117 Spring & Spring Boot interview questions with answers (2026)

All Spring & Spring Boot interview questions

What is Spring Boot and what are its advantages?

What is Dependency Injection (DI) and how does Spring implement it?

What is @Autowired and how does it work?

What is the difference between @Bean and @Component?

What are application.properties and application.yml? How does externalized config work?

What is the purpose of Spring Boot Actuator?

What is Spring Data JPA and what is the role of @Repository?

What is Spring transaction management and @Transactional?

What is the purpose of @Transactional(readOnly=true)?

How does OAuth 2.1 with Spring Authorization Server work in a microservices architecture?

What is the difference between an Authorization Server and a Resource Server in Spring Security 6?

What is the difference between Spring MVC and Spring WebFlux? When should you choose each?

What are Mono, Flux, and backpressure in Spring WebFlux?

What are the trade-offs between Testcontainers and H2 in-memory databases in CI/CD?

What is @SpringBootApplication? Which annotations does it combine?

How does auto-configuration work in Spring Boot?

What are bean scopes in Spring? How do Singleton and Prototype differ?

What does Spring Boot DevTools do?

Bean lifecycle in Spring Boot: when do you use @PostConstruct and @PreDestroy?

How do @Value and @ConfigurationProperties differ? When should you use each?

What are Spring Profiles and how do you use them?

What is a circular dependency in Spring? How do you detect and fix it?

When do you use @Primary and @Qualifier in Spring?

How do @RestController and @Controller differ?

How do @PathVariable, @RequestParam, and @RequestBody differ?

How does the DispatcherServlet work in Spring MVC?

How do JPA and Hibernate differ? What is Spring Data JPA?

What are lazy and eager loading in JPA? When do you use each?

What is the N+1 query problem in JPA? How do you fix it?

How do authentication and authorization differ in Spring Security?

What is the Spring Security Filter Chain? How does it work?

How does JWT authentication work in Spring Security?

What is CSRF protection in Spring Security? When should you enable or disable it?

What is @SpringBootTest? How does it differ from a plain unit test?

Slice tests in Spring Boot: when do you use @WebMvcTest and @DataJpaTest?

How do @MockBean and @Mock differ?

How do you create a custom HealthIndicator in Spring Boot Actuator?

How do @Async and @EnableAsync work in Spring Boot?

How do @Cacheable and @CacheEvict work in Spring Cache?

What are @ControllerAdvice and @ExceptionHandler used for?

How do @Valid and @Validated differ in Spring Boot?

What is the property precedence order in Spring Boot?

What is @ConditionalOnProperty used for?

How do CrudRepository, JpaRepository, and PagingAndSortingRepository differ?

Transaction propagation in Spring: what are the common types?

Transaction isolation levels in Spring: how do READ_COMMITTED and REPEATABLE_READ differ?

How does database migration with Flyway work in Spring Boot?

What is HikariCP? Why is it the default connection pool in Spring Boot?

What is ResponseEntity used for in Spring MVC?

What are @Scheduled and @EnableScheduling used for?

How do RestTemplate, WebClient, and RestClient differ?

Spring Kafka integration: how do you produce and consume messages?

Service discovery and load balancing in microservices with Spring Cloud?

How do you secure Actuator endpoints in production?

When do you use @ResponseStatus?

How does Spring Boot 3 differ from Spring Boot 2? What are the major changes when migrating?

What problem does the Saga pattern solve in microservices?

How do @Component, @Service, @Repository, and @Controller differ?

What are Spring Boot Starters? Name some commonly used starters.

How do constructor, setter, and field injection differ? Which should you use?

How do save(), saveAndFlush(), and flush() differ in JPA?

What is the @Transactional self-invocation problem?

How do you configure CORS in Spring Boot?

What is Testcontainers used for in Spring Boot?

What is a Spring Boot embedded server? How do you switch to Jetty?

How do you implement pagination and sorting with Spring Data JPA?

How do you integrate Spring Boot Actuator metrics with Prometheus and Grafana?

How does the Circuit Breaker pattern with Resilience4j work in Spring Boot?

How do you integrate OpenAPI (Swagger) with Spring Boot?

How do ApplicationContext and BeanFactory differ?

What is Spring AOP? How do @Aspect, @Around, and pointcuts work?

How does @TransactionalEventListener differ from @EventListener? When do you use it?

How do @PreAuthorize and method-level security work in Spring Security?

How do Virtual Threads (Java 21) work in Spring Boot 3.2? How do they differ from WebFlux?

How does GraalVM Native Image work with Spring Boot 3? What are the pros and cons?

How do Spring Framework and Spring Boot differ?

How do a Filter and a HandlerInterceptor differ in Spring?

How do @Entity, @Id, @GeneratedValue, and relationship mapping work in JPA?

Entity lifecycle in JPA: what are transient, managed, detached, and removed?

How do @RequestMapping and @GetMapping differ?

How do DTOs and Entities differ? Why not return entities directly from the API?

What is Spring Cloud Config Server used for?

What is an API Gateway? How does Spring Cloud Gateway work?

How do you exclude/disable a specific auto-configuration in Spring Boot?

How does @ComponentScan work, and how do you set base packages?

If a `@Transactional` method throws a checked exception, does the transaction roll back?

How do you run code right after the app starts? How is `CommandLineRunner` different from `@PostConstruct`?

What does `@ConfigurationProperties` need in order to bind? How does relaxed binding work?

What is graceful shutdown in Spring Boot and how do you configure it?

If you inject a `prototype`-scoped bean into a `singleton`, do you get a new instance on every use?

What changes if you put `@Bean` methods in a `@Component` class instead of `@Configuration`?

How does Spring decide between a JDK dynamic proxy and a CGLIB proxy?

Why do `@RequestBody` validation and `@RequestParam` validation throw two different exceptions?

How does Spring Boot 3 standardize error responses? How is `ProblemDetail` used?

After upgrading to Spring Boot 2.6+ the app fails to start with `BeanCurrentlyInCreationException` — how do you fix it?

How do `spring.profiles.active`, `spring.profiles.include` and `spring.profiles.group` differ?

How do you wire Kubernetes liveness and readiness probes with Actuator? How do the two differ?

You caught the exception, yet you still get `UnexpectedRollbackException: Transaction rolled back because it has been marked as rollback-only` — why?

How do `REQUIRES_NEW` and `NESTED` differ? What is the risk of overusing `REQUIRES_NEW`?

Does `@Transactional` work on a `private` or a `final` method?

If a bean declares `@PostConstruct`, `InitializingBean` and an `initMethod`, in what order do they run?

How do derived query methods differ from `@Query`? When should you use a native query?

When does `LazyInitializationException` happen? Why does it show up in production but not in dev?

How should passwords be stored? What is Spring Security's default `PasswordEncoder`, and what is the `{bcrypt}` prefix for?

How do you configure Spring Security 6 now that `WebSecurityConfigurerAdapter` is gone?

Why does changing an entity field inside a `@Transactional` method update the database even without calling `save()`?

How does `@EntityGraph` differ from `join fetch`? Which one should you use to fix N+1?

How should you implement `equals()` and `hashCode()` for a JPA entity, and why not use the auto-generated ID directly?

Walk through the username/password login flow in Spring Security: which components does the request pass through?

Two users open the same order and both hit save; the second overwrites the first. How would you design against this?

How does `CascadeType.REMOVE` differ from `orphanRemoval = true`, and when is `orphanRemoval` mandatory?

The frontend hits a CORS error and the `OPTIONS` preflight returns 401 even though `@CrossOrigin` is present. What is the cause and the fix?

The log shows `HHH000104: firstResult/maxResults specified with collection fetch; applying in memory`. What is happening and how do you fix it?

The app throws `MultipleBagFetchException: cannot simultaneously fetch multiple bags`. Why, and how do you handle it?

Importing 100,000 rows with `saveAll()` is slow. I set `hibernate.jdbc.batch_size=50` but the log still shows one INSERT at a time. Why?

Production logs `HikariPool-1 - Connection is not available, request timed out after 30000ms`. How do you diagnose it, and what should `maximumPoolSize` be?

With stateless JWT, how would you design the refresh token flow and handle logout / revocation?

All Spring & Spring Boot interview questions

What is Spring Boot and what are its advantages?
What is Dependency Injection (DI) and how does Spring implement it?
What is @Autowired and how does it work?
What is the difference between @Bean and @Component?
What are application.properties and application.yml? How does externalized config work?
What is the purpose of Spring Boot Actuator?
What is Spring Data JPA and what is the role of @Repository?
What is Spring transaction management and @Transactional?
What is the purpose of @Transactional(readOnly=true)?
How does OAuth 2.1 with Spring Authorization Server work in a microservices architecture?
What is the difference between an Authorization Server and a Resource Server in Spring Security 6?
What is the difference between Spring MVC and Spring WebFlux? When should you choose each?
What are Mono, Flux, and backpressure in Spring WebFlux?
What are the trade-offs between Testcontainers and H2 in-memory databases in CI/CD?
What is @SpringBootApplication? Which annotations does it combine?
How does auto-configuration work in Spring Boot?
What are bean scopes in Spring? How do Singleton and Prototype differ?
What does Spring Boot DevTools do?
Bean lifecycle in Spring Boot: when do you use @PostConstruct and @PreDestroy?
How do @Value and @ConfigurationProperties differ? When should you use each?
What are Spring Profiles and how do you use them?
What is a circular dependency in Spring? How do you detect and fix it?
When do you use @Primary and @Qualifier in Spring?
How do @RestController and @Controller differ?
How do @PathVariable, @RequestParam, and @RequestBody differ?
How does the DispatcherServlet work in Spring MVC?
How do JPA and Hibernate differ? What is Spring Data JPA?
What are lazy and eager loading in JPA? When do you use each?
What is the N+1 query problem in JPA? How do you fix it?
How do authentication and authorization differ in Spring Security?
What is the Spring Security Filter Chain? How does it work?
How does JWT authentication work in Spring Security?
What is CSRF protection in Spring Security? When should you enable or disable it?
What is @SpringBootTest? How does it differ from a plain unit test?
Slice tests in Spring Boot: when do you use @WebMvcTest and @DataJpaTest?
How do @MockBean and @Mock differ?
How do you create a custom HealthIndicator in Spring Boot Actuator?
How do @Async and @EnableAsync work in Spring Boot?
How do @Cacheable and @CacheEvict work in Spring Cache?
What are @ControllerAdvice and @ExceptionHandler used for?
How do @Valid and @Validated differ in Spring Boot?
What is the property precedence order in Spring Boot?
What is @ConditionalOnProperty used for?
How do CrudRepository, JpaRepository, and PagingAndSortingRepository differ?
Transaction propagation in Spring: what are the common types?
Transaction isolation levels in Spring: how do READ_COMMITTED and REPEATABLE_READ differ?
How does database migration with Flyway work in Spring Boot?
What is HikariCP? Why is it the default connection pool in Spring Boot?
What is ResponseEntity used for in Spring MVC?
What are @Scheduled and @EnableScheduling used for?
How do RestTemplate, WebClient, and RestClient differ?
Spring Kafka integration: how do you produce and consume messages?
Service discovery and load balancing in microservices with Spring Cloud?
How do you secure Actuator endpoints in production?
When do you use @ResponseStatus?
How does Spring Boot 3 differ from Spring Boot 2? What are the major changes when migrating?
What problem does the Saga pattern solve in microservices?
How do @Component, @Service, @Repository, and @Controller differ?
What are Spring Boot Starters? Name some commonly used starters.
How do constructor, setter, and field injection differ? Which should you use?
How do save(), saveAndFlush(), and flush() differ in JPA?
What is the @Transactional self-invocation problem?
How do you configure CORS in Spring Boot?
What is Testcontainers used for in Spring Boot?
What is a Spring Boot embedded server? How do you switch to Jetty?
How do you implement pagination and sorting with Spring Data JPA?
How do you integrate Spring Boot Actuator metrics with Prometheus and Grafana?
How does the Circuit Breaker pattern with Resilience4j work in Spring Boot?
How do you integrate OpenAPI (Swagger) with Spring Boot?
How do ApplicationContext and BeanFactory differ?
What is Spring AOP? How do @Aspect, @Around, and pointcuts work?
How does @TransactionalEventListener differ from @EventListener? When do you use it?
How do @PreAuthorize and method-level security work in Spring Security?
How do Virtual Threads (Java 21) work in Spring Boot 3.2? How do they differ from WebFlux?
How does GraalVM Native Image work with Spring Boot 3? What are the pros and cons?
How do Spring Framework and Spring Boot differ?
How do a Filter and a HandlerInterceptor differ in Spring?
How do @Entity, @Id, @GeneratedValue, and relationship mapping work in JPA?
Entity lifecycle in JPA: what are transient, managed, detached, and removed?
How do @RequestMapping and @GetMapping differ?
How do DTOs and Entities differ? Why not return entities directly from the API?
What is Spring Cloud Config Server used for?
What is an API Gateway? How does Spring Cloud Gateway work?
How do you exclude/disable a specific auto-configuration in Spring Boot?
How does @ComponentScan work, and how do you set base packages?
If a `@Transactional` method throws a checked exception, does the transaction roll back?
How do you run code right after the app starts? How is `CommandLineRunner` different from `@PostConstruct`?
What does `@ConfigurationProperties` need in order to bind? How does relaxed binding work?
What is graceful shutdown in Spring Boot and how do you configure it?
If you inject a `prototype`-scoped bean into a `singleton`, do you get a new instance on every use?
What changes if you put `@Bean` methods in a `@Component` class instead of `@Configuration`?
How does Spring decide between a JDK dynamic proxy and a CGLIB proxy?
Why do `@RequestBody` validation and `@RequestParam` validation throw two different exceptions?
How does Spring Boot 3 standardize error responses? How is `ProblemDetail` used?
After upgrading to Spring Boot 2.6+ the app fails to start with `BeanCurrentlyInCreationException` — how do you fix it?
How do `spring.profiles.active`, `spring.profiles.include` and `spring.profiles.group` differ?
How do you wire Kubernetes liveness and readiness probes with Actuator? How do the two differ?
You caught the exception, yet you still get `UnexpectedRollbackException: Transaction rolled back because it has been marked as rollback-only` — why?
How do `REQUIRES_NEW` and `NESTED` differ? What is the risk of overusing `REQUIRES_NEW`?
Does `@Transactional` work on a `private` or a `final` method?
If a bean declares `@PostConstruct`, `InitializingBean` and an `initMethod`, in what order do they run?
How do derived query methods differ from `@Query`? When should you use a native query?
When does `LazyInitializationException` happen? Why does it show up in production but not in dev?
How should passwords be stored? What is Spring Security's default `PasswordEncoder`, and what is the `{bcrypt}` prefix for?
How do you configure Spring Security 6 now that `WebSecurityConfigurerAdapter` is gone?
Why does changing an entity field inside a `@Transactional` method update the database even without calling `save()`?
How does `@EntityGraph` differ from `join fetch`? Which one should you use to fix N+1?
How should you implement `equals()` and `hashCode()` for a JPA entity, and why not use the auto-generated ID directly?
Walk through the username/password login flow in Spring Security: which components does the request pass through?
Two users open the same order and both hit save; the second overwrites the first. How would you design against this?
How does `CascadeType.REMOVE` differ from `orphanRemoval = true`, and when is `orphanRemoval` mandatory?
The frontend hits a CORS error and the `OPTIONS` preflight returns 401 even though `@CrossOrigin` is present. What is the cause and the fix?
The log shows `HHH000104: firstResult/maxResults specified with collection fetch; applying in memory`. What is happening and how do you fix it?
The app throws `MultipleBagFetchException: cannot simultaneously fetch multiple bags`. Why, and how do you handle it?
Importing 100,000 rows with `saveAll()` is slow. I set `hibernate.jdbc.batch_size=50` but the log still shows one INSERT at a time. Why?
Production logs `HikariPool-1 - Connection is not available, request timed out after 30000ms`. How do you diagnose it, and what should `maximumPoolSize` be?
With stateless JWT, how would you design the refresh token flow and handle logout / revocation?