Spring Framework Regulatory Frameworks & Compliance 5

Question 1

Which Spring Cloud Gateway filter can enforce rate limiting per authenticated user identity to comply with API usage policies under enterprise governance frameworks?

Accepted Answer

RequestRateLimiter filter using Redis and a KeyResolver based on the authenticated principal

Answer

Spring Cloud Gateway's RequestRateLimiter filter uses a Redis-backed token bucket algorithm, and a custom KeyResolver can extract the principal name from the SecurityContext to rate-limit per user.

Question 2

For GDPR Article 25 (Data Protection by Design), which Spring practice ensures sensitive data is not accidentally exposed via Spring Data REST's default endpoint behavior?

Accepted Answer

Annotating the repository interface with @RepositoryRestResource(exported = false) for sensitive aggregates

Answer

@RepositoryRestResource(exported = false) prevents Spring Data REST from auto-generating HTTP endpoints for sensitive entities, enforcing a privacy-by-default posture.

Question 3

A Spring application subject to SOC 2 Type II must demonstrate that configuration secrets are never stored in source control. Which Spring Cloud feature enforces this at runtime?

Accepted Answer

Spring Cloud Config Server backed by HashiCorp Vault, with no secrets in git

Answer

Spring Cloud Config Server can use Vault as a backend, fetching secrets at startup from Vault's encrypted store so no secret ever appears in the git repository.

Question 4

Which Spring Security configuration correctly implements HTTP Strict Transport Security (HSTS), required by compliance frameworks such as FedRAMP, to enforce HTTPS-only access?

Accepted Answer

http.headers().httpStrictTransportSecurity().maxAgeInSeconds(31536000).includeSubDomains(true)

Answer

Spring Security's headers().httpStrictTransportSecurity() adds the Strict-Transport-Security response header with configurable max-age and includeSubDomains, instructing browsers to only connect via HTTPS.

Question 5

Under GLBA (Gramm-Leach-Bliley Act), financial institutions must protect customer financial information. Which Spring Security feature provides method-level data isolation so one customer cannot access another's records?

Accepted Answer

@PostFilter("filterObject.customerId == principal.customerId")

Answer

@PostFilter applies a SpEL expression to each element of a returned collection, removing entries that don't belong to the requesting principal, enforcing row-level data isolation.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Regulatory Frameworks & Compliance 5