Regulatory Frameworks & Compliance Flashcards

A Spring Boot application must comply with FIPS 140-2 cryptographic standards. Which configuration change is required?

Answer: Running the JVM with a FIPS-approved security provider such as Bouncy Castle FIPS and restricting algorithms accordingly

FIPS 140-2 compliance requires using a validated cryptographic module at the JVM level; Spring itself delegates to the JVM's security provider, so the provider must be replaced with a FIPS-validated one.

Which Spring Security password encoding strategy aligns with NIST SP 800-63B guidance, which recommends adaptive hashing algorithms?

Answer: BCryptPasswordEncoder with a configurable strength factor

NIST SP 800-63B recommends memory-hard or adaptive hashing (bcrypt, scrypt, Argon2); BCryptPasswordEncoder's strength parameter controls the work factor, making it progressively harder as hardware improves.

How does Spring Batch support audit trail requirements common in financial services regulations like Dodd-Frank?

Answer: Through its built-in JobRepository which persists job execution metadata including start time, end time, status, and parameters

Spring Batch's JobRepository stores every job and step execution record in a relational database, providing a durable, queryable audit trail of when each batch process ran and what its outcome was.

A GDPR Data Protection Impact Assessment (DPIA) identifies that user consent must be recorded with a timestamp. Which Spring component is the most appropriate location to persist consent records?

Answer: A dedicated Spring Data repository saving a consent entity with @CreatedDate from Spring Data Auditing

Spring Data Auditing with @CreatedDate automatically populates timestamps, and a dedicated consent entity repository provides a durable, queryable record that can be retrieved or deleted per GDPR requests.

Which Spring Security feature helps comply with PCI-DSS Requirement 6.4 by preventing common web vulnerabilities like clickjacking in a Spring MVC application?

Answer: Configuring headers().frameOptions().deny() in HttpSecurity

Spring Security's headers().frameOptions().deny() adds the X-Frame-Options: DENY response header, which prevents the application from being embedded in iframes and mitigates clickjacking attacks.

When implementing an OAuth2 resource server in Spring Security to comply with enterprise SSO policies, which configuration correctly validates the JWT audience claim to ensure tokens are intended for this service?

Answer: oauth2ResourceServer().jwt().decoder(NimbusJwtDecoder.withJwkSetUri(uri))

NimbusJwtDecoder can be configured with JwtValidators including audience validators; by default Spring Security validates the iss and exp claims, and audience validation requires adding an explicit JwtClaimValidator.

A healthcare application built with Spring Boot must comply with HITECH Act breach notification requirements, necessitating detection of unauthorized PHI access. Which pattern best achieves this?

Answer: Implementing @PostAuthorize with a custom expression that logs and alerts when returned data contains PHI attributes accessed by unauthorized roles

@PostAuthorize evaluates after the method executes and can inspect the return value; a custom security expression can check whether PHI was returned to a caller without the appropriate role and trigger an alert.