Spring Boot Spring Security Fundamentals 3

Question 1

Which Spring Security class is used to configure HTTP security using the fluent API in a SecurityFilterChain bean?

Accepted Answer

HttpSecurity

Answer

HttpSecurity provides a fluent API to configure security for HTTP requests, including authorization rules, login forms, CSRF settings, and session management.

Question 2

What is the role of an AuthenticationManager in Spring Security?

Accepted Answer

It processes authentication requests and returns an Authentication object

Answer

AuthenticationManager is the core interface for processing authentication; its authenticate() method accepts an Authentication request and returns a fully populated Authentication object if successful.

Question 3

In Spring Security, what does the hasRole() expression automatically prepend to the role name?

Accepted Answer

ROLE_

Answer

hasRole('ADMIN') is equivalent to hasAuthority('ROLE_ADMIN') — Spring Security automatically prepends 'ROLE_' when using hasRole() expressions.

Question 4

Which filter in the Spring Security filter chain is responsible for reading the JWT token from the request header?

Accepted Answer

OncePerRequestFilter (custom)

Answer

JWT extraction is typically done in a custom filter that extends OncePerRequestFilter, which guarantees the filter logic runs exactly once per request.

Question 5

What is the purpose of the @Secured annotation in Spring Security?

Accepted Answer

It restricts method access to users with specified roles

Answer

@Secured restricts method invocation to users who have at least one of the listed roles (e.g., @Secured('ROLE_ADMIN')), and requires @EnableMethodSecurity(securedEnabled=true).

Spring Boot Practice Test

Spring Boot Practice Test

Spring Boot Spring Security Fundamentals 3