Spring Cloud Risk Assessment & Management 3 — Questions and Answers
Question 1: Which Spring Cloud Config feature reduces the risk of secrets being exposed in plaintext in a Git repository?
- Spring Cloud Bus refresh events
- Native file system profile
- Symmetric or asymmetric property encryption (Correct answer)
- Config server health endpoint
Correct answer: Symmetric or asymmetric property encryption
Spring Cloud Config supports encrypting sensitive values with {cipher} prefix using symmetric AES or asymmetric RSA keys, preventing plaintext secrets in Git.
Question 2: What is the risk of setting a very high slidingWindowSize in Resilience4j circuit breaker configuration?
- The circuit breaker opens too quickly on transient errors
- Slow reaction to genuine failures because more samples are needed before threshold is reached (Correct answer)
- Increased heap memory usage causing OutOfMemoryError
- Circuit breaker ignores slow calls entirely
Correct answer: Slow reaction to genuine failures because more samples are needed before threshold is reached
A large sliding window requires more failed calls before the failure rate exceeds the threshold, delaying circuit breaker activation and prolonging impact on callers.
Question 3: In Spring Cloud Gateway, which filter type is best suited to mitigate the risk of credential theft via insecure headers?
- RewritePath GatewayFilter
- RemoveRequestHeader GatewayFilter (Correct answer)
- AddResponseHeader GatewayFilter
- SetStatus GatewayFilter
Correct answer: RemoveRequestHeader GatewayFilter
RemoveRequestHeader filter strips sensitive headers before forwarding requests to downstream services that do not need them.
Question 4: A Spring Cloud application uses @RefreshScope for dynamic config updates. What risk exists if refresh events are triggered too frequently?
- Config server Git repository corruption
- Bean recreation storms causing temporary service unavailability (Correct answer)
- Eureka deregistration of healthy instances
- Circuit breaker state reset on every refresh
Correct answer: Bean recreation storms causing temporary service unavailability
Frequent @RefreshScope triggers destroy and recreate all scoped beans simultaneously, which can cause request failures and thread pool exhaustion during the recreation period.
Question 5: Which Spring Cloud pattern most directly addresses the risk of a single slow downstream service causing thread pool exhaustion in the caller?
- Service registry health checks
- Bulkhead isolation with separate thread pools per dependency (Correct answer)
- Config server property encryption
- API Gateway response caching
Correct answer: Bulkhead isolation with separate thread pools per dependency
Bulkhead pattern assigns a dedicated thread pool per dependency so a slow service only exhausts its own pool, not the caller's main pool.
Question 6: When Spring Cloud Eureka clients use lease renewal intervals, what risk does a very long renewalIntervalInSecs value introduce?
- Higher network bandwidth consumption
- Delayed detection of failed instances, routing traffic to dead services (Correct answer)
- Config server registration failures
- Ribbon client cache over-population
Correct answer: Delayed detection of failed instances, routing traffic to dead services
Long renewal intervals mean Eureka takes longer to mark an instance as DOWN after it fails, causing load balancers to continue sending requests to unavailable instances.
Question 7: Which risk does Spring Cloud Vault integration primarily address compared to Spring Cloud Config with Git backend?
- Dynamic property refresh without service restart
- Centralized secret management with dynamic secret generation and lease-based expiry (Correct answer)
- Multi-region config replication
- Environment-specific YAML profile selection
Correct answer: Centralized secret management with dynamic secret generation and lease-based expiry
HashiCorp Vault via Spring Cloud Vault provides dynamic secrets with automatic rotation and lease expiry, reducing the risk of long-lived static credentials being compromised.
Spring Cloud Risk Assessment & Management 3
Which Spring Cloud Config feature reduces the risk of secrets being exposed in plaintext in a Git repository?