Spring Boot Spring Security Fundamentals 2

Question 1

Which annotation is used to enable method-level security in a Spring Boot application?

Accepted Answer

@EnableMethodSecurity

Answer

@EnableMethodSecurity (introduced in Spring Security 5.6) replaces the older @EnableGlobalMethodSecurity and enables @PreAuthorize, @PostAuthorize, and related annotations.

Question 2

What does the @PreAuthorize annotation do in Spring Security?

Accepted Answer

Checks authorization before the method executes

Answer

@PreAuthorize evaluates a Spring Expression Language (SpEL) expression before a method is invoked and throws AccessDeniedException if the expression returns false.

Question 3

In Spring Security, what is the default behavior when an authenticated user accesses a resource they are not authorized to view?

Accepted Answer

A 403 Forbidden response is returned

Answer

Spring Security returns HTTP 403 Forbidden for authenticated users who lack the required authority, while 401 Unauthorized is returned for unauthenticated requests.

Question 4

Which interface must be implemented to provide custom user details to Spring Security?

Accepted Answer

UserDetailsService

Answer

UserDetailsService has a single method loadUserByUsername() that Spring Security calls during authentication to retrieve user details from any data source.

Question 5

What is the purpose of the SecurityContextHolder in Spring Security?

Accepted Answer

It holds the SecurityContext for the current execution thread

Answer

SecurityContextHolder stores the SecurityContext (which contains the Authentication object) for the current thread, making the authenticated principal accessible anywhere in the application.

Spring Boot Practice Test

Spring Boot Practice Test

Spring Boot Spring Security Fundamentals 2