Which strategy is correct for configuring Spring Security to intercept particular URLs? (Choose the best answer.)

Question

Options

• AThe URLs can be specified via configuration (using authorizeRequests () and request
• BSpring Security can obtain URLs from Spring MVC controllers, the Spring Security
• CThe URLs are specified in a special properties file, used by Spring Security.
• DThe URLs can be specified via configuration (using authorizeRequests () and request

• A
  87% (48)
• B
  4% (2)
• C
  7% (4)
• D
  2% (1)

Explanation

Option A is correct because Spring Security's standard approach is programmatic configuration using authorizeRequests() (or the modern authorizeHttpRequests()) combined with requestMatchers() / antMatchers() to specify which URL patterns require which level of access - all defined in a SecurityFilterChain bean or WebSecurityConfigurerAdapter subclass.

Why the distractors are wrong:

• B is incorrect because Spring Security does not automatically derive security rules by scanning Spring MVC controller mappings - security configuration is explicit, not inferred from routing.
• C is incorrect because there is no dedicated "special properties file" for URL security rules; application.properties handles basic settings but not fine-grained URL authorization.
• D appears identical to A in the truncated choices shown, which is a common trick; if there is a subtle wording difference in the real exam (e.g., wrong method name or wrong API), that version is a distractor designed to catch careless readers.

Memory tip: Think of Spring Security configuration as a chain of matchers - you match a request pattern, then authorize it. The method pair requestMatchers(...).hasRole(...) inside authorizeHttpRequests() is the canonical idiom. If you remember "match then authorize," you'll always land on the programmatic config answer.

No community discussion yet for this question.