Spring Cloud Regulatory Frameworks & Compliance 5

Question 1

Which Spring Cloud pattern addresses the ISO 27001 requirement for business continuity by ensuring service availability during partial infrastructure failures?

Accepted Answer

Spring Cloud CircuitBreaker with Bulkhead pattern for resource isolation

Answer

The Bulkhead pattern isolates resources so failures in one service don't cascade, maintaining business continuity as required by ISO 27001 availability controls.

Question 2

HIPAA requires a covered entity to have a Business Associate Agreement (BAA). How does this impact Spring Cloud third-party service integrations?

Accepted Answer

Any third-party service receiving PHI via Feign clients or Spring Cloud Stream must have a BAA in place

Answer

Any external service that receives PHI through microservice calls — whether via Feign, Stream, or Gateway — must have a signed BAA with the covered entity.

Question 3

A Spring Cloud microservice must comply with NIST SP 800-190 (application container security). Which practice is directly mandated?

Accepted Answer

Run Spring Boot containers as non-root users with read-only filesystems

Answer

NIST SP 800-190 requires containers to run as non-root users with minimal filesystem permissions to reduce the attack surface of containerized Spring Boot applications.

Question 4

Under PCI-DSS Requirement 6 (develop and maintain secure systems), which Spring Cloud development practice is most directly relevant?

Accepted Answer

Running SAST/DAST tools against Spring Boot services in the CI/CD pipeline

Answer

PCI-DSS Requirement 6 mandates security testing of applications before deployment, which SAST/DAST tools integrated into CI/CD pipelines directly fulfill.

Question 5

A Spring Cloud application stores logs containing sensitive data. Which GDPR-compliant approach should be applied to log retention?

Accepted Answer

Apply log rotation with defined retention periods and pseudonymization of PII in log entries

Answer

GDPR requires purpose limitation and storage limitation, so logs must have defined retention periods and PII must be pseudonymized to comply with data minimization principles.

Spring Cloud Practice Test

Spring Cloud Practice Test

Spring Cloud Regulatory Frameworks & Compliance 5