Spring Framework Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Spring Security feature helps enforce GDPR data minimization by restricting which fields are returned from REST endpoints?
- @JsonIgnore combined with role-based filtering
- Spring Data Projections with method security (Correct answer)
- @PreAuthorize on repository methods
- SecurityContextHolder field masking
Correct answer: Spring Data Projections with method security
Spring Data Projections restrict which fields are exposed per interface, and combining them with @PreAuthorize lets you serve different field sets based on user roles.
Question 2: When configuring a Spring Boot application for HIPAA compliance, which approach best ensures PHI is never written to application logs?
- Setting log level to ERROR globally
- Implementing a custom Logback filter that scrubs sensitive fields (Correct answer)
- Disabling all Spring Boot Actuator endpoints
- Using @Transactional on all service methods
Correct answer: Implementing a custom Logback filter that scrubs sensitive fields
A custom Logback TurboFilter or Filter can intercept log events and redact or drop PHI fields before they are written to any appender.
Question 3: Which Spring Security OAuth2 grant type is most appropriate for a backend service that calls another internal service without user interaction, supporting SOX audit trails?
- Authorization Code
- Implicit
- Client Credentials (Correct answer)
- Resource Owner Password
Correct answer: Client Credentials
The Client Credentials grant is designed for machine-to-machine calls where no user context exists, and the client ID can be used as the audit identity.
Question 4: How does Spring Vault integrate with compliance requirements for secret rotation without application restart?
- It caches secrets permanently in the application context
- It uses @RefreshScope beans so secrets can be reloaded via /actuator/refresh (Correct answer)
- It stores secrets in application.properties at startup
- It requires manual redeployment for every secret change
Correct answer: It uses @RefreshScope beans so secrets can be reloaded via /actuator/refresh
@RefreshScope combined with Spring Cloud Config and Vault allows secrets to be rotated in Vault and pulled into the running application without a restart.
Question 5: A PCI-DSS audit requires proof that all database queries accessing cardholder data are logged with the authenticated user's identity. Which Spring component is best suited for this cross-cutting concern?
- @Around AOP advice on repository methods (Correct answer)
- A Spring MVC HandlerInterceptor
- A Servlet Filter at the gateway layer
- Spring Batch ItemReader listeners
Correct answer: @Around AOP advice on repository methods
@Around AOP advice can wrap repository or service calls to capture the SecurityContext principal and write a structured audit log entry for each data access.
Question 6: Which Spring Security mechanism prevents a CSRF attack in a REST API that uses JWT bearer tokens instead of session cookies?
- CsrfTokenRepository with HttpSessionCsrfTokenRepository
- SameSite cookie attribute set to Strict
- Disabling CSRF protection because stateless JWTs don't use session cookies (Correct answer)
- Enabling X-Frame-Options DENY header
Correct answer: Disabling CSRF protection because stateless JWTs don't use session cookies
CSRF exploits session cookies; since JWT-based APIs carry tokens in Authorization headers (not cookies), CSRF is not applicable and protection can be disabled.
Question 7: Under NIST 800-53, least-privilege access control should be enforced. Which Spring Security annotation restricts a method so only users with both ROLE_AUDITOR and a custom authority 'READ_REPORTS' can invoke it?
- @Secured({"ROLE_AUDITOR", "READ_REPORTS"})
- @PreAuthorize("hasRole('AUDITOR') and hasAuthority('READ_REPORTS')") (Correct answer)
- @RolesAllowed("ROLE_AUDITOR", "READ_REPORTS")
- @PostAuthorize("returnObject.owner == principal.name")
Correct answer: @PreAuthorize("hasRole('AUDITOR') and hasAuthority('READ_REPORTS')")
@PreAuthorize supports SpEL expressions including logical 'and', allowing you to combine role and authority checks in a single annotation.
Spring Framework Regulatory Frameworks & Compliance 2
Which Spring Security feature helps enforce GDPR data minimization by restricting which fields are returned from REST endpoints?