Spring Boot Developer Interview Questions

Direct Answer

The Spring IoC Container lifecycle involves loading BeanDefinitions, executing BeanFactoryPostProcessors, instantiating beans, injecting dependencies, executing BeanPostProcessors, and performing destruction on shutdown.

Detailed Explanation

import org.springframework.beans.factory.InitializingBean;
import javax.annotation.PostConstruct;

public class CustomBean implements InitializingBean {
    @PostConstruct
    public void postConstruct() {
        System.out.println("1. PostConstruct annotation callback called");
    }

    @Override
    public void afterPropertiesSet() {
        System.out.println("2. InitializingBean interface callback called");
    }
}

Common Interview Pitfalls

• Assuming BeanPostProcessors operate on individual beans before the entire bean factory metadata is loaded.
• Relying on `@PostConstruct` in classes loaded outside Spring context management.

Direct Answer

Spring supports singleton, prototype, request, session, application, and websocket scopes. Injecting a short-lived scoped bean into a singleton requires a scoped proxy to intercept dynamic access.

Detailed Explanation

@Component
@Scope(value = "request", proxyMode = ScopedProxyMode.TARGET_CLASS)
public class UserSessionToken {
    private String token;
    public String getToken() { return token; }
    public void setToken(String token) { this.token = token; }
}

Common Interview Pitfalls

• Injecting prototype beans directly into singleton beans without using a Provider, ObjectFactory, or Scoped Proxy, expecting prototype instances to refresh.
• Expecting prototype beans to execute destruction lifecycle callbacks (Spring does not manage prototype bean destruction).

Direct Answer

BeanFactory provides basic configuration and lazy instantiation of beans. ApplicationContext is a subclass of BeanFactory that adds advanced features like eager loading, AOP integration, events, and i18n.

Detailed Explanation

import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;

public class ContextDemo {
    public static void main(String[] args) {
        // Eagerly instantiates and validates configuration
        ApplicationContext context = new AnnotationConfigApplicationContext(AppConfig.class);
        MyService service = context.getBean(MyService.class);
    }
}

Common Interview Pitfalls

• Using BeanFactory manually in modern Boot enterprise projects unless under severe memory constraints.
• Assuming ApplicationContext lazy-loads all beans by default (it eagerly validates singletons).

Direct Answer

Spring AOP uses JDK Dynamic Proxies for interface-based class proxying, and CGLIB for subclassing-based concrete class proxying. Self-invocation bypasses AOP intercepts.

Detailed Explanation

@Service
public class OrderService {
    @Transactional
    public void processOrder() {
        // Active transaction
    }

    public void checkout() {
        // Self-invocation: transaction aspect bypassed
        processOrder(); 
    }
}

Common Interview Pitfalls

• Calling an internal method annotated with `@Transactional` from a non-transactional method within the same class, expecting a transaction to start.
• Making target methods or classes `final` when using CGLIB proxying (CGLIB cannot subclass final classes or override final methods).

Direct Answer

Constructor injection is preferred because it guarantees immutability, facilitates unit testing with plain mock injections, and prevents circular dependency risks.

Detailed Explanation

@Service
public class PaymentProcessor {
    private final GatewayService gateway;

    // Constructor injection: final fields guaranteed, @Autowired is optional in single constructor classes
    public PaymentProcessor(GatewayService gateway) {
        this.gateway = gateway;
    }
}

Common Interview Pitfalls

• Using field injection and getting NullPointerExceptions in unit tests because Spring container context was not bootstrapped.
• Declaring fields injected by constructors without the `final` keyword, allowing unwanted mutability.

Direct Answer

Spring resolves `@Autowired` dependencies first by type, then by bean name. If multiple matching beans exist without qualifiers, a NoUniqueBeanDefinitionException is thrown.

Detailed Explanation

@Component
public class ClientService {
    @Autowired
    @Qualifier("smtpService") // Disambiguates between multiple EmailService beans
    private EmailService emailService;
}

Common Interview Pitfalls

• Naming a bean variable arbitrarily expecting naming fallback to magically match a different configured bean name.
• Setting `@Autowired(required = false)` and failing to perform null checks before invoking methods on the bean.

Direct Answer

`@Primary` designates a default bean to use when multiple instances match a type. `@Qualifier` provides a specific target name to override default selection.

Detailed Explanation

@Configuration
public class ServiceConfig {
    @Bean
    @Primary // Default choice
    public MessageSender smsSender() { return new SmsSender(); }

    @Bean
    public MessageSender emailSender() { return new EmailSender(); }
}

Common Interview Pitfalls

• Marking multiple bean definitions of the same type with `@Primary`, returning the same NoUniqueBeanDefinitionException conflict.
• Typing the qualifier string argument incorrectly (qualifiers are evaluated as string keys and are not validated at compile time).

Direct Answer

`@PostConstruct` runs initialization logic once dependencies are injected. `@PreDestroy` runs cleanups before the container destroys the bean.

Detailed Explanation

import jakarta.annotation.PostConstruct;
import jakarta.annotation.PreDestroy;
import org.springframework.stereotype.Component;

@Component
public class CacheWarmer {
    @PostConstruct
    public void init() {
        System.out.println("Loading reference tables into memory cache...");
    }

    @PreDestroy
    public void cleanup() {
        System.out.println("Releasing socket connections...");
    }
}

Common Interview Pitfalls

• Trying to access dependency-injected beans inside the constructor instead of a `@PostConstruct` method (dependencies are null in the constructor).
• Declaring a `@PostConstruct` or `@PreDestroy` method with arguments (they must be void and take no parameters).

Direct Answer

`@SpringBootApplication` is a meta-annotation composed of `@SpringBootConfiguration`, `@EnableAutoConfiguration`, and `@ComponentScan`.

Detailed Explanation

@SpringBootApplication // Combines Configuration, AutoConfiguration, and Scan
public class MainApplication {
    public static void main(String[] args) {
        SpringApplication.run(MainApplication.class, args);
    }
}

Common Interview Pitfalls

• Placing the `@SpringBootApplication` class in a nested sub-package, causing ComponentScan to bypass parent packages and miss classes.
• Manually adding `@ComponentScan` pointing to the exact same packages, causing duplicate scan configurations.

Direct Answer

`@Conditional` annotations evaluate system properties, classes on the classpath, or existence of other beans before creating a bean.

Detailed Explanation

@Configuration
public class DatabaseConfig {
    @Bean
    @ConditionalOnProperty(name = "datasource.mock", havingValue = "false", matchIfMissing = true)
    public DataSource realDataSource() {
        return new HikariDataSource();
    }
}

Common Interview Pitfalls

• Evaluating `@ConditionalOnBean` or `@ConditionalOnMissingBean` annotations in incorrect class order (conditionals should be run in auto-configurations after user configurations are processed).
• Configuring `@ConditionalOnProperty` but failing to specify a default value or setting `matchIfMissing` appropriately.

Direct Answer

Create an autoconfigure module, write a `@Configuration` class with conditionals, register it in `META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`, and package it.

Detailed Explanation

// File: META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
com.example.autoconfigure.CustomLibraryAutoConfiguration

Common Interview Pitfalls

• Using `spring.factories` in Spring Boot 3.x+ (it has been removed in favor of the `.imports` file).
• Failing to make auto-configured beans `@ConditionalOnMissingBean`, which prevents clients from overriding those beans with their own configurations.

Direct Answer

Spring Boot loads configuration properties in a strict order: Command line arguments override OS environment variables, which override application.properties/yaml files.

Detailed Explanation

// Override database URL at execution time via OS Environment variable
// Spring Boot relaxes name rules: DB_PASSWORD maps to datasource.password
DATABASE_URL=jdbc:postgresql://prod-db:5432/db java -jar app.jar

Common Interview Pitfalls

• Assuming packaged properties inside the jar can override values set via environment variables in Kubernetes/Docker environments.
• Failing to utilize profile-specific configuration overrides for testing and production environments.

Direct Answer

The N+1 query problem occurs when fetching an entity triggers a query for the parent, followed by N separate queries for its lazy-loaded children. Resolve using Join Fetch or `@EntityGraph`.

Detailed Explanation

@Repository
public interface AuthorRepository extends JpaRepository<Author, Long> {
    @Query("SELECT a FROM Author a JOIN FETCH a.books")
    List<Author> findAllWithBooks(); // Resolved via JPQL join fetch

    @EntityGraph(attributePaths = {"books"})
    List<Author> findAll(); // Resolved via EntityGraph
}

Common Interview Pitfalls

• Assuming that setting `FetchType.LAZY` on relationships prevents the N+1 problem (LAZY only defers queries; iterating over the lazy collection still triggers N+1).
• Using multiple independent JOIN FETCH statements for different collection relationships in a single query (triggers a Cartesian product validation error).

Direct Answer

JPA entities cycle through four states: Transient (new, unmanaged), Managed (associated with active PersistenceContext), Detached (session closed), and Removed (marked for deletion).

Detailed Explanation

EntityManager em = ...;
em.getTransaction().begin();

User user = new User("John"); // Transient state
em.persist(user); // Managed state

em.getTransaction().commit(); // Database insert, user is still Managed
em.clear(); // Detached state (session cleared)

Common Interview Pitfalls

• Expecting database updates to trigger on modifications made to detached objects without calling `EntityManager.merge()`.
• Calling `persist` on an object that already has a primary key set, causing potential IdentifierGenerationExceptions.

Direct Answer

`REQUIRED` (default) joins an active transaction or creates a new one. `REQUIRES_NEW` suspends active transactions to run in a separate physical connection.

Detailed Explanation

@Service
public class AuditService {
    @Transactional(propagation = Propagation.REQUIRES_NEW)
    public void logAction(String msg) {
        // Will commit even if the calling method's transaction fails and rolls back
        auditRepo.save(new AuditLog(msg));
    }
}

Common Interview Pitfalls

• Using `Propagation.REQUIRES_NEW` inside the same class via self-invocation (aspect bypassed, runs in the parent transaction instead).
• Catching an exception inside a `REQUIRED` transaction boundary and hoping the transaction won't roll back (once a transaction is marked rollback-only, it cannot commit).

Direct Answer

`LazyInitializationException` occurs when attempting to access a lazy-loaded collection/proxy after its associated EntityManager session has been closed. Prevent using Join Fetch or EntityGraph.

Detailed Explanation

@Service
public class BookService {
    @Transactional
    public BookDetails getBookDetails(Long id) {
        Book book = bookRepo.findById(id).orElseThrow();
        // Trigger lazy load inside active transaction context
        book.getReviews().size(); 
        return new BookDetails(book);
    }
}

Common Interview Pitfalls

• Enabling `spring.jpa.properties.hibernate.enable_lazy_load_no_trans=true` (anti-pattern: opens and closes a new database connection for *every* lazy property fetch, causing connection pool exhaustion).
• Accessing lazy relationships directly in JSON serialization classes without DTO mapping.

Direct Answer

Pass a `Pageable` parameter (created via `PageRequest.of(page, size, Sort)`) to the repository method. Return a `Page<T>` or `Slice<T>` object.

Detailed Explanation

@Repository
public interface ProductRepository extends JpaRepository<Product, Long> {
    Page<Product> findByNameContaining(String name, Pageable pageable);
}

// Controller call:
Pageable pageable = PageRequest.of(0, 10, Sort.by("price").descending());
Page<Product> page = productRepo.findByNameContaining("phone", pageable);

Common Interview Pitfalls

• Returning `Page<T>` for massive datasets when a `Slice<T>` or `List<T>` would avoid expensive SQL count queries.
• Performing pagination in-memory (e.g. fetching all rows via `.findAll()` and slicing them in Java list methods).

Direct Answer

Spring Security uses a series of servlet filters (managed by DelegatingFilterProxy and FilterChainProxy) to intercept HTTP requests for authentication, authorization, and CSRF protection.

Detailed Explanation

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults());
        return http.build();
    }
}

Common Interview Pitfalls

• Mixing up Servlet Filters and Spring MVC Interceptors (filters run before Spring MVC DispatcherServlet is reached).
• Configuring multiple SecurityFilterChains without defining clear path matching priority rules (`@Order`).

Direct Answer

An AuthenticationFilter extracts credentials into an unauthenticated Authentication token and delegates it to the AuthenticationManager, which queries AuthenticationProviders to return a fully populated, authenticated token.

Detailed Explanation

@Component
public class CustomAuthProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {
        String username = auth.getName();
        String password = auth.getCredentials().toString();
        // Implement custom validation logic
        return new UsernamePasswordAuthenticationToken(username, password, List.of(new SimpleGrantedAuthority("ROLE_USER")));
    }

    @Override
    public boolean supports(Class<?> authType) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authType);
    }
}

Common Interview Pitfalls

• Failing to save the authenticated user in the SecurityContextHolder manually in custom filter implementations.
• Storing passwords in plain text instead of using BCrypt/Argon2 hashing encoders.

Direct Answer

Session-based authentication uses stateful sessions stored on the server. JWT is stateless, self-contained, and scales horizontally, but revocation is complex.

Detailed Explanation

// Configure Spring Security for stateless JWT execution
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable()) // Safe to disable CSRF when not using session cookies
        .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    return http.build();
}

Common Interview Pitfalls

• Disabling CSRF protection while still using stateful, cookie-based session authentication in your endpoints.
• Storing sensitive credentials (like passwords) inside unencrypted JWT claims.

Direct Answer

Enable method security via `@EnableMethodSecurity`. `@PreAuthorize` uses Spring Expression Language (SpEL) for dynamic condition evaluation before method execution.

Detailed Explanation

@Service
public class DocumentService {
    @PreAuthorize("hasRole('ADMIN') or #owner == authentication.name")
    public Document getDocument(Long id, String owner) {
        return docRepo.findById(id).orElseThrow();
    }
}

Common Interview Pitfalls

• Adding `@PreAuthorize` to methods inside class definitions without enabling `@EnableMethodSecurity` (silently ignores the security checks).
• Using role name strings inside `hasRole(...)` expressions with the `ROLE_` prefix (Spring adds it automatically; use `hasRole("ADMIN")` instead of `hasRole("ROLE_ADMIN")`).

Direct Answer

`@SpringBootTest` bootstraps the complete ApplicationContext for integration testing. `@WebMvcTest` is a test slice that loads only the web layer and mocks dependencies.

Detailed Explanation

@WebMvcTest(UserController.class)
public class UserControllerTest {
    @Autowired
    private MockMvc mockMvc;

    @MockBean
    private UserService userService; // Mocked dependency

    @Test
    public void testGetUsers() throws Exception {
        mockMvc.perform(get("/users")).andExpect(status().isOk());
    }
}

Common Interview Pitfalls

• Using `@SpringBootTest` for simple controller endpoint testing, adding unnecessary database configuration loading to the test runner.
• Forgetting that `@WebMvcTest` does not scan regular `@Component` or `@Service` beans, requiring them to be manually mocked or declared.

Direct Answer

`@MockBean` creates a Mockito mock and registers it in the Spring ApplicationContext, replacing any existing bean of the same type.

Detailed Explanation

@SpringBootTest
public class OrderProcessorTest {
    @Autowired
    private OrderProcessor processor;

    @MockBean
    private PaymentGateway mockGateway; // Replaces the real gateway bean

    @Test
    public void testSuccess() {
        Mockito.when(mockGateway.charge(100.0)).thenReturn(true);
        boolean result = processor.process(100.0);
        Assertions.assertTrue(result);
    }
}

Common Interview Pitfalls

• Using Mockito's `@Mock` instead of `@MockBean` in Spring Boot tests, resulting in Spring injecting the real implementation instead of the mock.
• Failing to realize that using `@MockBean` in different tests alters the ApplicationContext, which disables Spring's test context caching and slows down the test suite.

Direct Answer

Configure exposure in `application.properties`, write classes annotated with `@Endpoint`, and secure the endpoint path `/actuator/**` in Spring Security.

Detailed Explanation

@Component
@Endpoint(id = "systemStatus")
public class SystemStatusEndpoint {
    @ReadOperation
    public Map<String, String> getStatus() {
        return Map.of("database", "UP", "threads", "OK");
    }
}

Common Interview Pitfalls

• Exposing sensitive endpoints like `/env` or `/heapdump` to the public web without adding authentication constraints.
• Configuring endpoints without proper path mappings under `/actuator` in security filter chains.

Direct Answer

Inject a `MeterRegistry` bean, construct a metric type (Counter, Gauge, or Timer), and record application events to expose them at `/actuator/prometheus`.

Detailed Explanation

@Service
public class OrderService {
    private final Counter orderCounter;

    public OrderService(MeterRegistry registry) {
        // Register custom Counter metric
        this.orderCounter = Counter.builder("shop.orders.completed")
                .description("Total number of completed orders")
                .register(registry);
    }

    public void completeOrder() {
        // Business logic
        orderCounter.increment();
    }
}

Common Interview Pitfalls

• Re-creating a Counter or Timer instance on every method execution instead of caching it as a single class field (creates duplicate registration overhead).
• Using Gauges to track running counts (Gauges should only monitor current states; use Counters for cumulative calculations).