Advanced Spring Boot test (Advanced)

Sample questions

5 sample questions from the Advanced Spring Boot test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which approach correctly enables method-level security in Spring Security 6 with an authorization check for the 'read' scope?

   1. Use @EnableResourceServer and configure via OAuth2ResourceServerConfigurer
   2. Use @EnableMethodSecurity and @PreAuthorize("hasAuthority('SCOPE_read')")
   3. Use @EnableWebSecurity and configure via WebSecurityConfigurerAdapter
   4. Use @EnableGlobalMethodSecurity and @Secured("SCOPE_read")

   Answer: B. Use @EnableMethodSecurity and @PreAuthorize("hasAuthority('SCOPE_read')")

   In Spring Security 6, method-level security is enabled using @EnableMethodSecurity and secured with @PreAuthorize. The other options are either incorrect or relate to different aspects of Spring Security (e.g., CSRF protection, OAuth2 resource server configuration).

2. Which of the following is a key concept in advanced Spring Boot development that allows developers to conditionally enable or disable configurations based on the presence of specific classes or properties?

   1. OAuth2 Resource Server
   2. Custom auto-configuration
   3. WebFlux benefits
   4. JWT token validation

   Answer: B. Custom auto-configuration

   Custom auto-configuration in Spring Boot involves creating a configuration class annotated with @Configuration and @ConditionalOnClass, allowing developers to conditionally enable or disable configurations based on the presence of specific classes or properties. This is a core concept in advanced Spring Boot development.

3. What is a common mistake when validating a JWT token with Spring Security that could lead to an insecure validation process?

   1. The JWT token is not properly validated because the expected issuer is not set in the JwtDecoder configuration.
   2. The JWT token is not validated because the algorithm used is not supported by Spring Security.
   3. The JWT token is not validated because the token's expiration time is not set.
   4. The JWT token is not validated because the signature key is missing from the application's configuration.

   Answer: A. The JWT token is not properly validated because the expected issuer is not set in the JwtDecoder configuration.

   When validating a JWT token in Spring Security, it is crucial to configure the JwtDecoder with the expected issuer. If the issuer is not set, the token may be accepted even if it was issued by a different party, leading to a security vulnerability. The other options are either irrelevant or do not directly address the validation process.

4. In a Spring Security project, how is the order of filters in the filter chain determined?

   1. The filter chain order is defined by the order in which the filters are added to the SecurityFilterChain, with earlier filters executed first.
   2. The filter chain order is determined automatically by Spring Security based on the type of filter.
   3. The filter chain order is not important and can be changed without affecting the application's security.
   4. Filters are executed in reverse order of their registration in the SecurityFilterChain.

   Answer: A. The filter chain order is defined by the order in which the filters are added to the SecurityFilterChain, with earlier filters executed first.

   In Spring Security, the order of filters in the filter chain is determined by the order in which they are added to the SecurityFilterChain. Earlier filters are executed first, and this order is crucial for ensuring that authentication and authorization are applied correctly in a realistic project scenario. Other options may misrepresent the actual behavior or include incorrect statements about the filter chain order.

5. Which statement accurately describes how JWT tokens are signed using the RS256 algorithm?

   1. RS256 signing is primarily used for encrypting JWT payloads rather than signing them.
   2. RS256 signing uses symmetric keys for JWT token generation and validation.
   3. RS256 signing uses a public/private key pair for secure JWT token generation and validation.
   4. RS256 signing does not require any key pairs for JWT token generation and validation.

   Answer: C. RS256 signing uses a public/private key pair for secure JWT token generation and validation.

   RS256 is a digital signature algorithm that uses a public/private key pair, ensuring the JWT is signed by the private key and can be validated by the public key. This provides stronger security and is commonly used in production environments. Other options incorrectly describe the RS256 algorithm or its purpose.