Regulatory Frameworks & Compliance Flashcards

Which Spring Security feature helps enforce GDPR data minimization by restricting which fields are returned from REST endpoints?

Answer: Spring Data Projections with method security

Spring Data Projections restrict which fields are exposed per interface, and combining them with @PreAuthorize lets you serve different field sets based on user roles.

When configuring a Spring Boot application for HIPAA compliance, which approach best ensures PHI is never written to application logs?

Answer: Implementing a custom Logback filter that scrubs sensitive fields

A custom Logback TurboFilter or Filter can intercept log events and redact or drop PHI fields before they are written to any appender.

Which Spring Security OAuth2 grant type is most appropriate for a backend service that calls another internal service without user interaction, supporting SOX audit trails?

Answer: Client Credentials

The Client Credentials grant is designed for machine-to-machine calls where no user context exists, and the client ID can be used as the audit identity.

How does Spring Vault integrate with compliance requirements for secret rotation without application restart?

Answer: It uses @RefreshScope beans so secrets can be reloaded via /actuator/refresh

@RefreshScope combined with Spring Cloud Config and Vault allows secrets to be rotated in Vault and pulled into the running application without a restart.

A PCI-DSS audit requires proof that all database queries accessing cardholder data are logged with the authenticated user's identity. Which Spring component is best suited for this cross-cutting concern?

Answer: @Around AOP advice on repository methods

@Around AOP advice can wrap repository or service calls to capture the SecurityContext principal and write a structured audit log entry for each data access.

Which Spring Security mechanism prevents a CSRF attack in a REST API that uses JWT bearer tokens instead of session cookies?

Answer: Disabling CSRF protection because stateless JWTs don't use session cookies

CSRF exploits session cookies; since JWT-based APIs carry tokens in Authorization headers (not cookies), CSRF is not applicable and protection can be disabled.

Under NIST 800-53, least-privilege access control should be enforced. Which Spring Security annotation restricts a method so only users with both ROLE_AUDITOR and a custom authority 'READ_REPORTS' can invoke it?

Answer: @PreAuthorize("hasRole('AUDITOR') and hasAuthority('READ_REPORTS')")

@PreAuthorize supports SpEL expressions including logical 'and', allowing you to combine role and authority checks in a single annotation.