Spring Framework Risk Assessment & Management 3

Question 1

Which approach best mitigates the risk of mass assignment vulnerabilities in a Spring MVC REST API?

Accepted Answer

Using DTOs instead of binding request bodies directly to JPA entities

Answer

DTOs expose only the fields the API intends to accept, preventing clients from overwriting fields like 'isAdmin' or 'id' on JPA entities.

Question 2

In Spring Security, what risk does permitting all requests to /api/** before securing sensitive sub-paths introduce?

Accepted Answer

Spring Security rules are evaluated in order, so the permitting rule may override later restrictive rules

Answer

Spring Security's HttpSecurity rules are applied in declaration order, so a broad permit rule declared first will match before any narrower deny rules below it.

Question 3

Which risk is introduced when Spring beans are made prototype-scoped inside a singleton-scoped bean without special handling?

Accepted Answer

The prototype bean is created once and reused, defeating the intent of prototype scope

Answer

A singleton injects the prototype bean once at construction time, so every call uses the same instance, undermining prototype semantics.

Question 4

What is the primary security risk of enabling Spring Boot DevTools in a production deployment?

Accepted Answer

DevTools enables remote restart and live reload, which can expose the application to code injection

Answer

Spring Boot DevTools includes a remote restart server that, if accessible, allows arbitrary code execution on the production server.

Question 5

Which risk is associated with using @Cacheable without specifying a cache eviction policy in Spring?

Accepted Answer

Unbounded cache growth leading to out-of-memory errors over time

Answer

Without eviction settings, the cache grows indefinitely as new keys are added, eventually exhausting heap memory.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Risk Assessment & Management 3