Spring Framework Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A Spring Boot application must comply with FIPS 140-2 cryptographic standards. Which configuration change is required?
- Setting spring.security.crypto.strength=256 in application.properties
- Running the JVM with a FIPS-approved security provider such as Bouncy Castle FIPS and restricting algorithms accordingly (Correct answer)
- Enabling AES-256 in Spring Security's password encoder only
- Configuring TLS 1.3 in the embedded Tomcat server
Correct answer: Running the JVM with a FIPS-approved security provider such as Bouncy Castle FIPS and restricting algorithms accordingly
FIPS 140-2 compliance requires using a validated cryptographic module at the JVM level; Spring itself delegates to the JVM's security provider, so the provider must be replaced with a FIPS-validated one.
Question 2: Which Spring Security password encoding strategy aligns with NIST SP 800-63B guidance, which recommends adaptive hashing algorithms?
- MD5PasswordEncoder
- BCryptPasswordEncoder with a configurable strength factor (Correct answer)
- NoOpPasswordEncoder for plaintext storage
- SHA-256 with a static salt
Correct answer: BCryptPasswordEncoder with a configurable strength factor
NIST SP 800-63B recommends memory-hard or adaptive hashing (bcrypt, scrypt, Argon2); BCryptPasswordEncoder's strength parameter controls the work factor, making it progressively harder as hardware improves.
Question 3: How does Spring Batch support audit trail requirements common in financial services regulations like Dodd-Frank?
- Through its built-in JobRepository which persists job execution metadata including start time, end time, status, and parameters (Correct answer)
- By automatically encrypting all batch output files
- Via Spring Integration's message history header
- Through @Transactional rollback on failed steps
Correct answer: Through its built-in JobRepository which persists job execution metadata including start time, end time, status, and parameters
Spring Batch's JobRepository stores every job and step execution record in a relational database, providing a durable, queryable audit trail of when each batch process ran and what its outcome was.
Question 4: A GDPR Data Protection Impact Assessment (DPIA) identifies that user consent must be recorded with a timestamp. Which Spring component is the most appropriate location to persist consent records?
- A Spring AOP aspect on the consent endpoint
- A dedicated Spring Data repository saving a consent entity with @CreatedDate from Spring Data Auditing (Correct answer)
- The SecurityContext as a GrantedAuthority
- A Spring Cache entry keyed by user ID
Correct answer: A dedicated Spring Data repository saving a consent entity with @CreatedDate from Spring Data Auditing
Spring Data Auditing with @CreatedDate automatically populates timestamps, and a dedicated consent entity repository provides a durable, queryable record that can be retrieved or deleted per GDPR requests.
Question 5: Which Spring Security feature helps comply with PCI-DSS Requirement 6.4 by preventing common web vulnerabilities like clickjacking in a Spring MVC application?
- Configuring headers().frameOptions().deny() in HttpSecurity (Correct answer)
- Enabling @CrossOrigin on all controllers
- Using @SessionAttributes to store card data
- Setting spring.mvc.throw-exception-if-no-handler-found=true
Correct answer: Configuring headers().frameOptions().deny() in HttpSecurity
Spring Security's headers().frameOptions().deny() adds the X-Frame-Options: DENY response header, which prevents the application from being embedded in iframes and mitigates clickjacking attacks.
Question 6: When implementing an OAuth2 resource server in Spring Security to comply with enterprise SSO policies, which configuration correctly validates the JWT audience claim to ensure tokens are intended for this service?
- oauth2ResourceServer().jwt().decoder(NimbusJwtDecoder.withJwkSetUri(uri)) (Correct answer)
- oauth2ResourceServer().jwt().jwtAuthenticationConverter(converter) only
- Adding a DelegatingJwtGrantedAuthoritiesConverter
- Using JwtTimestampValidator with a clock skew setting
Correct answer: oauth2ResourceServer().jwt().decoder(NimbusJwtDecoder.withJwkSetUri(uri))
NimbusJwtDecoder can be configured with JwtValidators including audience validators; by default Spring Security validates the iss and exp claims, and audience validation requires adding an explicit JwtClaimValidator.
Question 7: A healthcare application built with Spring Boot must comply with HITECH Act breach notification requirements, necessitating detection of unauthorized PHI access. Which pattern best achieves this?
- Using Spring Cache to detect repeated queries
- Implementing @PostAuthorize with a custom expression that logs and alerts when returned data contains PHI attributes accessed by unauthorized roles (Correct answer)
- Setting server.error.include-stacktrace=never
- Enabling Spring Boot DevTools for hot reload
Correct answer: Implementing @PostAuthorize with a custom expression that logs and alerts when returned data contains PHI attributes accessed by unauthorized roles
@PostAuthorize evaluates after the method executes and can inspect the return value; a custom security expression can check whether PHI was returned to a caller without the appropriate role and trigger an alert.
Spring Framework Regulatory Frameworks & Compliance 4
A Spring Boot application must comply with FIPS 140-2 cryptographic standards.
Which configuration change is required?