⚡ CrackLab/Spring Ecosystem Mastery

Learning roadmap

Learn each topic from scratch, then practice the interview questions on it — in order.

1

1. Learn

Why Spring & Spring Boot IoC Container & Dependency Injection Beans, Configuration & Lifecycle Core Annotations & Auto-Configuration Properties, Profiles & Starters Building REST APIs DTOs & Entity Mapping Spring Data JPA & Hibernate Relationships & Queries Exception Handling & Validation Testing APIs & Dockerized Postgres Spring Security Fundamentals Authentication with JWT Authorization & Role-Based Access Control Refresh Tokens & Session Lifecycle Securing Exceptions & Custom Errors Caching with Redis Introduction to Microservices Event-Driven Architecture with Kafka API Gateway & Service Communication Docker & Docker Compose Logging Transactions with @Transactional Scheduling with @Scheduled Async Programming with @Async File Upload Spring Boot Actuator Aspect-Oriented Programming (AOP)Performance Optimization Production Best Practices Capstone — A Production-Ready System

2. Practice interview questions

What problem does the Spring IoC container solve that plain Java object creation doesn't?What does 'auto-configuration' actually do under the hood in Spring Boot?Why is constructor injection preferred over field injection in modern Spring code?What's the difference between `@Component`, `@Bean`, and `@Configuration`?What is the default bean scope in Spring, and when would you use `prototype` instead?What's the correct way to run code right after a bean's dependencies are injected?What exactly does `@SpringBootApplication` bundle together?How would you exclude one specific auto-configuration class from being applied?How do Spring profiles let the same codebase behave differently in dev vs production?What is a Spring Boot 'starter', and why does adding one dependency configure so much automatically?What's the difference between `@RequestBody` and `@RequestParam`?Why should a REST controller return `ResponseEntity<T>` instead of just `T`?Why not just return JPA `@Entity` objects directly from a REST controller?What's a practical downside of hand-writing entity-to-DTO mapping code everywhere?What is the N+1 query problem, and how does it show up with Spring Data JPA?What's the difference between `save()` triggering an INSERT vs an UPDATE in Spring Data JPA?Why does Hibernate default `@OneToMany` to `FetchType.LAZY` but `@ManyToOne` to `FetchType.EAGER`?How do Spring Data JPA's derived query methods like `findByEmailAndStatus` actually work?What does `@ExceptionHandler` combined with `@RestControllerAdvice` give you that a plain try/catch doesn't?How does Bean Validation (`@Valid` + `@NotNull`/`@Size`) actually get triggered on a REST request?Why use Testcontainers instead of an in-memory database like H2 for integration tests?What's the difference between `@SpringBootTest` and `@WebMvcTest`?What happens the instant you add `spring-boot-starter-security` to a project with zero configuration?What is a `SecurityFilterChain`, and where does it sit in a request's lifecycle?Why is a JWT-based API typically configured as stateless, and what does that change?What actually happens if you decode a JWT's payload without a library — is it 'safe' to just read?What's the difference between a Spring Security 'role' and an 'authority'?Why does `@PreAuthorize` on a method sometimes get silently ignored?Why use a short-lived access token plus a separate long-lived refresh token instead of one long-lived token?What is refresh token rotation, and what attack does it defend against?Why does Spring Security return 401 for one failure and 403 for another, and how do you customize each?Why can leaking a raw exception message in a security error response be dangerous?What does `@Cacheable` actually do the first time vs subsequent times a method is called with the same argument?Why does a cache need an eviction/TTL strategy instead of just caching forever?What's the core trade-off microservices make compared to a monolith?Why is 'a service per database' considered a core microservices principle rather than an implementation detail?What's the fundamental difference between a service calling another service's REST API vs publishing a Kafka event?Why might using Kafka introduce eventual consistency bugs that a direct REST call wouldn't have?What cross-cutting concerns does an API Gateway centralize that would otherwise be duplicated in every microservice?Why is client-side load balancing (each service instance discovering peers itself) sometimes preferred over a centralized load balancer?Why is Docker Compose useful for local development of a multi-service Spring Boot app even though production uses Kubernetes?What's the practical difference between `CMD` and `ENTRYPOINT` in a Dockerfile for a Spring Boot app?When integrating JWT auth, JPA persistence, Redis caching, and Kafka events into one production service, what's the most common integration bug?Why does a 'production-ready' checklist include health checks and structured logging, not just working business logic?Why does log.info("msg={}", value) use a placeholder instead of string concatenation?Why is logging every request at INFO level a bad default for a production service?Why does calling a @Transactional method from another method in the same class not start a transaction?Does @Transactional roll back on every exception by default?Why does @Scheduled run on a single shared thread by default, and why does that matter?If you deploy 3 replicas of a service with a nightly @Scheduled job, how many times does it actually run?Why does an @Async method silently run synchronously when called from within the same class?Why return CompletableFuture instead of void from an @Async method?Why is trusting a file's Content-Type header or extension as proof of what it actually is a security risk?Why doesn't saving uploaded files to the application server's local disk work in a real production deployment?How does /actuator/health decide whether to report UP or DOWN?Why is exposing /actuator/env or /actuator/heapdump to the public internet a real security risk?What do @Transactional, @Async, and @PreAuthorize have in common under the hood?Why is @Around the only AOP advice type that can change a method's return value, and what's the risk in writing one?Why should you measure with real data (like Actuator metrics) before optimizing a 'slow' endpoint?What's the telltale symptom that distinguishes connection-pool exhaustion from other performance problems?Why does a service need graceful shutdown configured, not just a health check?Why should environment-specific behavior live in profile-specific properties files instead of if-checks in code?

2

3

4

5

6