Spring Cloud Regulatory Frameworks & Compliance 2

Question 1

Which Spring Cloud component helps enforce audit logging for compliance with regulations like SOX and PCI-DSS?

Accepted Answer

Spring Data JPA Auditing with Spring Cloud Bus events

Answer

Spring Data JPA Auditing combined with Spring Cloud Bus events enables distributed audit trails required by SOX and PCI-DSS.

Question 2

Under GDPR, a Spring Cloud microservice must support the 'right to erasure'. What is the recommended architectural pattern?

Accepted Answer

Use a saga pattern with compensating transactions to erase data across services

Answer

The saga pattern with compensating transactions ensures coordinated, consistent data erasure across distributed microservices while maintaining eventual consistency.

Question 3

Which Spring Security feature is most directly relevant to HIPAA's requirement for unique user identification in a Spring Cloud app?

Accepted Answer

UserDetailsService with unique principal assignment

Answer

HIPAA requires each user to have a unique identifier, which is enforced via UserDetailsService ensuring distinct principals for every account.

Question 4

A Spring Cloud Gateway is used as an API gateway. Which filter type is best for implementing PCI-DSS requirement of masking PANs in logs?

Accepted Answer

GatewayFilter that sanitizes request/response logging

Answer

A GatewayFilter applied to logging can intercept and sanitize requests/responses to mask Primary Account Numbers before they reach log outputs.

Question 5

Which Spring Cloud Config feature supports the NIST SP 800-53 control requiring separation of configuration from code?

Accepted Answer

Git-backed external configuration store

Answer

A Git-backed external configuration store separates configuration from application code, directly supporting NIST SP 800-53 configuration management controls.

Spring Cloud Practice Test

Spring Cloud Practice Test

Spring Cloud Regulatory Frameworks & Compliance 2