Spring Security auto-configuration in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the default behavior of Spring Security auto-configuration in a new Spring Boot web app?

When you create a new Spring Boot web application and include Spring Security starter, what does the auto-configuration do by default?

A It disables security and allows all requests without authentication.

B It requires manual configuration to enable any security features.

C It secures only POST requests and allows GET requests without authentication.

D It secures all HTTP endpoints with basic authentication requiring a generated password.

💡 Hint

Think about what Spring Security does out of the box to protect your app.

By default, Spring Security auto-configuration secures all HTTP endpoints with basic authentication. It generates a default password printed in the console.

📝 Syntax

intermediate

Which code snippet correctly disables Spring Security auto-configuration in a Spring Boot app?

You want to disable Spring Security auto-configuration completely. Which of the following code snippets achieves this?

A @SpringBootApplication(exclude = SecurityAutoConfiguration.class)

B @EnableAutoConfiguration(include = SecurityAutoConfiguration.class)

C @SpringBootApplication(disable = SecurityAutoConfiguration.class)

D @EnableSecurityAutoConfiguration(false)

💡 Hint

Look for the annotation attribute that excludes auto-configuration classes.

Using @SpringBootApplication(exclude = SecurityAutoConfiguration.class) disables Spring Security auto-configuration.

❓ state_output

advanced

What is the value of the default generated password printed by Spring Security auto-configuration?

When Spring Security auto-configures your app, it prints a default password in the console. What is the format of this password?

A A random UUID string generated at startup.

B The fixed string 'password' for all apps by default.

C An empty string, meaning no password is set.

D The username repeated twice as the password.

💡 Hint

Check the console output when you run a Spring Boot app with Spring Security starter.

The default password is a random UUID string generated each time the app starts.

🧠 Conceptual

advanced

Which Spring Boot property disables the default security password generation?

You want to disable the default generated password and allow users to set their own. Which property disables the default password generation?

A spring.security.user.enabled=false

B spring.security.user.generate-password=false

C spring.security.user.password=

D spring.security.user.default-password=false

💡 Hint

Setting this property to an empty value disables the generated password.

Setting spring.security.user.password= disables the default generated password and requires you to set your own password.

❓ lifecycle

expert

In what order does Spring Security auto-configuration apply filters in the filter chain by default?

Spring Security auto-configuration sets up a filter chain for HTTP requests. Which of the following correctly describes the order of these filters?

A ExceptionTranslationFilter → FilterSecurityInterceptor → SecurityContextPersistenceFilter → BasicAuthenticationFilter

B SecurityContextPersistenceFilter → BasicAuthenticationFilter → ExceptionTranslationFilter → FilterSecurityInterceptor

C BasicAuthenticationFilter → SecurityContextPersistenceFilter → FilterSecurityInterceptor → ExceptionTranslationFilter

D FilterSecurityInterceptor → ExceptionTranslationFilter → BasicAuthenticationFilter → SecurityContextPersistenceFilter

💡 Hint

Think about how Spring Security manages context, authentication, exceptions, and authorization.

The correct filter order is: SecurityContextPersistenceFilter loads the security context, then BasicAuthenticationFilter processes login, ExceptionTranslationFilter handles exceptions, and FilterSecurityInterceptor enforces access control.