Spring Cloud Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which Spring Cloud pattern helps comply with the SOC 2 availability principle during a downstream service failure?
- Circuit Breaker with fallback responses via Spring Cloud CircuitBreaker (Correct answer)
- Spring Cloud Config refresh
- Distributed tracing with Sleuth
- Feign client with default timeouts
Correct answer: Circuit Breaker with fallback responses via Spring Cloud CircuitBreaker
Spring Cloud CircuitBreaker opens the circuit and returns fallback responses during failures, maintaining availability as required by SOC 2 Trust Service Criteria.
Question 2: FISMA requires federal systems to implement least-privilege access. How is this enforced in Spring Cloud microservices?
- Use Spring Cloud Gateway rate limiting
- Assign fine-grained OAuth2 scopes per microservice endpoint with Spring Security (Correct answer)
- Deploy all services in the same network segment
- Use Spring Cloud Config for role definitions
Correct answer: Assign fine-grained OAuth2 scopes per microservice endpoint with Spring Security
Fine-grained OAuth2 scopes assigned per endpoint enforce least-privilege by ensuring tokens only grant access to explicitly required resources.
Question 3: Which Spring Cloud Vault feature directly supports PCI-DSS Requirement 3 (protect stored cardholder data)?
- Dynamic secrets generation for database credentials
- Transit secrets engine for encrypting cardholder data at rest (Correct answer)
- PKI secrets engine for TLS certificates
- AppRole authentication
Correct answer: Transit secrets engine for encrypting cardholder data at rest
Vault's Transit secrets engine provides encryption-as-a-service, allowing Spring Cloud applications to encrypt cardholder data without managing encryption keys directly.
Question 4: A Spring Cloud microservice processes EU citizen data. Under GDPR Article 25, which design principle must be applied?
- Data portability by default
- Privacy by design and by default (Correct answer)
- Data minimization only at the API layer
- Consent logging at the database layer
Correct answer: Privacy by design and by default
GDPR Article 25 mandates 'data protection by design and by default', meaning privacy controls must be built into the microservice architecture from the start.
Question 5: Which Spring Boot Actuator endpoint is most useful for demonstrating SOC 2 change management controls during an audit?
- /actuator/health
- /actuator/info with build metadata and git commit info (Correct answer)
- /actuator/metrics
- /actuator/env
Correct answer: /actuator/info with build metadata and git commit info
The /actuator/info endpoint exposing build metadata and git commit SHA provides auditors evidence of controlled deployments for SOC 2 change management.
Question 6: For HIPAA Security Rule compliance, Spring Cloud service-to-service communication must use encryption in transit. What is the recommended approach?
- Enable Spring Cloud Config encryption
- Mutual TLS (mTLS) between services using Spring Cloud certificate management (Correct answer)
- JWT tokens with HMAC signing
- API key authentication over HTTP
Correct answer: Mutual TLS (mTLS) between services using Spring Cloud certificate management
Mutual TLS ensures both parties authenticate and all data is encrypted in transit, satisfying HIPAA's transmission security standard for PHI.
Question 7: An ISO 27001 audit requires evidence of access control reviews for Spring Cloud microservices. Which approach provides the best audit trail?
- Manual spreadsheet of service permissions
- Spring Authorization Server with OAuth2 token introspection logs and scope audit reports (Correct answer)
- Spring Cloud Gateway access logs only
- Database-level row security policies
Correct answer: Spring Authorization Server with OAuth2 token introspection logs and scope audit reports
Spring Authorization Server with token introspection logging and scope auditing provides structured evidence of who accessed what, satisfying ISO 27001 access review requirements.
Spring Cloud Regulatory Frameworks & Compliance 3
Which Spring Cloud pattern helps comply with the SOC 2 availability principle during a downstream service failure?