Skip to main content

Spring Boot Tricky Interview Questions & Answers

This guide covers real-world, challenging Spring Boot interview questions. It focuses on application configuration, security (JWT, OAuth), resilience in microservices, and testing strategies.

1. Spring Boot Core & Configuration​

Q: Can we create a non-web application in Spring Boot?​

A: Yes, Spring Boot is not exclusively for web projects. You can use it to build standalone applications for running background scripts, batch jobs, or processing data. If you do not include web dependencies (like spring-boot-starter-web) in your project, Spring Boot will not start an embedded web server. Instead, you can implement interfaces like CommandLineRunner or ApplicationRunner to execute your logic immediately after the application context loads.

Q: What does the @SpringBootApplication annotation do internally?​

A: @SpringBootApplication is a convenience "shortcut" annotation that combines three highly important annotations:

  1. @Configuration: Tells Spring that the class contains bean definitions and configurations.
  2. @EnableAutoConfiguration: Instructs Spring Boot to automatically set up and configure beans based on the dependencies present in your classpath.
  3. @ComponentScan: Tells Spring to scan the current package and its sub-packages for other components, services, and configurations to register them in the Application Context.

Q: How does Spring Boot support internationalization (i18n)?​

A: Spring Boot supports internationalization by externalizing text messages into properties files. You place these files in the src/main/resources directory using a specific naming convention, such as messages_en.properties (for English) or messages_fr.properties (for French). Spring Boot uses a LocaleResolver to determine the user's locale (often based on the Accept-Language HTTP header) and dynamically fetches the corresponding translations, making the app user-friendly globally.

Q: What is Spring Boot DevTools used for?​

A: Spring Boot DevTools is a dependency designed to make the development process faster and smoother. Its key features include:

  • Automatic Restarts: It monitors classpath files and automatically restarts the application when code changes are detected.
  • LiveReload: It automatically refreshes the web browser when static resources (like HTML/CSS) change.
  • Disabling Caching: It disables template caching (like Thymeleaf) during development so UI changes are visible immediately.

2. Testing & Deployment​

Q: How can you mock external services in a Spring Boot test?​

A: You can use the @MockBean annotation. This annotation creates a mock version of a service or repository and injects it directly into the Spring Application Context, replacing the actual real bean. You then use a mocking framework like Mockito to dictate how this mock should behave (e.g., when(mockService.getData()).thenReturn(mockData)). This makes integration tests faster and reliable since they don't depend on external systems being online.

Q: How do you mock microservices during testing?​

A: To mock entire external microservices, you can use tools like WireMock. WireMock spins up a dummy HTTP server that mimics the behavior of the real microservice. You configure it to return specific JSON responses when your application hits certain HTTP endpoints. This thoroughly tests your REST clients (like WebClient or RestTemplate) without needing the actual downstream services to be running.

Q: Explain the process of creating a Docker image for a Spring Boot application.​

A: 1. Create a Dockerfile: In the root of your project, write a Dockerfile. 2. Define the Base Image: Specify the Java runtime environment (e.g., FROM eclipse-temurin:17-jdk-alpine). 3. Copy the Artifact: Copy the compiled Spring Boot .jar file from your target/build folder into the Docker image (COPY target/myapp.jar app.jar). 4. Specify the Entrypoint: Tell Docker how to run the application (ENTRYPOINT ["java", "-jar", "/app.jar"]). 5. Build the Image: Run the command docker build -t my-spring-app . in your terminal to package the application.

3. Security (Spring Security & JWT)​

Q: Discuss the configuration of Spring Security to address common security concerns.​

A: To secure a Spring Boot app, I would configure:

  • Authentication: Verify user identities using an authentication provider (database-backed form login, OAuth2, or JWT).
  • Authorization: Use Role-Based Access Control (RBAC) with annotations like @PreAuthorize to restrict endpoint access based on user roles.
  • HTTPS/TLS: Enforce secure, encrypted communication over the network.
  • CSRF Protection: Leave Cross-Site Request Forgery (CSRF) protection enabled (which is default in Spring Security) for browser-based clients.
  • Password Hashing: Store passwords securely in the database using strong, salted hashing algorithms like BCryptPasswordEncoder.

Q: Discuss how you would secure a Spring Boot application using JSON Web Tokens (JWT).​

A: 1. Login: When a user logs in with valid credentials, the server generates a JWT containing the user's details (claims) and signs it using a secret key. 2. Token Transmission: The server returns this JWT to the client. 3. Subsequent Requests: The client includes the JWT in the Authorization HTTP header (as a Bearer token) for all subsequent requests. 4. Validation: A custom Spring Security Filter intercepts incoming requests, verifies the JWT's signature and expiration, and extracts the user's authorities. Benefit: This makes the application strictly stateless, reducing database hits and memory usage, which is highly scalable for microservices.

Q: You need to ensure that only authenticated users can access certain endpoints. Describe how you would configure Spring Security to set up basic form-based authentication.​

A: 1. Add the spring-boot-starter-security dependency. 2. Create a configuration class annotated with @Configuration and @EnableWebSecurity. 3. Define a SecurityFilterChain bean. 4. Use the AuthorizeHttpRequests customizer to declare which paths require authentication (e.g., .requestMatchers("/admin/**").authenticated()) and which are public. 5. Chain .formLogin() to enable the default Spring Security login form. 6. Provide a UserDetailsService bean to fetch users from a database to validate credentials.

4. Microservices, Resilience & Async Processing​

Q: How can a Spring Boot application be made more resilient to failures, especially in a microservices architecture?​

A: You make it resilient by implementing fault-tolerance patterns using libraries like Resilience4j:

  • Circuit Breakers: Monitor downstream calls. If a service fails repeatedly, the circuit "opens" and immediately rejects further calls, preventing cascading system failures.
  • Retries: Automatically retry failed network calls that might be caused by temporary glitches.
  • Timeouts: Ensure HTTP clients don't wait indefinitely for unresponsive services.
  • Fallbacks: Provide alternative methods or cached data to return to the user if the primary service is down.

Q: Explain the conversion of business logic into serverless functions with Spring Cloud Function.​

A: Spring Cloud Function allows you to write standard business logic using core Java functional interfaces (Supplier, Function, Consumer). The framework completely abstracts away the underlying cloud infrastructure. This means you can write a simple Java Function, and deploy it seamlessly as an AWS Lambda, Azure Function, or Google Cloud Function without modifying the code or dealing with server provisioning.

Q: How can Spring Cloud Gateway be configured for routing, security, and monitoring?​

A: * Routing: Routes are defined in application.yml or via Java configuration, matching incoming request predicates (paths, headers) and forwarding them to specific microservice URIs.

  • Security: Integrate Spring Security (often as an OAuth2 Resource Server) directly at the Gateway level to authenticate tokens before requests ever reach the internal microservices.
  • Monitoring: Enable Spring Boot Actuator on the Gateway to expose health metrics, route details, and network traffic statistics.

Q: Your application needs to process notifications asynchronously using a message queue. Explain how you would set up the integration.​

A: 1. Add dependencies for the message broker, such as spring-boot-starter-amqp (for RabbitMQ) or spring-kafka. 2. Define the broker connection properties (URL, port, credentials) in application.yml. 3. Create configuration beans to define the Queues, Exchanges, and Topics. 4. Autowire the RabbitTemplate or KafkaTemplate into your service. 5. Use the template.send() or template.convertAndSend() method, passing the destination queue and the notification payload to dispatch the message asynchronously.

Q: How would you manage and monitor asynchronous tasks inside a Spring Boot application to track progress and handle failures?​

A: 1. Execution: Use the @Async annotation on methods to run them in background threads. 2. Tracking: Have the @Async method return a CompletableFuture<T>. This allows the calling thread to attach callbacks to handle success results or catch exceptions (.exceptionally()). 3. Thread Management: Configure a custom ThreadPoolTaskExecutor bean to control the core pool size, max pool size, and queue capacity to prevent memory exhaustion. 4. Monitoring: Integrate Spring Boot Actuator and Micrometer to actively monitor the health and usage metrics of the custom thread pool.