
Question 7: Which principle of the NIST Cybersecurity Framework is most relevant to a TypeScript team that performs threat modeling before writing new authentication code?
- Respond
- Recover
- Identify (Correct answer)
- Detect
Correct answer: Identify
The 'Identify' function of the NIST CSF covers understanding cybersecurity risks to systems—threat modeling is a core Identify activity performed before controls are built.
TypeScript Regulatory Compliance & Legal Framework 5
A TypeScript SaaS application retains deleted user records for 2 years 'just in case'.
Which GDPR principle does this most likely violate?