Spring Framework Regulatory Frameworks & Compliance 3

Question 1

A Spring Boot service must comply with CCPA and allow users to request deletion of their data. Which Spring Data feature simplifies implementing a 'right to be forgotten' endpoint?

Accepted Answer

A custom service method calling repository delete operations wrapped in a saga pattern

Answer

A right-to-be-forgotten workflow typically spans multiple tables and services, so a transactional service method orchestrating multiple repository deletes (possibly with a saga for distributed systems) is the correct approach.

Question 2

Which Spring Boot Actuator endpoint provides runtime evidence for a SOX audit that the application's configuration has not changed since deployment?

Accepted Answer

/actuator/info with build metadata

Answer

/actuator/info can expose git commit hash and build timestamp from META-INF/build-info.properties, giving auditors a verifiable artifact tying the running binary to a specific source commit.

Question 3

How should a Spring Security configuration be structured to comply with OWASP's requirement that authentication failures do not reveal whether the username or password was wrong?

Accepted Answer

Always throw BadCredentialsException regardless of whether the user exists or the password is wrong

Answer

Spring Security's DaoAuthenticationProvider hides UsernameNotFoundException behind a generic BadCredentialsException by default to prevent username enumeration attacks.

Question 4

Which Spring framework feature supports FedRAMP's requirement for continuous monitoring by exporting application metrics to an external monitoring system?

Accepted Answer

Micrometer with a Prometheus or Datadog registry configured in Spring Boot Actuator

Answer

Micrometer is Spring Boot Actuator's metrics facade; configuring a Prometheus or Datadog registry pushes runtime metrics to external monitoring platforms required by FedRAMP continuous monitoring.

Question 5

A compliance requirement mandates that all inter-service HTTP calls within a Spring Cloud application use mutual TLS (mTLS). Where is this best configured?

Accepted Answer

At the service mesh layer (e.g., Istio sidecar), keeping Spring services unaware

Answer

A service mesh like Istio handles mTLS transparently via sidecar proxies, removing the certificate management burden from individual Spring services.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Regulatory Frameworks & Compliance 3