Spring Cloud Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Spring Cloud pattern addresses the ISO 27001 requirement for business continuity by ensuring service availability during partial infrastructure failures?
- Spring Cloud CircuitBreaker with Bulkhead pattern for resource isolation (Correct answer)
- Spring Cloud Config high availability mode
- Spring Cloud Contract consumer-driven tests
- Spring Cloud Sleuth sampling rate adjustment
Correct answer: Spring Cloud CircuitBreaker with Bulkhead pattern for resource isolation
The Bulkhead pattern isolates resources so failures in one service don't cascade, maintaining business continuity as required by ISO 27001 availability controls.
Question 2: HIPAA requires a covered entity to have a Business Associate Agreement (BAA). How does this impact Spring Cloud third-party service integrations?
- All Spring Cloud starter dependencies must be HIPAA-certified
- Any third-party service receiving PHI via Feign clients or Spring Cloud Stream must have a BAA in place (Correct answer)
- Spring Cloud Config must encrypt all properties
- OAuth2 tokens must use HIPAA-approved algorithms
Correct answer: Any third-party service receiving PHI via Feign clients or Spring Cloud Stream must have a BAA in place
Any external service that receives PHI through microservice calls — whether via Feign, Stream, or Gateway — must have a signed BAA with the covered entity.
Question 3: A Spring Cloud microservice must comply with NIST SP 800-190 (application container security). Which practice is directly mandated?
- Run Spring Boot containers as non-root users with read-only filesystems (Correct answer)
- Use Spring Cloud Kubernetes for deployment
- Enable Spring Boot Actuator in containers
- Use Docker Compose for multi-service orchestration
Correct answer: Run Spring Boot containers as non-root users with read-only filesystems
NIST SP 800-190 requires containers to run as non-root users with minimal filesystem permissions to reduce the attack surface of containerized Spring Boot applications.
Question 4: Under PCI-DSS Requirement 6 (develop and maintain secure systems), which Spring Cloud development practice is most directly relevant?
- Using Spring Cloud Contract to verify API contracts before deployment
- Running SAST/DAST tools against Spring Boot services in the CI/CD pipeline (Correct answer)
- Enabling Spring Boot Actuator in production
- Using Spring Cloud Config for secret management
Correct answer: Running SAST/DAST tools against Spring Boot services in the CI/CD pipeline
PCI-DSS Requirement 6 mandates security testing of applications before deployment, which SAST/DAST tools integrated into CI/CD pipelines directly fulfill.
Question 5: A Spring Cloud application stores logs containing sensitive data. Which GDPR-compliant approach should be applied to log retention?
- Retain all logs indefinitely for audit purposes
- Apply log rotation with defined retention periods and pseudonymization of PII in log entries (Correct answer)
- Disable all application logging to avoid GDPR risk
- Store logs only in memory to prevent persistence
Correct answer: Apply log rotation with defined retention periods and pseudonymization of PII in log entries
GDPR requires purpose limitation and storage limitation, so logs must have defined retention periods and PII must be pseudonymized to comply with data minimization principles.
Question 6: Which Spring Cloud approach supports SOC 2 processing integrity by ensuring data transformations between microservices are consistent and verifiable?
- Spring Cloud Contract with provider verification tests ensuring consistent API behavior (Correct answer)
- Spring Cloud Gateway request caching
- Spring Cloud Bus event broadcasting
- Spring Cloud Consul health checks
Correct answer: Spring Cloud Contract with provider verification tests ensuring consistent API behavior
Spring Cloud Contract enforces consistent API behavior through provider verification tests, ensuring data transformations between services produce expected results as required by SOC 2 processing integrity.
Question 7: For CCPA compliance, a Spring Cloud service receives a verified consumer request to know all personal data collected. What is the architecturally correct response mechanism?
- Query each microservice's database directly from a compliance dashboard
- Aggregate data via a purpose-built data subject access request (DSAR) service that calls each microservice's dedicated data export endpoint (Correct answer)
- Export the entire production database
- Reply with a general privacy policy URL
Correct answer: Aggregate data via a purpose-built data subject access request (DSAR) service that calls each microservice's dedicated data export endpoint
A dedicated DSAR service that calls each microservice's data export API provides a structured, maintainable, and legally defensible response to CCPA data access requests.
Spring Cloud Regulatory Frameworks & Compliance 5
Which Spring Cloud pattern addresses the ISO 27001 requirement for business continuity by ensuring service availability during partial infrastructure failures?