Spring Framework Risk Assessment & Management 2

Question 1

Which Spring Security feature helps mitigate the risk of session fixation attacks?

Accepted Answer

Invalidating and regenerating the session ID upon successful authentication

Answer

Spring Security migrates the session (creates a new session ID) on login by default to prevent session fixation attacks.

Question 2

When assessing risk in a Spring Boot application, which actuator endpoint poses the highest security risk if exposed publicly?

Accepted Answer

/actuator/env

Answer

The /actuator/env endpoint can expose sensitive configuration values, environment variables, and secrets, making it the highest-risk endpoint.

Question 3

Which Spring property reduces the risk of exposing sensitive actuator endpoints in production?

Accepted Answer

management.endpoints.web.exposure.include=health,info

Answer

Restricting the exposed actuator endpoints to only health and info minimizes the attack surface in production environments.

Question 4

In Spring Data JPA, which practice best mitigates the risk of SQL injection?

Accepted Answer

Using JPQL named parameters or Spring Data query methods

Answer

JPQL named parameters and derived query methods use parameterized queries internally, preventing SQL injection.

Question 5

Which risk does enabling Spring Boot's H2 console in production introduce?

Accepted Answer

Unauthenticated access to the database via a web interface

Answer

The H2 console provides a full database web interface that, if left unsecured, allows anyone to query or modify the database.

Spring Framework Practice Test