Spring Framework Regulatory Frameworks & Compliance 4

Question 1

A Spring Boot application must comply with FIPS 140-2 cryptographic standards. Which configuration change is required?

Accepted Answer

Running the JVM with a FIPS-approved security provider such as Bouncy Castle FIPS and restricting algorithms accordingly

Answer

FIPS 140-2 compliance requires using a validated cryptographic module at the JVM level; Spring itself delegates to the JVM's security provider, so the provider must be replaced with a FIPS-validated one.

Question 2

Which Spring Security password encoding strategy aligns with NIST SP 800-63B guidance, which recommends adaptive hashing algorithms?

Accepted Answer

BCryptPasswordEncoder with a configurable strength factor

Answer

NIST SP 800-63B recommends memory-hard or adaptive hashing (bcrypt, scrypt, Argon2); BCryptPasswordEncoder's strength parameter controls the work factor, making it progressively harder as hardware improves.

Question 3

How does Spring Batch support audit trail requirements common in financial services regulations like Dodd-Frank?

Accepted Answer

Through its built-in JobRepository which persists job execution metadata including start time, end time, status, and parameters

Answer

Spring Batch's JobRepository stores every job and step execution record in a relational database, providing a durable, queryable audit trail of when each batch process ran and what its outcome was.

Question 4

A GDPR Data Protection Impact Assessment (DPIA) identifies that user consent must be recorded with a timestamp. Which Spring component is the most appropriate location to persist consent records?

Accepted Answer

A dedicated Spring Data repository saving a consent entity with @CreatedDate from Spring Data Auditing

Answer

Spring Data Auditing with @CreatedDate automatically populates timestamps, and a dedicated consent entity repository provides a durable, queryable record that can be retrieved or deleted per GDPR requests.

Question 5

Which Spring Security feature helps comply with PCI-DSS Requirement 6.4 by preventing common web vulnerabilities like clickjacking in a Spring MVC application?

Accepted Answer

Configuring headers().frameOptions().deny() in HttpSecurity

Answer

Spring Security's headers().frameOptions().deny() adds the X-Frame-Options: DENY response header, which prevents the application from being embedded in iframes and mitigates clickjacking attacks.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Regulatory Frameworks & Compliance 4