Revise: Spring Boot Internals & Spring Security (5–8 Years Tier)

How to use this revision

This page condenses every question from the 5 to 8 Years course in these areas into a single line: the question, linked to its full answer, and the one-sentence answer you should be able to give instantly. Read down the list and answer each question aloud before reading the line. Wherever you hesitate, follow the link and revise the full answer — interviewers at your level expect these basics to be fluent, and they often open with them before going deeper.

Advanced Spring Boot

Logging, Configuration & Actuator (Advanced) — Interview Questions — open the lesson

• How do you do logging in Spring Boot? — Spring Boot ships spring-boot-starter-logging: SLF4J as the API, and Logback as the default implementation. Out of the box, it logs to the console with a sensible pattern at INFO level.
• What is SLF4J? — SLF4J (Simple Logging Facade for Java) is a logging API (a facade), not a logging engine. Your code calls org.slf4j.Logger, and a binding chosen at deployment time does the actual output: Logback, Log4j2, or java.util.logging.
• Why is SLF4J described as "a single API, with the implementation chosen at deployment"? (Security-course variant) — The compile-time dependency is only slf4j-api. What prints the logs is decided by which provider jar is on the classpath at runtime.
• If you switch from Logback to Log4j2, what changes in the code? — None in the Java code, if you log through SLF4J. You only change the build and the configuration — <dependency> <groupId>org.springframework.boot</groupId>
• What are the benefits and considerations of externalised configuration? — Benefits: one artifact, many environments. The same jar or image is promoted from dev to QA to prod, with only the configuration changing. That follows the 12-factor principle of keeping configuration in the environment. It also lets you tweak behaviour without a rebuild…
• What is the order of precedence in Spring Boot configuration? — Later sources override earlier ones. From lowest to highest precedence (a simplified version of the official list): Default properties (SpringApplication.setDefaultProperties); @PropertySource on @Configuration classes; Config data files, in this order:…
• Can you use both application.yml and application.properties? How are they prioritised? — Yes. Boot loads both and merges them. If the same key is in both in the same location, .properties wins over .yml.
• You're migrating an application from properties files to YAML. What are the steps and considerations? — Convert each file (application.properties to application.yml, application-prod.properties to application-prod.yml), turning dotted keys into nested maps. An IDE or a converter tool helps; Watch the YAML pitfalls: Indentation is significant; Multi-document files: you…
• How do you customise Actuator endpoints? — Exposure: Over HTTP, only health is exposed by default; Paths and ports: management.endpoints.web.base-path=/manage; Security: protect everything except health and info with Spring Security (an EndpointRequest matcher), and sanitise env and configprops values…
• How can Actuator be used for application monitoring and management? — Health: /health and its liveness/readiness groups drive load balancer and Kubernetes probes. Database, disk, broker and custom indicators decide whether the instance takes traffic; Metrics: /metrics and /prometheus, backed by Micrometer. JVM, HTTP…

Transactions, Multiple Datasources & Query Tuning — Interview Questions — open the lesson

• What mechanisms does Spring Boot provide for transaction management? — Spring's PlatformTransactionManager abstraction (JpaTransactionManager, DataSourceTransactionManager, JtaTransactionManager, and the reactive ReactiveTransactionManager), used in two ways: Declarative: @Transactional on methods or classes. An AOP proxy begins the…
• Can transaction management be managed externally, or must it be inside the application? — Both are possible: Local, application-managed transactions (a single resource, handled by Spring's JpaTransactionManager) are the norm, and the fastest; Externally coordinated transactions use JTA/XA: a transaction manager (Atomikos, Narayana, or an application server's)…
• You're designing an e-commerce application that needs precise control over transactions. What approach would you take? — Keep the transaction boundaries at the service layer, and small: one business operation, one transaction; Use declarative @Transactional for most methods, and programmatic TransactionTemplate where one method needs several independent commits; Never hold a database…
• How do you configure and connect to multiple databases in Spring Boot? — Define one set of beans per database: DataSource, LocalContainerEntityManagerFactoryBean and PlatformTransactionManager (or a JdbcTemplate); Mark one set @Primary, so auto-wiring without a qualifier works; Point each set at its own repository and entity packages…
• How do you achieve multiple database connections? (The short version) — Separate configuration classes, each producing its own DataSource, EntityManagerFactory and TransactionManager; @Primary on the default; @Qualifier at injection points; and separate repository packages bound through @EnableJpaRepositories.
• You need to migrate an application to a new database schema with no downtime. How would you plan it? — Use expand/contract (parallel change), with versioned migrations (Flyway or Liquibase), and backward-compatible steps, so that the old and new versions of the application can run at the same time during a rolling deployment.
• You have a complex query that runs slowly. How would you optimise it? — Measure first, then fix the biggest cost.

Validation & REST API Design (Advanced) — Interview Questions — open the lesson

• How does Spring Boot support data validation? — Add spring-boot-starter-validation. That brings Hibernate Validator, the reference implementation of Jakarta Bean Validation 3.x (jakarta.validation.* in Boot 3; it was javax.validation in Boot 2). Then: Annotate DTO fields (@NotBlank, @Email, @Size, @Positive,…
• How do you handle form validation in Spring Boot applications? — Server-rendered forms (Thymeleaf or MVC): use @Valid @ModelAttribute("form") Form form, BindingResult result. BindingResult must come immediately after the validated parameter. If result.hasErrors(), return the form view, which renders field errors with th:errors;…
• Can you use custom validators? How? — Yes, in two ways: A custom constraint annotation (preferred, and reusable): an annotation with @Constraint(validatedBy = …), plus a ConstraintValidator<A, T>. Validators are Spring beans, so they can inject repositories or services; Spring's…
• How do you implement complex validation rules involving several fields? — Use a class-level constraint: an annotation on the DTO, and a ConstraintValidator that receives the whole object.
• Can you integrate third-party libraries for validation? How? — Yes: Other Jakarta Validation providers or constraint libraries: add the dependency, and their annotations work with @Valid/@Validated, since they plug into the same Validator. For example, Hibernate Validator's extra constraints (@URL, @CreditCardNumber, @UUID),…
• How do you keep validation rules consistent across many forms? — Define each rule once, as a reusable custom or composed constraint (@ValidPhone, @ValidPincode built from @Pattern plus @Size), and reuse it on every DTO; Share the DTOs, or at least the constraint annotations, in a common module; Centralise the messages in…
• What does @RequestBody do? — It binds the HTTP request body to a method parameter, through an HttpMessageConverter chosen by the Content-Type: Jackson for JSON, or JAXB/Jackson XML.
• What's the difference between returning a ResponseEntity and returning an object directly? — Returning an object: Spring serialises it with status 200 (or the status given by @ResponseStatus). It's simple, and good for the standard path; ResponseEntity<T>: full control of the status, headers and body per call. For example: 201 Created with a Location header.
• What are the HTTP methods? — GET: read; POST: create, or process; PUT: replace, or create at a known URI; PATCH: partial update; …
• When should you use each HTTP method in a REST API? — GET /products?category=x&page=2: retrieval, with filters and pagination. It's cacheable, and must have no side effects; POST /products: create, where the server assigns the ID. Returns 201 with Location. Also used for actions that don't map to CRUD (`POST…
• You're designing new REST endpoints for a complex product inventory system. Which best practices would you follow for scalability, maintainability and performance? — Resource modelling: Nouns and hierarchy (/warehouses/{id}/stock), with consistent naming; Scalability: Stateless services, horizontally scaled; Performance: Caching: ETag/Cache-Control for catalogue reads, and Redis for hot data; Correctness under concurrency:…

Reactive, Async & Scheduling in Spring Boot — Interview Questions — open the lesson

• Describe a scenario where you'd use asynchronous messaging in Spring Boot. — Order placement in e-commerce. The checkout API validates and saves the order, then publishes an OrderPlaced event to Kafka or RabbitMQ, and immediately returns 201/202 to the user.
• What support does Spring Boot have for reactive programming? — Spring WebFlux (spring-boot-starter-webflux) is a non-blocking web stack, running on Netty by default, built on Project Reactor: Mono<T> carries 0 or 1 item, and Flux<T> carries 0..N items. Both are Reactive Streams publishers; Annotated controllers, or functional…
• How is back-pressure handled in reactive streams? — Reactive Streams is a pull-based contract. A subscriber calls Subscription.request(n) to say how many items it can take, and the publisher must not emit more than was requested.
• You need a highly scalable real-time data processing application. How would you use Spring Boot's reactive features? — Build a streaming pipeline from source to sink: Ingest: consume from Kafka with Reactor Kafka, or Spring Cloud Stream reactive functions (Function<Flux<In>, Flux<Out>>), or accept WebSocket or RSocket streams; Process non-blockingly: Parse, filter and enrich, with…
• How does Spring handle scheduling and task execution? — Scheduling: add @EnableScheduling, then @Scheduled methods: fixedRate: start every N, regardless of the previous run; Async execution: add @EnableAsync. Methods marked @Async run on a TaskExecutor, returning void or CompletableFuture<T>; The underlying…
• You need to process heavy image files asynchronously. How would you set this up? — For quick wins, use @Async with a dedicated, bounded executor. For robustness, use a queue-backed job: Upload: stream the file to object storage (S3 or GCS), not into memory. Create a ImageJob(PENDING) row, and return 202 Accepted with /jobs/{id}, or notify later…

Deployment, High Availability, Scaling & Caching — Interview Questions — open the lesson

• How would you ensure high availability for a Spring Boot e-commerce application at peak times? — Redundancy everywhere: ≥ 2 instances per service, spread across availability zones, behind a load balancer; Elasticity: Stateless application instances: sessions in Redis, or JWTs; Protect the core: Caching (CDN for static and catalogue content, Redis for hot data);…
• Your application suddenly needs to handle twice the load it was designed for. What would you do immediately? — Look before you act: find the saturated resource (CPU, the database connection pool, a slow dependency, GC or memory, threads) from metrics and traces; Scale out the stateless tier: more instances behind the load balancer. It only helps if the bottleneck isn't downstream;…
• What are the ways to deploy a Spring Boot application? — An executable fat JAR with an embedded server: java -jar app.jar, run as a systemd service, or on a PaaS (Render, Heroku-style, Elastic Beanstalk, Azure App Service, Cloud Run); A WAR deployed to an external servlet container (Tomcat, Jetty, or an application server);…
• How does Spring Boot simplify deployment compared with traditional Spring applications? — Traditional Spring meant building a WAR, then installing, configuring and tuning an external server per environment, often with server-specific datasources and JNDI. Boot produces one self-contained executable JAR: embedded server, dependencies and configuration defaults…
• What's the difference between embedded and external application-server deployment? — Embedded: the server (Tomcat, Jetty, Undertow or Netty) is a library inside your application. The application starts the server: one application per process, and the server version is pinned in your build; External: you build a WAR. The server starts your application (through…
• What are the pros and cons of an embedded server? — Pros: Simple, self-contained deployment; Cons: Each application carries its own server: more memory than several applications sharing one server, though that matters less with containers.
• You need to move an application from embedded Tomcat to an external Tomcat. What steps would you follow? — Packaging: <packaging>war</packaging>, or the Gradle war plugin; Mark the embedded Tomcat as provided, so it's not bundled but is still available at compile time and for java -jar in development:.
• Your application is read-heavy and needs efficient caching. Which caching solutions would you consider? — Layer the caches: HTTP and CDN caching for public, cacheable responses (Cache-Control, ETag): catalogue pages, images; A local in-process cache: Caffeine. Nanosecond access, size- and time-bounded. Good for reference data (categories, configuration, exchange rates), where…
• What are the disadvantages of Spring Boot's default caching? — Without a cache library on the classpath, Boot uses ConcurrentMapCacheManager: a plain ConcurrentHashMap per cache. It has: no TTL or expiry; no size limit or eviction, so it grows until an OutOfMemoryError; no statistics; no sharing between instances: each node has its…
• You're moving the application to Docker. What changes would you make to the deployment process? — Build the image reproducibly: A multi-stage Dockerfile, or buildpacks (spring-boot:build-image); Make the application container-friendly: Configuration through environment variables and secrets, with no environment-specific images; CI/CD: Build, scan the image (Trivy or…

Custom Starters, DI, Testing & DevTools — Interview Questions — open the lesson

• How do you create a custom Spring Boot starter, and why is it useful? — A starter packages dependencies + auto-configuration + defaults, so any team adds one dependency and gets a correctly configured feature. The convention is two modules: acme-audit-spring-boot-autoconfigure: the @AutoConfiguration classes, @ConfigurationProperties, and…
• Your project needs to integrate a third-party library. How would you make a starter for it? — Create the autoconfigure and starter modules, with the library as a dependency (optional in the autoconfigure module); Expose the library's settings as typed @ConfigurationProperties with safe defaults; Define its client beans in an @AutoConfiguration, guarded by:…
• Name some common Spring Boot starters. — Web: spring-boot-starter-web (MVC + Tomcat), -webflux (Reactor + Netty); Data: -data-jpa, -jdbc, -data-mongodb, -data-redis; Security: -security, -oauth2-resource-server, -oauth2-client; Validation and operations: -validation, -actuator; …
• What are the alternatives to @Autowired? — Constructor injection (recommended): a single constructor needs no annotation, since Spring 4.3. Dependencies are final, the object is fully initialised, it's easy to test with new, and circular dependencies are exposed; Setter injection: for optional dependencies, or…
• What's the difference between @Mock and @MockBean (@MockitoBean)? — @Mock (Mockito): creates a mock in a plain unit test, with no Spring context. It's injected with @InjectMocks, or manually. It's fast; @MockBean: replaces or adds a bean inside the Spring ApplicationContext for slice or integration tests (@WebMvcTest,…
• What's the difference between JUnit 4 and JUnit 5, and why choose one? — Architecture: JUnit 5 is Platform (the launcher) + Jupiter (the new API) + Vintage (runs JUnit 4 tests); Extensibility: JUnit 4 had @RunWith and @Rule. JUnit 5 has one extension model (@ExtendWith), and several extensions can compose; Features: @ParameterizedTest with…
• How would you use the test lifecycle annotations in a practical test? — @BeforeAll: expensive, shared, read-only setup, once per class. It's static unless you use @TestInstance(PER_CLASS). For example, start a Testcontainers database, or load reference data; @BeforeEach: fresh state per test: new objects, reset mocks, insert test data. That…
• How do you write unit tests for Spring Boot controllers? — Use @WebMvcTest(ProductController.class). It loads only the MVC slice: the controller, the advice, converters, filters and security.
• How would you set up integration tests for an application that calls an external API? — Test your real HTTP client code against a fake server, rather than mocking the client bean away (which the source suggests, and which skips serialisation, headers, timeouts and error mapping): WireMock (or MockWebServer): run a stub HTTP server, point the client's base URL at…
• What should you consider about DevTools in production? — Don't ship it.
• How does DevTools help when you're making frequent changes and need immediate feedback? — Automatic restart: when classes change (on IDE build), the application restarts quickly using two classloaders. Third-party jars stay loaded, and only your code reloads. That takes seconds, instead of a full cold start; LiveReload: refreshes the browser for template and…

Spring Security for APIs

Securing REST APIs End to End — Interview Questions — open the lesson

• How would you secure a REST API? Give all the methods, step by step. — Transport: HTTPS/TLS 1.2+ everywhere, with HSTS; Authentication: OAuth2/OIDC: users log in at an identity provider, and the API validates access tokens (JWTs) as a resource server; Authorisation: Deny by default; Input and output: Validate every input (Bean Validation), limit…
• What options are there for securing a REST API in Spring Boot? — Spring Security (spring-boot-starter-security) supports: HTTP Basic: simple, for internal tools or behind a gateway, and only over TLS; Session or form login: for server-rendered applications; OAuth2 resource server with JWTs (spring-boot-starter-oauth2-resource-server):…
• What's inside a JWT? — A JWT is three Base64URL parts separated by dots: header.payload.signature.
• How do you implement authentication and authorisation in Spring Boot? — Add spring-boot-starter-security. Then define: authentication: where identities come from (a UserDetailsService backed by a database, LDAP, or an OAuth2/OIDC provider); authorisation: which requests or methods need which authorities.
• How do you implement authentication and authorisation in Spring Boot? (The Spring Boot course variant) — The same foundation as Q4, stated as the steps an interviewer expects: Add the security starter. Everything is now secured, with a generated default user, which is for development only; Provide a UserDetailsService (a JPA-backed user table), plus a PasswordEncoder (BCrypt…
• You're designing a secure REST API for a banking application. Which security practices would you implement? — Everything from Q1, raised to regulated-industry level: Identity: OAuth2/OIDC with MFA and step-up authentication for sensitive actions (adding a payee, large transfers); Authorisation: Strict object-level checks (account ownership) on every call; Transactions: Idempotency…
• How do you secure service-to-service communication? — Identity for services: use the OAuth2 client-credentials grant. Each service gets its own client, and requests tokens with an audience and scopes for the target service. The target validates them as a resource server; Or propagate the user's context, through token exchange…
• What's the difference between method security and URL security? — URL (request) security: configured in the SecurityFilterChain (authorizeHttpRequests). It's enforced by the AuthorizationFilter, before the request reaches the controller, based on the path, the HTTP method and the authorities. It's coarse-grained, central and cheap.…
• What are Spring Security's core classes? Does it differ between Spring MVC and Spring Boot? Is there a starter? — The core building blocks, in Spring Security 6: SecurityFilterChain (a bean) and HttpSecurity: configure the ordered filter chain. The DelegatingFilterProxy/FilterChainProxy connect it to the servlet container; AuthenticationManager (usually ProviderManager) and…
• Your application needs stateless authentication for REST services. How would you implement JWT authentication with Spring Security? Describe the flow from login to accessing protected resources. — The preferred design delegates token issuing to an authorization server (Keycloak, Okta, or Spring Authorization Server), and makes your API a resource server. If the API must issue tokens itself, the flow is: Login: the client POSTs its credentials to /auth/login over…

Follow-up questions this topic invites — and their answers

Q: How should I use this list in the last week before an interview? A: Do one pass per day. Cover the answer text, say your answer out loud, then check it. Mark every question you could not answer crisply, and spend your study time only on the marked ones by opening the linked full answer. By the third pass the marked list should be short.

Q: The interviewer asks one of these basics — should I give only the one-liner? A: Lead with the one-liner, then add one concrete detail or example from your own work. At this level the follow-up usually probes the mechanism behind the basic answer, so be ready to go one layer deeper using the key points in the full lesson.

Q: Some answers here were corrected compared with common prep sheets — why? A: Several widely shared answers are outdated or wrong (for example, Java version details, removed Spring APIs, or SQL queries that miss edge cases). The full lessons call these out under "Common trap" — reading those is the fastest way to stand out from candidates who memorised the same sheets.