Regulatory Frameworks & Compliance Flashcards

Which Spring Cloud Gateway filter can enforce rate limiting per authenticated user identity to comply with API usage policies under enterprise governance frameworks?

Answer: RequestRateLimiter filter using Redis and a KeyResolver based on the authenticated principal

Spring Cloud Gateway's RequestRateLimiter filter uses a Redis-backed token bucket algorithm, and a custom KeyResolver can extract the principal name from the SecurityContext to rate-limit per user.

For GDPR Article 25 (Data Protection by Design), which Spring practice ensures sensitive data is not accidentally exposed via Spring Data REST's default endpoint behavior?

Answer: Annotating the repository interface with @RepositoryRestResource(exported = false) for sensitive aggregates

@RepositoryRestResource(exported = false) prevents Spring Data REST from auto-generating HTTP endpoints for sensitive entities, enforcing a privacy-by-default posture.

A Spring application subject to SOC 2 Type II must demonstrate that configuration secrets are never stored in source control. Which Spring Cloud feature enforces this at runtime?

Answer: Spring Cloud Config Server backed by HashiCorp Vault, with no secrets in git

Spring Cloud Config Server can use Vault as a backend, fetching secrets at startup from Vault's encrypted store so no secret ever appears in the git repository.

Which Spring Security configuration correctly implements HTTP Strict Transport Security (HSTS), required by compliance frameworks such as FedRAMP, to enforce HTTPS-only access?

Answer: http.headers().httpStrictTransportSecurity().maxAgeInSeconds(31536000).includeSubDomains(true)

Spring Security's headers().httpStrictTransportSecurity() adds the Strict-Transport-Security response header with configurable max-age and includeSubDomains, instructing browsers to only connect via HTTPS.

Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial information. Which Spring Security feature provides method-level data isolation so one customer cannot access another's records?

Answer: @PostFilter("filterObject.customerId == principal.customerId")

@PostFilter applies a SpEL expression to each element of a returned collection, removing entries that don't belong to the requesting principal, enforcing row-level data isolation.

Which Spring Boot property, when set correctly, prevents verbose error responses that could expose internal stack traces and violate OWASP and PCI-DSS information-disclosure requirements?

Answer: server.error.include-stacktrace=never and server.error.include-message=never

Setting server.error.include-stacktrace=never and server.error.include-message=never ensures that Spring Boot's default error responses omit stack traces and exception messages from API responses.

A Spring application must implement account lockout after five failed login attempts to satisfy CIS Benchmark recommendations. Which Spring Security component is the correct extension point?

Answer: A UserDetailsService that throws LockedException based on a failure counter stored in the database

UserDetailsService.loadUserByUsername() returns a UserDetails object; if the enabled/accountNonLocked flags are false, Spring Security throws LockedException, and a custom implementation can toggle the lock after tracking failures.