Spring Framework Risk Assessment & Management 4

Question 1

Which risk does relying solely on client-side validation introduce in a Spring MVC application?

Accepted Answer

Malicious clients can bypass client-side checks and send invalid or harmful data to the server

Answer

Client-side validation can be bypassed with tools like curl or Burp Suite, so server-side @Valid/@Validated constraints are essential for real enforcement.

Question 2

What risk does using @CrossOrigin(origins="*") on all Spring REST controllers introduce?

Accepted Answer

Any website can make authenticated cross-origin requests to the API using the user's credentials

Answer

A wildcard CORS policy allows any origin to call the API, potentially enabling cross-site request forgery or data exfiltration from authenticated sessions.

Question 3

In Spring Batch, what is a key risk of not configuring a job restart policy for long-running jobs?

Accepted Answer

A failed job may reprocess already-completed items, causing duplicate data or transactions

Answer

Without proper restart strategy, Spring Batch may re-run completed steps from the beginning, leading to duplicate writes or inconsistent state.

Question 4

Which risk is introduced when Spring's @Async methods are configured without a custom executor?

Accepted Answer

The default SimpleAsyncTaskExecutor creates an unbounded number of threads, risking thread exhaustion

Answer

SimpleAsyncTaskExecutor spawns a new thread per task with no pool limit, so a traffic spike can exhaust server threads and cause an OutOfMemoryError.

Question 5

Which Spring Security feature directly reduces the risk of clickjacking attacks?

Accepted Answer

Configuring X-Frame-Options or Content-Security-Policy frame-ancestors via headers

Answer

X-Frame-Options: DENY or CSP frame-ancestors 'none' prevents the page from being embedded in iframes used by clickjacking attacks.

Spring Framework Practice Test

Spring Framework Practice Test

Spring Framework Risk Assessment & Management 4