Spring Framework Regulatory Frameworks & Compliance 2

Question 1

Which Spring Security feature helps enforce GDPR data minimization by restricting which fields are returned from REST endpoints?

Accepted Answer

Spring Data Projections with method security

Answer

Spring Data Projections restrict which fields are exposed per interface, and combining them with @PreAuthorize lets you serve different field sets based on user roles.

Question 2

When configuring a Spring Boot application for HIPAA compliance, which approach best ensures PHI is never written to application logs?

Accepted Answer

Implementing a custom Logback filter that scrubs sensitive fields

Answer

A custom Logback TurboFilter or Filter can intercept log events and redact or drop PHI fields before they are written to any appender.

Question 3

Which Spring Security OAuth2 grant type is most appropriate for a backend service that calls another internal service without user interaction, supporting SOX audit trails?

Accepted Answer

Client Credentials

Answer

The Client Credentials grant is designed for machine-to-machine calls where no user context exists, and the client ID can be used as the audit identity.

Question 4

How does Spring Vault integrate with compliance requirements for secret rotation without application restart?

Accepted Answer

It uses @RefreshScope beans so secrets can be reloaded via /actuator/refresh

Answer

@RefreshScope combined with Spring Cloud Config and Vault allows secrets to be rotated in Vault and pulled into the running application without a restart.

Question 5

A PCI-DSS audit requires proof that all database queries accessing cardholder data are logged with the authenticated user's identity. Which Spring component is best suited for this cross-cutting concern?

Accepted Answer

@Around AOP advice on repository methods

Answer

@Around AOP advice can wrap repository or service calls to capture the SecurityContext principal and write a structured audit log entry for each data access.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Regulatory Frameworks & Compliance 2