Spring Boot Spring Security Fundamentals 2 — Questions and Answers
Question 1: Which annotation is used to enable method-level security in a Spring Boot application?
- @EnableWebSecurity
- @EnableMethodSecurity (Correct answer)
- @EnableGlobalMethodSecurity
- @PreAuthorizeEnabled
Correct answer: @EnableMethodSecurity
@EnableMethodSecurity (introduced in Spring Security 5.6) replaces the older @EnableGlobalMethodSecurity and enables @PreAuthorize, @PostAuthorize, and related annotations.
Question 2: What does the @PreAuthorize annotation do in Spring Security?
- Encrypts the method return value
- Checks authorization before the method executes (Correct answer)
- Logs method invocations for auditing
- Applies CSRF protection to the method
Correct answer: Checks authorization before the method executes
@PreAuthorize evaluates a Spring Expression Language (SpEL) expression before a method is invoked and throws AccessDeniedException if the expression returns false.
Question 3: In Spring Security, what is the default behavior when an authenticated user accesses a resource they are not authorized to view?
- The user is redirected to the login page
- A 403 Forbidden response is returned (Correct answer)
- A 401 Unauthorized response is returned
- The request is silently ignored
Correct answer: A 403 Forbidden response is returned
Spring Security returns HTTP 403 Forbidden for authenticated users who lack the required authority, while 401 Unauthorized is returned for unauthenticated requests.
Question 4: Which interface must be implemented to provide custom user details to Spring Security?
- UserRepository
- AuthenticationProvider
- UserDetailsService (Correct answer)
- SecurityContextHolder
Correct answer: UserDetailsService
UserDetailsService has a single method loadUserByUsername() that Spring Security calls during authentication to retrieve user details from any data source.
Question 5: What is the purpose of the SecurityContextHolder in Spring Security?
- It stores the application's security configuration
- It holds the SecurityContext for the current execution thread (Correct answer)
- It manages session tokens across requests
- It encrypts sensitive configuration properties
Correct answer: It holds the SecurityContext for the current execution thread
SecurityContextHolder stores the SecurityContext (which contains the Authentication object) for the current thread, making the authenticated principal accessible anywhere in the application.
Question 6: Which password encoder is recommended for production use in Spring Security?
- MD5PasswordEncoder
- NoOpPasswordEncoder
- BCryptPasswordEncoder (Correct answer)
- SHA1PasswordEncoder
Correct answer: BCryptPasswordEncoder
BCryptPasswordEncoder is recommended because it is adaptive (cost factor can increase over time), includes a built-in salt, and is resistant to brute-force attacks.
Question 7: What Spring Security feature prevents cross-site request forgery attacks by default in web applications?
- CORS filter
- CSRF protection (Correct answer)
- Content Security Policy header
- XSS filter
Correct answer: CSRF protection
Spring Security enables CSRF protection by default for stateful web applications by requiring a synchronizer token in state-changing requests (POST, PUT, DELETE).
Spring Boot Spring Security Fundamentals 2
Which annotation is used to enable method-level security in a Spring Boot application?