Spring Security Expert Assessment

Q: What is this java-spring-boot mock test?

This is a comprehensive java-spring-boot mock test with 25 questions covering Security Architecture, Authentication, JWT. It simulates real technical interviews with timed conditions and provides detailed explanations.

Q: How long does the test take?

The test has a time limit of 90 minutes. You can pause and resume, but we recommend completing it in one sitting.

Q: Will I get feedback on my answers?

Yes! After each question, you receive immediate feedback with detailed explanations. At the end, you get a comprehensive report showing your strengths and areas for improvement.

Q: Is this test suitable for FAANG interview preparation?

Absolutely! Our questions are curated by FAANG interviewers and cover the exact topics and difficulty levels you'll encounter in top tech company interviews.

Question 1

What is the correct order of filters in Spring Security's default filter chain?

Answer

UsernamePasswordAuthenticationFilter → BasicAuthenticationFilter → ExceptionTranslationFilter → AuthorizationFilter

Question 2

Which interface must you implement to create a custom authentication mechanism in Spring Security?

Answer

AuthenticationProvider

Question 3

What is the difference between UserDetailsService and AuthenticationProvider?

Answer

UserDetailsService loads user data by username; AuthenticationProvider performs actual authentication logic (password verification, etc.)

Question 4

How do you configure Spring Security to use a custom password encoder that wraps BCrypt with a pe...

Answer

Implement PasswordEncoder interface and combine BCrypt with pepper (secret added to password before hashing)

Question 5

What is the purpose of SecurityContextHolder in Spring Security?

Answer

To hold the current security context (Authentication object) for the current thread

Question 6

How do you propagate SecurityContext to child threads in async processing?

Answer

Use @Async with DelegatingSecurityContextRunnable or SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL)

Question 7

What is the correct way to implement stateless JWT authentication in Spring Security?

Answer

Configure session management as STATELESS and add custom JwtAuthenticationFilter before UsernamePasswordAuthenticationFilter

Question 8

How do you handle JWT revocation (logout) in a stateless architecture?

Answer

Maintain a denylist (blacklist) of revoked JWTs in Redis until token expiration

Question 9

What does @PreAuthorize("hasPermission(#id, 'document', 'read')") do?

Answer

It uses a custom PermissionEvaluator to check permission on a domain object

Question 10

How do you enable method-level security with @PreAuthorize in Spring Security?

Answer

Add @EnableGlobalMethodSecurity(prePostEnabled = true) (pre Spring Security 6) or @EnableMethodSecurity (Spring Security 6+)

Spring Security Expert Assessment

Difficulty

Topics Covered

What You'll Get