Spring Cloud Risk Assessment & Management 5 — Questions and Answers
Question 1: In Spring Cloud, which approach best mitigates the risk of a misconfigured Feign client causing all requests to fail silently?
- Increasing the Feign connection timeout to 60 seconds
- Implementing a FallbackFactory that logs the cause and returns a safe default (Correct answer)
- Disabling Resilience4j integration with Feign
- Using RestTemplate instead of Feign
Correct answer: Implementing a FallbackFactory that logs the cause and returns a safe default
FallbackFactory receives the exception that caused the fallback, allowing teams to log the root cause while returning safe defaults instead of propagating failures silently.
Question 2: A Spring Cloud microservice relies on Eureka for discovery but has no client-side retry configured. What failure scenario does this leave unaddressed?
- Config server becoming temporarily unavailable
- Requests hitting a just-deregistered but still-cached stale Eureka entry (Correct answer)
- Gateway route predicate misconfiguration
- Zipkin span context loss across async boundaries
Correct answer: Requests hitting a just-deregistered but still-cached stale Eureka entry
Eureka caches can briefly contain deregistered instances; without client-side retry, the single attempt to a stale entry fails with no automatic recovery to a healthy instance.
Question 3: Which Spring Cloud Config Server configuration reduces the risk of one team's config changes accidentally affecting another team's services?
- Setting spring.cloud.config.server.git.searchPaths per application (Correct answer)
- Enabling spring.cloud.config.server.encrypt.enabled
- Using spring.cloud.config.fail-fast on all clients
- Configuring spring.cloud.bus.enabled=false
Correct answer: Setting spring.cloud.config.server.git.searchPaths per application
Scoping Git search paths per application name ensures each service reads only from its designated directory, preventing cross-team configuration bleed.
Question 4: What is the primary risk of using default Resilience4j circuit breaker settings without tuning them to actual service SLAs?
- Circuit breaker never records metrics in Micrometer
- Default thresholds may be too sensitive or too lenient for the service's real failure profile (Correct answer)
- The circuit breaker blocks all health check endpoints
- Default settings disable the HALF_OPEN state entirely
Correct answer: Default thresholds may be too sensitive or too lenient for the service's real failure profile
Generic defaults like 50% failure rate threshold may trigger false opens on healthy services with bursty traffic or fail to protect against gradual degradation in stable services.
Question 5: In Spring Cloud Gateway, what security risk does a misconfigured CORS policy with allowedOrigins set to wildcard introduce?
- Prevents WebSocket connections from being proxied
- Allows malicious websites to make authenticated cross-origin requests on behalf of users (Correct answer)
- Causes JWT validation to fail for mobile clients
- Breaks Spring Security CSRF token validation
Correct answer: Allows malicious websites to make authenticated cross-origin requests on behalf of users
Wildcard CORS origins allow any website to make cross-origin requests using the user's session credentials, enabling cross-site request forgery attacks from malicious domains.
Question 6: A Spring Cloud Stream application does not configure a dead-letter queue (DLQ). What risk does this introduce for poison message scenarios?
- Messages are silently dropped after max retry attempts with no audit trail (Correct answer)
- Consumer group offsets are reset to the beginning of the topic
- The message broker connection pool becomes exhausted
- Spring Cloud Bus refresh events are blocked
Correct answer: Messages are silently dropped after max retry attempts with no audit trail
Without a DLQ, messages that consistently fail processing are either dropped silently or cause infinite retry loops, resulting in data loss or service disruption.
Question 7: When performing a risk assessment of a Spring Cloud microservices system, which factor most increases the blast radius of a single service failure?
- High number of Eureka zones configured
- Synchronous chain of service-to-service calls with no timeouts or circuit breakers (Correct answer)
- Using Spring Cloud Config native profile instead of Git
- Enabling Micrometer metrics export to multiple registries
Correct answer: Synchronous chain of service-to-service calls with no timeouts or circuit breakers
Synchronous call chains without timeouts or circuit breakers allow one slow or failed service to cascade upstream, potentially bringing down every service in the call chain.
Spring Cloud Risk Assessment & Management 5
In Spring Cloud, which approach best mitigates the risk of a misconfigured Feign client causing all requests to fail silently?