Spring Cloud Regulatory Frameworks & Compliance 3

Question 1

Which Spring Cloud pattern helps comply with the SOC 2 availability principle during a downstream service failure?

Accepted Answer

Circuit Breaker with fallback responses via Spring Cloud CircuitBreaker

Answer

Spring Cloud CircuitBreaker opens the circuit and returns fallback responses during failures, maintaining availability as required by SOC 2 Trust Service Criteria.

Question 2

FISMA requires federal systems to implement least-privilege access. How is this enforced in Spring Cloud microservices?

Accepted Answer

Assign fine-grained OAuth2 scopes per microservice endpoint with Spring Security

Answer

Fine-grained OAuth2 scopes assigned per endpoint enforce least-privilege by ensuring tokens only grant access to explicitly required resources.

Question 3

Which Spring Cloud Vault feature directly supports PCI-DSS Requirement 3 (protect stored cardholder data)?

Accepted Answer

Transit secrets engine for encrypting cardholder data at rest

Answer

Vault's Transit secrets engine provides encryption-as-a-service, allowing Spring Cloud applications to encrypt cardholder data without managing encryption keys directly.

Question 4

A Spring Cloud microservice processes EU citizen data. Under GDPR Article 25, which design principle must be applied?

Accepted Answer

Privacy by design and by default

Answer

GDPR Article 25 mandates 'data protection by design and by default', meaning privacy controls must be built into the microservice architecture from the start.

Question 5

Which Spring Boot Actuator endpoint is most useful for demonstrating SOC 2 change management controls during an audit?

Accepted Answer

/actuator/info with build metadata and git commit info

Answer

The /actuator/info endpoint exposing build metadata and git commit SHA provides auditors evidence of controlled deployments for SOC 2 change management.

Spring Cloud Practice Test

Spring Cloud Practice Test

Spring Cloud Regulatory Frameworks & Compliance 3