Spring Boot Spring Security Fundamentals Questions and Answers

Question 1

In a modern Spring Boot application, what is the primary purpose of defining a `SecurityFilterChain` bean?

Accepted Answer

To define a sequence of security filters that are applied to HTTP requests to handle concerns like authentication, authorization, and CSRF protection.

Answer

To manage user details and credentials by connecting to a database or an in-memory store.

Answer

To specify how passwords should be hashed and verified during the authentication process.

Answer

To enable method-level security annotations like `@PreAuthorize` and `@Secured` across the application.

Question 2

A developer needs to secure a service method so that it can only be executed by users with the 'ADMIN' role. Which annotation provides the most flexible, expression-based approach to achieve this?

Accepted Answer

@PreAuthorize("hasRole('ADMIN')")

Answer

@Secured("ROLE_ADMIN")

Answer

@RolesAllowed("ADMIN")

Answer

@PermitAll

Question 3

In the context of Spring Security's authentication architecture, what is the primary responsibility of the `AuthenticationManager`?

Accepted Answer

To coordinate the authentication process by delegating the credential verification to one or more `AuthenticationProvider` instances.

Answer

To load user-specific data from a persistent store, such as a database.

Answer

To store the authenticated user's details in the `SecurityContext` for the duration of the request.

Answer

To encode and compare passwords using a specific hashing algorithm like bcrypt.

Question 4

A Spring Boot application is configured to use form-based login. To protect against Cross-Site Request Forgery (CSRF) attacks, Spring Security, by default, employs the Synchronizer Token Pattern. How is the CSRF token typically validated for a state-changing request (e.g., POST)?

Accepted Answer

The token, stored in the user's session, must be included by the client in the request as a hidden form field or a specific HTTP header.

Answer

The token is sent as a URL query parameter and compared with a value stored in the application's database.

Answer

The browser automatically includes the token from a secure, HttpOnly cookie in the request headers.

Answer

The server validates that the request's `Origin` header matches the application's domain.

Question 5

Which of the following is the recommended `PasswordEncoder` implementation in modern Spring Security for securely hashing and storing user passwords?

Accepted Answer

`BCryptPasswordEncoder`

Answer

`NoOpPasswordEncoder`

Answer

`StandardPasswordEncoder`

Answer

`MessageDigestPasswordEncoder`

Question 6

A developer is configuring a `SecurityFilterChain` and wants to ensure that all requests to endpoints starting with `/api/` require authentication, while requests to `/public/` are permitted for everyone. Which of the following configurations correctly implements this requirement?

Accepted Answer

`.authorizeHttpRequests(auth -> auth.requestMatchers("/public/**").permitAll().requestMatchers("/api/**").authenticated())`

Answer

`.authorizeHttpRequests(auth -> auth.requestMatchers("/api/**").permitAll().requestMatchers("/public/**").authenticated())`

Answer

`.authorizeHttpRequests(auth -> auth.requestMatchers("/api/**").authenticated().requestMatchers("/public/**").permitAll().anyRequest().denyAll())`

Answer

`.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())`