Spring Framework Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Spring Security feature helps mitigate the risk of session fixation attacks?
- Invalidating and regenerating the session ID upon successful authentication (Correct answer)
- Storing session tokens in cookies with HttpOnly flag only
- Using stateless JWT tokens for all endpoints
- Enabling CSRF protection on login forms
Correct answer: Invalidating and regenerating the session ID upon successful authentication
Spring Security migrates the session (creates a new session ID) on login by default to prevent session fixation attacks.
Question 2: When assessing risk in a Spring Boot application, which actuator endpoint poses the highest security risk if exposed publicly?
- /actuator/health
- /actuator/env (Correct answer)
- /actuator/info
- /actuator/metrics
Correct answer: /actuator/env
The /actuator/env endpoint can expose sensitive configuration values, environment variables, and secrets, making it the highest-risk endpoint.
Question 3: Which Spring property reduces the risk of exposing sensitive actuator endpoints in production?
- management.endpoints.web.exposure.include=health,info (Correct answer)
- spring.security.enabled=true
- management.endpoint.shutdown.enabled=false
- server.ssl.enabled=true
Correct answer: management.endpoints.web.exposure.include=health,info
Restricting the exposed actuator endpoints to only health and info minimizes the attack surface in production environments.
Question 4: In Spring Data JPA, which practice best mitigates the risk of SQL injection?
- Using @Query with native SQL and string concatenation
- Using JPQL named parameters or Spring Data query methods (Correct answer)
- Disabling query caching globally
- Using EntityManager.createNativeQuery with user input directly
Correct answer: Using JPQL named parameters or Spring Data query methods
JPQL named parameters and derived query methods use parameterized queries internally, preventing SQL injection.
Question 5: Which risk does enabling Spring Boot's H2 console in production introduce?
- Increased CPU usage from in-memory database operations
- Unauthenticated access to the database via a web interface (Correct answer)
- Slower query execution due to console overhead
- Incompatibility with Spring Security's CSRF protection
Correct answer: Unauthenticated access to the database via a web interface
The H2 console provides a full database web interface that, if left unsecured, allows anyone to query or modify the database.
Question 6: What is the primary risk of using @Transactional(propagation=REQUIRES_NEW) carelessly in Spring?
- It can cause deadlocks by creating nested independent transactions that lock shared resources (Correct answer)
- It disables the Spring transaction manager for the annotated method
- It prevents the method from being called within an existing transaction
- It increases memory usage by caching transaction data
Correct answer: It can cause deadlocks by creating nested independent transactions that lock shared resources
REQUIRES_NEW suspends the outer transaction and starts a new one, which can deadlock if both transactions need the same database row.
Question 7: Which Spring Security configuration best manages the risk of brute-force login attacks?
- Configuring account lockout or rate limiting on the authentication endpoint (Correct answer)
- Switching from form login to HTTP Basic authentication
- Disabling remember-me functionality for all users
- Using BCrypt with a cost factor of 4 for faster password validation
Correct answer: Configuring account lockout or rate limiting on the authentication endpoint
Account lockout or rate limiting throttles repeated failed login attempts, directly reducing brute-force attack effectiveness.
Spring Framework Risk Assessment & Management 2
Which Spring Security feature helps mitigate the risk of session fixation attacks?