Spring Cloud Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Spring Cloud component helps enforce audit logging for compliance with regulations like SOX and PCI-DSS?
- Spring Cloud Sleuth
- Spring Cloud Audit
- Spring Data JPA Auditing with Spring Cloud Bus events (Correct answer)
- Spring Cloud Config
Correct answer: Spring Data JPA Auditing with Spring Cloud Bus events
Spring Data JPA Auditing combined with Spring Cloud Bus events enables distributed audit trails required by SOX and PCI-DSS.
Question 2: Under GDPR, a Spring Cloud microservice must support the 'right to erasure'. What is the recommended architectural pattern?
- Delete records directly in each service's database
- Use a saga pattern with compensating transactions to erase data across services (Correct answer)
- Archive data to cold storage instead of deleting
- Encrypt the data and discard the key
Correct answer: Use a saga pattern with compensating transactions to erase data across services
The saga pattern with compensating transactions ensures coordinated, consistent data erasure across distributed microservices while maintaining eventual consistency.
Question 3: Which Spring Security feature is most directly relevant to HIPAA's requirement for unique user identification in a Spring Cloud app?
- OAuth2 Resource Server
- Method-level security with @PreAuthorize
- UserDetailsService with unique principal assignment (Correct answer)
- CSRF protection
Correct answer: UserDetailsService with unique principal assignment
HIPAA requires each user to have a unique identifier, which is enforced via UserDetailsService ensuring distinct principals for every account.
Question 4: A Spring Cloud Gateway is used as an API gateway. Which filter type is best for implementing PCI-DSS requirement of masking PANs in logs?
- GlobalFilter that rewrites response bodies
- GatewayFilter that sanitizes request/response logging (Correct answer)
- RouteLocator filter
- LoadBalancerFilter
Correct answer: GatewayFilter that sanitizes request/response logging
A GatewayFilter applied to logging can intercept and sanitize requests/responses to mask Primary Account Numbers before they reach log outputs.
Question 5: Which Spring Cloud Config feature supports the NIST SP 800-53 control requiring separation of configuration from code?
- Refresh scope for live config updates
- Git-backed external configuration store (Correct answer)
- Encrypted property values
- Config server health endpoint
Correct answer: Git-backed external configuration store
A Git-backed external configuration store separates configuration from application code, directly supporting NIST SP 800-53 configuration management controls.
Question 6: For FedRAMP compliance, a Spring Cloud application must implement continuous monitoring. Which tool combination best supports this?
- Spring Boot Actuator + Micrometer + Prometheus/Grafana (Correct answer)
- Spring Cloud Sleuth + Zipkin only
- Spring Cloud Contract + WireMock
- Spring Cloud Stream + Kafka
Correct answer: Spring Boot Actuator + Micrometer + Prometheus/Grafana
Spring Boot Actuator exposes metrics, Micrometer collects them, and Prometheus/Grafana provide the continuous monitoring dashboards required by FedRAMP.
Question 7: A CCPA compliance requirement mandates providing users a list of data categories collected. In a Spring Cloud microservices architecture, where should this data catalog be maintained?
- Hardcoded in each microservice's README
- Centralized data catalog service or API gateway metadata registry (Correct answer)
- In the Spring Cloud Config server properties
- In each service's application.yml
Correct answer: Centralized data catalog service or API gateway metadata registry
A centralized data catalog service or metadata registry in the API gateway provides a single source of truth for CCPA data category disclosures across microservices.
Spring Cloud Regulatory Frameworks & Compliance 2
Which Spring Cloud component helps enforce audit logging for compliance with regulations like SOX and PCI-DSS?