Spring Boot Interview Questions and Answers (2026): Spring Core, Auto-configuration, REST, JPA, Transactions, Security and Spring Boot 4

The short answer: Spring Boot interviews check that you understand what Spring does for you, and what it does behind your back. Expect questions on dependency injection and bean scopes, @SpringBootApplication and auto-configuration, starters and externalized configuration, REST controllers with validation and error handling, Spring Data JPA (and the N+1 query problem), @Transactional and its proxy pitfalls, Spring Security, testing, and Actuator. Experienced candidates also get production scenarios: “the API got slow”, “the transaction didn’t roll back”. Interviewers increasingly ask what’s current. Spring Boot 4 (November 2025) moved to Spring Framework 7, Jakarta EE 11 and Jackson 3, split auto-configuration into smaller modules and removed @MockBean. Spring Boot 4.1 (June 2026) is the current release. The answers below are checked against the Spring reference documentation and release notes, with sources at the end, and every Java sample compiles on Spring Boot 4.1.2.

Spring Boot runs on Java, so expect core Java questions in the same interview. Our Java interview questions cover collections, concurrency, virtual threads and Java 25.

Spring Boot versions in 2026

Support dates are from spring.io. Spring Boot 4 needs Java 17 or later (the Spring team recommends the latest LTS release, Java 25), Kotlin 2.2 or later for Kotlin projects, GraalVM 25 or later for native images, and a Jakarta EE 11 (Servlet 6.1) container. The Spring team recommends upgrading to the latest 3.5.x release before moving to 4.0.

Spring core: the container and dependency injection

“What are inversion of control and dependency injection?”

Inversion of control means your classes don’t create or look up the objects they depend on; the Spring container (the ApplicationContext) creates them, wires them together and manages their lifecycle. Dependency injection is how it hands each object its dependencies: through a constructor, a setter or a field. The objects Spring manages are beans. The benefit is loose coupling: a class depends on an interface, and you can swap the implementation, or a test double, without changing the class.

“Constructor, setter or field injection?”

The Spring reference documentation says the team “generally advocates constructor injection”: it lets you make components immutable with final fields, guarantees required dependencies aren’t null, and returns fully initialized objects. Use setter injection only for optional dependencies. Field injection (@Autowired on a field) hides dependencies and makes the class hard to test without Spring. With a single constructor, you don’t need @Autowired at all:

@Service
public class OrderService {
  private final OrderRepository repo;
  private final PaymentClient payments;

  OrderService(OrderRepository repo,
      PaymentClient payments) {
    this.repo = repo;
    this.payments = payments;
  }
}

“@Component, @Service, @Repository or @Controller?”

All four mark a class for component scanning, so Spring creates a bean from it. @Service, @Repository and @Controller are specializations of @Component that say what the class is for. @Repository also translates persistence exceptions into Spring’s DataAccessException hierarchy, and @Controller marks a web controller. @RestController is @Controller plus @ResponseBody: return values are written to the response body (as JSON, for example) instead of being treated as view names.

“@Bean or @Component?”

@Component goes on your own class, and Spring finds it by scanning. @Bean goes on a method in a @Configuration class and returns an object you build yourself, typically from a third-party library you can’t annotate:

@Configuration
class TimeConfig {
  @Bean
  Clock clock() {
    return Clock.systemUTC();
  }
}

“Two beans of the same type: which one gets injected?”

Spring fails at startup with a NoUniqueBeanDefinitionException unless it can tell which one you mean. As a fallback it picks the bean whose name matches the parameter or field name. To be explicit, mark one bean @Primary to make it the default, or add @Qualifier("name") at the injection point to pick one explicitly. You can also inject all of them as a List or a Map keyed by bean name.

“What are the bean scopes?”

Spring supports six scopes; four of them only exist in a web-aware application context.

The classic follow-up: a prototype bean injected into a singleton is created once, when the singleton is built, so the singleton keeps the same “prototype” instance. To get a fresh one each time, inject an ObjectProvider and call getObject(), or use a lookup method. Singletons are shared between threads, so keep them stateless or thread-safe.

“Describe the bean lifecycle.”

Spring instantiates the bean, injects its dependencies, calls Aware callbacks, runs BeanPostProcessors before and after initialization, and calls the init callback (a @PostConstruct method, InitializingBean.afterPropertiesSet() or a custom init method). On shutdown, it calls the destroy callback (@PreDestroy). Spring creates proxies, such as the ones behind @Transactional and @Async, in that post-processing step. Spring Framework 7 dropped support for the old javax.annotation versions of these annotations; use jakarta.annotation.

“What happens with circular dependencies?”

If bean A needs B in its constructor and B needs A in its constructor, Spring can’t build either and throws a BeanCurrentlyInCreationException. Spring Boot also prohibits circular references by default (spring.main.allow-circular-references is false). The right fix is design: extract the shared logic into a third bean, or publish an event instead of calling back.

Spring Boot essentials

“What does Spring Boot add on top of Spring?”

Spring Boot makes a Spring application runnable with almost no setup. Starters bring in a consistent set of dependencies for a technology, auto-configuration creates sensible beans based on what’s on the classpath, an embedded server (Tomcat by default, or Jetty) lets you run the app as a plain java -jar, externalized configuration handles properties, YAML, environment variables and profiles, and Actuator adds health checks and metrics for production.

“What does @SpringBootApplication do?”

It combines three annotations: @EnableAutoConfiguration (turn on auto-configuration), @ComponentScan (scan the package of this class and its sub-packages for components) and @SpringBootConfiguration (a @Configuration that tests can find automatically). Put the class in your root package, so scanning covers the whole application:

@SpringBootApplication
public class ShopApplication {
  public static void main(
      String[] args) {
    SpringApplication.run(
        ShopApplication.class, args);
  }
}

“How does auto-configuration work?”

Spring Boot ships auto-configuration classes that are guarded by conditions such as @ConditionalOnClass (a library is on the classpath), @ConditionalOnMissingBean (you haven’t defined your own) and @ConditionalOnProperty. Add a JDBC driver and a data starter, and Boot configures a DataSource; define your own DataSource bean, and the auto-configured one backs off. That’s what the documentation means by auto-configuration being “non-invasive”. To see what was applied and why, start the app with --debug to print the conditions report. To turn one off, use @SpringBootApplication(exclude = ...).

“What are starters? What changed in Spring Boot 4?”

A starter is a dependency that pulls in everything needed for one technology, with versions that work together. Spring Boot 4 split the large auto-configuration jars into smaller modules, one per technology, and made the starter names consistent: spring-boot-starter-web became spring-boot-starter-webmvc, and each technology has a matching test starter, such as spring-boot-starter-webmvc-test. Technologies that used to need only their own library, such as Flyway, now need their starter (spring-boot-starter-flyway).

“How does externalized configuration work? Which value wins?”

Spring Boot reads properties from many sources, and later sources override earlier ones. From lowest to highest priority, the main ones are: default properties, @PropertySource annotations, config files (application.properties or application.yml), OS environment variables, Java system properties, and command-line arguments. Among config files, profile-specific files (application-prod.yml) override the default file, and files outside the jar override those packaged inside it. So --server.port=9090 on the command line beats server.port in application.yml.

Bind related settings to a typed, validated object instead of scattering @Value annotations:

@ConfigurationProperties("app.mail")
record MailProperties(
    String host,
    int port,
    Duration timeout) {}

app:
  mail:
    host: smtp.example.com
    port: 587
    timeout: 5s

Register it with @ConfigurationPropertiesScan or @EnableConfigurationProperties. Values such as 5s convert to a Duration automatically.

“What are profiles?”

Profiles group configuration and beans by environment. Activate one with spring.profiles.active=prod (as a property, an environment variable or a command-line argument); Boot then loads application-prod.yml on top of application.yml, and beans annotated @Profile("prod") are created only when that profile is active. Keep secrets out of the files: inject them through environment variables or a secrets manager.

REST APIs with Spring MVC

“Build a REST endpoint with validation.”

@RestController
@RequestMapping("/orders")
class OrderController {
  private final OrderService orders;

  OrderController(
      OrderService orders) {
    this.orders = orders;
  }

  @GetMapping("/{id}")
  OrderDto get(@PathVariable long id) {
    return orders.find(id);
  }

  @PostMapping
  @ResponseStatus(HttpStatus.CREATED)
  OrderDto create(@Valid @RequestBody
      NewOrder order) {
    return orders.create(order);
  }
}

record NewOrder(
    @NotBlank String customerId,
    @Positive int quantity) {}

@Valid triggers Bean Validation on the request body (add spring-boot-starter-validation). If a constraint fails, Spring answers 400 Bad Request before your method runs. @ResponseStatus(HttpStatus.CREATED) sets 201 for a successful create.

“How do you handle errors in a REST API?”

Put @ExceptionHandler methods in a @RestControllerAdvice class so every controller shares them, and return a ProblemDetail: Spring’s built-in representation of the “Problem Details for HTTP APIs” standard (RFC 9457), a consistent JSON shape with type, title, status and detail fields:

@RestControllerAdvice
class ApiErrors {
  @ExceptionHandler
  ProblemDetail notFound(
      OrderNotFoundException e) {
    var problem =
        ProblemDetail.forStatus(404);
    problem.setDetail(e.getMessage());
    return problem;
  }
}

A request for a missing order now gets a 404 with a JSON body that clients can rely on, instead of a stack trace.

“How do you call other services?”

Use RestClient, the synchronous client added in Spring Framework 6.1, or declare an HTTP service interface and let Spring implement it. Spring Boot 4 auto-configures these clients:

@HttpExchange("/repos")
interface RepoClient {
  @GetExchange("/{owner}/{name}")
  Repo get(@PathVariable String owner,
      @PathVariable String name);
}

@SpringBootApplication
@ImportHttpServices(group = "github",
    types = RepoClient.class)
public class ShopApplication {
  // main method as before
}

You then inject RepoClient like any bean, and set the group’s base URL with a base-url property under spring.http.serviceclient. Always configure timeouts for remote calls.

“Spring MVC or WebFlux? What about virtual threads?”

Spring MVC uses a thread per request and blocking I/O; WebFlux is non-blocking and reactive, built to serve many concurrent requests with few threads. With Java 21 or later, setting spring.threads.virtual.enabled=true runs Spring MVC request handling on virtual threads, so plain blocking code can handle many more concurrent, I/O-bound requests. That removes a lot of the reason to choose WebFlux only for scalability. The Spring Boot docs strongly recommend Java 24 or later for virtual threads, since earlier versions could pin them in synchronized blocks.

Data access with Spring Data JPA

“How do Spring Data repositories work?”

You declare an interface; Spring Data generates the implementation at startup. Methods are derived from their names (findByTitleContaining), or you write the query yourself with @Query. JpaRepository adds CRUD, paging and sorting:

interface BookRepository
    extends JpaRepository<Book, Long> {

  List<Book> findByTitleContaining(
      String text);

  @Query("""
      select b from Book b
      join fetch b.author""")
  List<Book> findAllWithAuthor();
}

By default, the read methods inherited from CrudRepository run in read-only transactions, and the other inherited methods run in regular transactions.

“What is the N+1 query problem? How do you fix it?”

You load N books with one query, then touch book.getAuthor() in a loop, and the ORM fires one more query per book: N+1 queries instead of one or two. It’s the most common Spring Boot performance question. Fixes:

• Mark associations LAZY. JPA fetches @ManyToOne eagerly by default, which Hibernate’s own guide calls “a very unfortunate misfeature”.
• Fetch what a use case needs up front with join fetch in the query (as in findAllWithAuthor() above) or an @EntityGraph.
• Use a DTO projection when you only need a few columns.
• Turn on SQL logging in development and count the queries.

@Entity
class Book {
  @Id @GeneratedValue
  Long id;
  String title;

  @ManyToOne(fetch = FetchType.LAZY)
  Author author;
}

“What is Open EntityManager in View? Should you turn it off?”

In a web application, Spring Boot registers OpenEntityManagerInViewInterceptor by default (spring.jpa.open-in-view is true). It keeps the persistence context open for the whole request, so lazy associations can load while the response is being rendered. That hides N+1 problems and holds a database connection for longer. Many teams set spring.jpa.open-in-view=false and fetch what they need inside the service layer.

“What does LazyInitializationException mean?”

The code touched a lazy association after its persistence context (and usually its transaction) had closed, for example in a controller after the service method returned. Fetch the association inside the transaction (join fetch, an entity graph) or return a DTO built inside the service. Don’t fix it by making the association eager.

Transactions

“How does @Transactional work?”

Spring wraps the bean in a proxy. When a caller invokes a @Transactional method through that proxy, the proxy starts a transaction (or joins an existing one), calls your method, and commits when it returns, or rolls back if it throws. Because the work happens in the proxy, how the method is called matters, as the next question shows.

“Why didn’t my @Transactional method start a transaction?”

The most common cause is self-invocation. The reference documentation states that in proxy mode, the default, only external calls coming in through the proxy are intercepted, so a method calling another method of the same object doesn’t start a transaction, even if the called method is @Transactional:

@Service
public class ReportService {
  public void runAll(List<Long> ids) {
    for (long id : ids) {
      // Calls this object directly,
      // not the proxy: no transaction
      run(id);
    }
  }

  @Transactional
  public void run(long id) {
    // load, update, save
  }
}

Fixes: move run() into another bean, annotate the calling method instead, or use TransactionTemplate for programmatic control. The same proxy rule applies to @Async, @Cacheable and @Retryable.

“Why didn’t my transaction roll back?”

By default, Spring rolls back only on unchecked exceptions (RuntimeException and its subclasses) and Error. A checked exception, such as an IOException, commits the transaction unless you declare it, as in @Transactional(rollbackFor = Exception.class). Catching an exception inside the method and not rethrowing it also commits. Interviewers love this question because it causes real data bugs.

“What do the propagation levels mean?”

• REQUIRED (the default): join the current transaction, or start one if there isn’t one.
• REQUIRES_NEW: always start an independent transaction, suspending the current one. Use it for work that must commit even if the caller rolls back, such as an audit record.
• MANDATORY: require an existing transaction, and throw if there isn’t one.
• SUPPORTS, NOT_SUPPORTED, NEVER and NESTED (a savepoint inside the current transaction) are rarer.

Add readOnly = true to query-only methods: it documents intent and lets the persistence provider optimize, for example by skipping dirty checking.

Spring Security

“How does Spring Security work?”

Spring Security is a chain of servlet filters that runs before your controllers: it authenticates the request (from a session, a form login, a JWT and so on), stores the result in the SecurityContext, and checks authorization rules. You configure it by declaring a SecurityFilterChain bean:

@Configuration
@EnableWebSecurity
class SecurityConfig {
  @Bean
  SecurityFilterChain api(
      HttpSecurity http)
      throws Exception {
    http.authorizeHttpRequests(a -> a
        .requestMatchers("/public/**")
        .permitAll()
        .anyRequest().authenticated())
      .oauth2ResourceServer(o -> o
        .jwt(withDefaults()));
    return http.build();
  }
}

This configuration lets anyone call /public/**, requires authentication everywhere else, and validates JSON Web Tokens as an OAuth 2.0 resource server. In Spring Boot 4 the starter for that is spring-boot-starter-security-oauth2-resource-server.

“Is CSRF protection on? Should a REST API disable it?”

Spring Security protects against CSRF by default for unsafe HTTP methods such as POST. CSRF attacks rely on the browser sending credentials automatically, such as session cookies. An API that authenticates every request with a bearer token in a header isn’t exposed in the same way, which is why stateless token APIs often disable it. An API used by a browser with cookie-based sessions should keep it on.

“How should passwords be stored?”

Never in plain text or with a fast hash. Use a PasswordEncoder with a slow, salted, adaptive algorithm such as bcrypt, and let Spring Security compare hashes at login.

Testing

“@SpringBootTest or a test slice?”

@SpringBootTest starts the whole application context: thorough, but slow. Test slices start only one layer: @WebMvcTest for controllers (with MockMvc), @DataJpaTest for repositories (with an embedded database by default), and others for JSON, REST clients and more. Replace the beans a slice doesn’t load with @MockitoBean:

@WebMvcTest(OrderController.class)
class OrderControllerTest {
  @Autowired MockMvc mvc;
  @MockitoBean OrderService orders;

  @Test
  void getsOrder() throws Exception {
    when(orders.find(1)).thenReturn(
        new OrderDto(1, "NEW"));

    mvc.perform(get("/orders/1"))
        .andExpect(status().isOk())
        .andExpect(jsonPath("$.status")
            .value("NEW"));
  }
}

Spring Boot 4 removed its @MockBean and @SpyBean annotations; use Spring Framework’s @MockitoBean and @MockitoSpyBean. For integration tests against a real database, start it in a container with Testcontainers and annotate the container field with @ServiceConnection, so Spring Boot points the application at it automatically.

Production readiness

“What does Actuator give you?”

Endpoints for health checks, metrics, info, environment, loggers and more. By default, only the health endpoint is exposed over HTTP, because the others can reveal sensitive information. Expose more on purpose, and secure them:

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus

Since Spring Boot 4, the liveness and readiness health groups that Kubernetes probes use are enabled by default. Metrics go through Micrometer, and a new spring-boot-starter-opentelemetry exports metrics and traces over OTLP.

“How do you handle failures when calling other services?”

Set connect and read timeouts on every client, retry only idempotent operations, back off between retries, and limit concurrency so a slow dependency can’t exhaust your threads. Spring Framework 7 moved retry support into the core framework: enable it with @EnableResilientMethods, then annotate methods with @Retryable or @ConcurrencyLimit:

@Configuration
@EnableResilientMethods
class ResilienceConfig {}

@Service
class EventPublisher {
  private final Broker broker;

  EventPublisher(Broker broker) {
    this.broker = broker;
  }

  @Retryable(maxRetries = 4,
      delay = 500, multiplier = 2)
  void publish(Event event) {
    broker.send(event);
  }
}

With no attributes, @Retryable retries up to three times, one second apart, for any exception. For circuit breakers, teams use a library such as Resilience4j.

“How do you make a Spring Boot app start faster or use less memory?”

Profile startup first, since slow startup is often a slow bean or a remote call during initialization. Then: avoid component-scanning more packages than you need, consider lazy initialization (spring.main.lazy-initialization), use the JVM’s AOT cache (Spring Boot’s documentation shows how to extract the jar for it), or compile a GraalVM native image (GraalVM 25 or later for Spring Boot 4) for the fastest startup and smallest memory footprint, with longer builds as the trade-off.

What’s new in Spring Boot 4 and Spring Framework 7

The upgrade path the Spring team recommends: move to the latest 3.5.x, remove deprecation warnings, then upgrade to the latest 4.0.x or later and follow the migration guide.

Scenario questions for experienced developers

• “An endpoint got five times slower after a release. What do you do?” Check metrics and traces to see where the time goes (database, a remote call, the CPU). Look for new N+1 queries in the SQL log, missing indexes, a connection pool that’s exhausted, or a remote call without a timeout. Reproduce, fix the cause, and add a test or an alert so it doesn’t come back.
• “A payment was saved but the order wasn’t. Why?” Probably two transactions where you expected one: self-invocation, a REQUIRES_NEW, or a checked exception that committed. Walk through the proxies and the rollback rules above.
• “The service runs out of database connections under load.” Long transactions, Open EntityManager in View holding connections during rendering, slow queries, or a remote call made inside a transaction. Keep transactions short and never call a remote service while holding one.
• “The app won’t start after upgrading to Spring Boot 4.” Read the first error in the conditions report or the stack trace. Typical causes: renamed starters, Jackson 3 package changes, javax imports, @MockBean in tests, and libraries that don’t support Jakarta EE 11 yet.
• “How would you split a monolith into services?” Start from business boundaries, not technical layers; give each service its own data; prefer asynchronous events where you can; and plan for timeouts, retries, idempotency and tracing from day one. Our system design interview guide covers the design round.

Questions by level and role

• Junior: what Spring Boot adds, @SpringBootApplication, beans and dependency injection, the stereotype annotations, @RestController and request mapping, application.properties and profiles, Spring Data repositories, basic tests.
• Mid-level: auto-configuration and conditions, bean scopes and lifecycle, configuration properties, validation and ProblemDetail errors, @Transactional pitfalls, N+1 queries, test slices and @MockitoBean, Actuator, Spring Security basics.
• Senior: proxies and AOP, transaction propagation and isolation, connection-pool and performance tuning, virtual threads vs WebFlux, resilience and observability, upgrading to Spring Boot 4, service boundaries and data ownership in microservices.
• By role: backend developers also get SQL and API design (see our SQL interview questions, web API interview questions and backend developer interview questions); full-stack developers add a front-end framework.

Behavioral questions for Spring Boot developers

Use the STAR method with a real example:

• “Tell me about a production incident in a Spring Boot service. How did you find the cause?”
• “Describe a time you made a slow endpoint or query faster. What did you measure?”
• “How did you upgrade a service to a new Spring Boot or Java version? What broke?”
• “Tell me about a design decision you disagreed with. What did you do?”

More: our Java interview questions, software engineer interview questions and Java 8 interview questions.

Frequently asked questions

Sources

• Spring, Spring Boot project page and support timeline and the release tags on GitHub (4.0.0 on 2025-11-20, 4.1.0 on 2026-06-10, 4.1.2 and 4.2.0-RC1 on 2026-10-22). Read on 4 November 2026.
• Spring Boot wiki: Spring Boot 4.0 Release Notes, Spring Boot 4.0 Migration Guide, Spring Boot 4.1 Release Notes and Spring Boot 4.2.0-RC1 Release Notes. Read on 4 November 2026.
• Spring Framework wiki: Spring Framework 7.0 Release Notes. Read on 4 November 2026.
• Spring Boot reference: Using @SpringBootApplication, Auto-configuration, Externalized Configuration, SpringApplication (virtual threads), SQL databases (Open EntityManager in View), HTTP service interface clients, Testing Spring Boot applications, Testcontainers, Actuator endpoints and common application properties. Read on 4 November 2026.
• Spring Framework reference: Dependencies and their injection, Bean scopes, Using @Transactional, Rolling back a declarative transaction, Transaction propagation, Error responses (RFC 9457) and Resilience features. Read on 4 November 2026.
• Spring Data JPA reference: Query methods and Transactionality. Spring Security reference: Java configuration and CSRF. Read on 4 November 2026.
• Hibernate, An Introduction to Hibernate 7 (eager @ManyToOne by default, N+1 selects, join fetch and entity graphs). Read on 4 November 2026.