Spring Framework Regulatory Frameworks & Compliance 5

Question 1

Which Spring Cloud Gateway filter can enforce rate limiting per authenticated user identity to comply with API usage policies under enterprise governance frameworks?

Accepted Answer

RequestRateLimiter filter using Redis and a KeyResolver based on the authenticated principal

Answer

RewritePath filter

Answer

SetResponseHeader filter

Answer

CircuitBreaker filter with Resilience4J

Question 2

For GDPR Article 25 (Data Protection by Design), which Spring practice ensures sensitive data is not accidentally exposed via Spring Data REST's default endpoint behavior?

Accepted Answer

Annotating the repository interface with @RepositoryRestResource(exported = false) for sensitive aggregates

Answer

Using @JsonProperty(access = WRITE_ONLY) on all entity fields

Answer

Disabling Spring Boot autoconfiguration globally

Answer

Setting spring.jpa.show-sql=false

Question 3

A Spring application subject to SOC 2 Type II must demonstrate that configuration secrets are never stored in source control. Which Spring Cloud feature enforces this at runtime?

Accepted Answer

Spring Cloud Config Server backed by HashiCorp Vault, with no secrets in git

Answer

Storing secrets in bootstrap.yml committed to the repository

Answer

Using @Value annotations with default fallback values

Answer

Spring Boot's application.properties encryption via Jasypt

Question 4

Which Spring Security configuration correctly implements HTTP Strict Transport Security (HSTS), required by compliance frameworks such as FedRAMP, to enforce HTTPS-only access?

Accepted Answer

http.headers().httpStrictTransportSecurity().maxAgeInSeconds(31536000).includeSubDomains(true)

Answer

http.requiresChannel().anyRequest().requiresSecure()

Answer

http.csrf().requireCsrfProtectionMatcher(new AntPathRequestMatcher("/api/**"))

Answer

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

Question 5

Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial information. Which Spring Security feature provides method-level data isolation so one customer cannot access another's records?

Accepted Answer

@PostFilter("filterObject.customerId == principal.customerId")

Answer

@EnableGlobalMethodSecurity(prePostEnabled = true) with @PreAuthorize only at the controller layer

Answer

Spring Data's @Query annotation with a static customer ID

Answer

Using ROLE_USER authority for all authenticated users

Question 6

Which Spring Boot property, when set correctly, prevents verbose error responses that could expose internal stack traces and violate OWASP and PCI-DSS information-disclosure requirements?

Accepted Answer

server.error.include-stacktrace=never and server.error.include-message=never

Answer

spring.mvc.throw-exception-if-no-handler-found=true

Answer

logging.level.root=OFF

Answer

spring.jpa.show-sql=false

Question 7

A Spring application must implement account lockout after five failed login attempts to satisfy CIS Benchmark recommendations. Which Spring Security component is the correct extension point?

Accepted Answer

A UserDetailsService that throws LockedException based on a failure counter stored in the database

Answer

A custom AuthenticationSuccessHandler

Answer

Overriding the AbstractSecurityInterceptor

Answer

A custom LogoutHandler