Spring Framework Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A Spring Boot service must comply with CCPA and allow users to request deletion of their data. Which Spring Data feature simplifies implementing a 'right to be forgotten' endpoint?
- CrudRepository.deleteById() exposed directly via REST
- Spring Data REST's DELETE endpoint with @RepositoryRestResource
- A custom service method calling repository delete operations wrapped in a saga pattern (Correct answer)
- Spring Batch job triggered per deletion request
Correct answer: A custom service method calling repository delete operations wrapped in a saga pattern
A right-to-be-forgotten workflow typically spans multiple tables and services, so a transactional service method orchestrating multiple repository deletes (possibly with a saga for distributed systems) is the correct approach.
Question 2: Which Spring Boot Actuator endpoint provides runtime evidence for a SOX audit that the application's configuration has not changed since deployment?
- /actuator/env
- /actuator/configprops
- /actuator/info with build metadata (Correct answer)
- /actuator/metrics
Correct answer: /actuator/info with build metadata
/actuator/info can expose git commit hash and build timestamp from META-INF/build-info.properties, giving auditors a verifiable artifact tying the running binary to a specific source commit.
Question 3: How should a Spring Security configuration be structured to comply with OWASP's requirement that authentication failures do not reveal whether the username or password was wrong?
- Throw UsernameNotFoundException for unknown users and BadCredentialsException for wrong passwords separately
- Always throw BadCredentialsException regardless of whether the user exists or the password is wrong (Correct answer)
- Return HTTP 403 for wrong usernames and HTTP 401 for wrong passwords
- Use a custom AuthenticationFailureHandler that sets distinct error codes
Correct answer: Always throw BadCredentialsException regardless of whether the user exists or the password is wrong
Spring Security's DaoAuthenticationProvider hides UsernameNotFoundException behind a generic BadCredentialsException by default to prevent username enumeration attacks.
Question 4: Which Spring framework feature supports FedRAMP's requirement for continuous monitoring by exporting application metrics to an external monitoring system?
- Spring AOP weaving at load time
- Micrometer with a Prometheus or Datadog registry configured in Spring Boot Actuator (Correct answer)
- Spring Batch execution listeners
- Spring Integration message history
Correct answer: Micrometer with a Prometheus or Datadog registry configured in Spring Boot Actuator
Micrometer is Spring Boot Actuator's metrics facade; configuring a Prometheus or Datadog registry pushes runtime metrics to external monitoring platforms required by FedRAMP continuous monitoring.
Question 5: A compliance requirement mandates that all inter-service HTTP calls within a Spring Cloud application use mutual TLS (mTLS). Where is this best configured?
- In each microservice's RestTemplate bean by loading client keystores
- At the service mesh layer (e.g., Istio sidecar), keeping Spring services unaware (Correct answer)
- In Spring Security's HttpSecurity.requiresChannel() configuration
- In application.properties using server.ssl.client-auth=need only
Correct answer: At the service mesh layer (e.g., Istio sidecar), keeping Spring services unaware
A service mesh like Istio handles mTLS transparently via sidecar proxies, removing the certificate management burden from individual Spring services.
Question 6: Under ISO 27001 Annex A, access rights must be reviewed regularly. Which Spring Security feature can automatically expire user sessions after a compliance-defined period of inactivity?
- ConcurrentSessionControlAuthenticationStrategy
- HttpSecurity.sessionManagement().invalidSessionUrl()
- Setting server.servlet.session.timeout in application.properties (Correct answer)
- Using JWT with a short exp claim and no refresh token
Correct answer: Setting server.servlet.session.timeout in application.properties
server.servlet.session.timeout (or spring.session.timeout for Spring Session) sets the inactivity timeout after which the server invalidates the session, enforcing access review requirements.
Question 7: Which approach does Spring Authorization Server use to support PKCE, which is required for public clients under OAuth 2.1 compliance?
- Adding a custom GrantedAuthoritiesMapper
- Enabling code_challenge and code_challenge_method parameters in the authorization request flow (Correct answer)
- Configuring client_secret_post authentication method
- Using opaque tokens instead of JWTs
Correct answer: Enabling code_challenge and code_challenge_method parameters in the authorization request flow
PKCE requires the client to send a code_challenge in the authorization request and a code_verifier in the token request; Spring Authorization Server validates this exchange automatically when PKCE is configured.
Spring Framework Regulatory Frameworks & Compliance 3
A Spring Boot service must comply with CCPA and allow users to request deletion of their data.
Which Spring Data feature simplifies implementing a 'right to be forgotten' endpoint?