QUESTION 109

When using the @WebListener annotation, the class on which the annotation is applied to must also implement
at least one o the following interfaces (Choose two):

A. RequestListener
B. AttributeListener
C. ServletContextListener
D. HttpSessionListener
E. SessionAttributeListener
F. AsyncListener

Correct Answer: CD
Explanation/Reference:
@WebListener
The main task of the listener is to listen the particular events and process your own task on that event. For
example, if you want to initialize a database connection before your application starts, ServletContextListener
will be implemented to do that. Another good example is -when you want to do some task on the creation and
destruction of a session. For this purpose you need to implement HttpSessionListener.

QUESTION 108

Which of following annotations can be used in a servlet class?
(i) @javax.annotation.Resource
(ii) @javax.annotation.PreDestroy
(iii) @javax.annotation.security.RunAs
(iv) @javax.annotation.security.RolesAllowed
(v) @javax.servlet.annotation.WebServlet

A. (v) only
B. (i) and (v)
C. (i), (ii), (iii) and (v)
D. (i), (ii), (iv) and (v)
E. (i), (ii), (iii), (iv) and (v)

Correct Answer: B
Explanation/Reference:
* (i) The javax.annotation.Resource annotation is used to declare a reference to a resource. @Resource can
decorate a class, a field, or a method.
* (v) javax.servlet.annotation
Annotation Type WebServlet
Annotation used to declare a servlet.
This annotation is processed by the container at deployment time, and the corresponding servlet made
available at the specified URL patterns.
Incorrect:
* Not (II) : javax.annotation.PreDestroy
Target: Method

QUESTION 107

Which of the following are attributes of the annotation javax.servlet.annotation.WebFiler?
(i) Name
(ii) servletNames
(iii) urlPatterns
(iv) dispatcherTypes
(v) supportAsync

A. (iii) only
B. (iii) and (iv)
C. (ii), (iii) and (iv)
D. (iii), (iv) and (v)
E. (ii), (iii), (iv) and (v)

Correct Answer: B
Explanation/Reference:
* (iii) urlPatterns
The URL patterns to which the filter applies
* (iv) dispatcherTypes
The dispatcher types to which the filter applies
* (not V): asyncSupported
Declares whether the filter supports asynchronous operation mode.
Note:
* javax.servlet.annotation
Annotation Type WebFilter
Annotation used to declare a servlet filter.
This annotation is processed by the container at deployment time, and the corresponding filter applied to the
specified URL patterns, servlets, and dispatcher types.

QUESTION 106

You have built a web application that you license to small businesses. The webapp uses a context parameter,
called licenseExtension, which enables certain advanced features based on your client's license package.
When a client pays for a specific service, you provide them with a license extension key that they insert into the
< context-param> of the deployment descriptor. Not every client will have this context parameter so you need to
create a context listener to set up a default value in the licenseExtension parameter.
Which code snippet will accomplish this goal?

A. You cannot do this because context parameters CANNOT be altered programmatically.
B. 
    String ext = context.getParameter(`licenseExtension');
    if ( ext == null ) {
        context.setParameter(`licenseExtension' DEFAULT);
    }
C.
    String ext = context.getAttribute(`licenseExtension');
    if ( ext == null ) {
        context.setAttribute(`licenseExtension' DEFAULT);
    }
D.
    String ext = context.getInitParameter(`licenseExtension')
    if ( ext == null ) {
        context.resetInitParameter(`licenseExtension' DEFAULT);
    }
E.
    String ext = context.getInitParameter(`licenseExtension')
    if ( ext == null ) {
        context.setInitParameter(`licenseExtension' DEFAULT);
    }

Correct Answer: A

QUESTION 105

Given the fragment from Java EE deployment descriptor:
341. <error-page>
342. <exception-type>java.lang.Throwable</exception-type> 343. <location>/mainError.jsp</location>
344. </error-page>
345. <error-page>
346. <exception-type>java.lang.ClassCastException</exception-type> 347. <location>/castError.jsp</location>
348. </error-page>
If the web application associated with the fragment above throws a ClassCastException.
Which statement is true?

A. The deployment descriptor is invalid.
B. The container invokes mainError.jsp
C. The container invokes castError.jsp
D. Neither mainError.jsp nor castError.jsp is invoked.

Correct Answer: C

QUESTION 104

Given a web fragment jar file, where should we put the web fragment.xml inside the jar file?

A. WEB-INF
B. META-INF
C. WEB-INF/lib
D. WEB-INF/classes
E. META-INF/services

Correct Answer: C
Explanation/Reference:
* If you're dealing with web applications, /WEB-INF/lib is the portable place to put JARs. This is where web
servers servlet containers expect to find an application's jar files.
* The /WEB-INF/classes directory is on the ClassLoader's classpath. This is where .class files are loaded from
when the web application is executing. Any JAR files placed in the /WEB- INF/lib directory will also be placed on
the ClassLoader's classpath.

QUESTION 103

Given the portion of a valid Java EE web application's directory structure:

You want to know whether File1.html, File2.html, and/or File3.html is protected from direct access by your web
client's browsers. What statement is true?

A. All three files are directly accessible.
B. Only File1.html is directly accessible.
C. Only File2.html is directly accessible.
D. Only File3.html is directly accessible.
E. Only File1.html and File2.html are directly accessible.
F. Only File1.html and File3.html are directly accessible.
G. Only File2.html and File3.html are directly accessible.

Correct Answer: B
Explanation/Reference:
Note:
* WEB-INF is the folder just under the root of a WAR that holds information that you don't want to be accessible
to a client via a URL request. Specifically, it holds the web.xml, classes, and lib directories, but you can put
anything you want to hide from the client there.
* META-INF is what discriminates a JAR file from a plain ZIP file. It holds the manifest file and may hold other
deployment information as needed.

QUESTION 102

A web application uses a cookies to track a client as it navigates through the pages that constitutes the
application. Which code snippet can be used by the web application to reduce the chance of a cross-site
scripting attack by setting some property of the cookie before returning it to the client?

A. cookie.setHttpOnly(true)
B. cookie.setMaxAge(3600)
C. cookie.setPath("/")
D. cookie.setSecure(true)

Correct Answer: A
Explanation/Reference:
When HTTPOnly flag is assigned to a cookie, the browser will restrict the access to such Cookie from Java
Script code hence the cookie would only be sent to the subsequent request to server but cannot be accessed
using client side script. In such a case even if website is vulnerable to Cross Site Scripting (XSS) attacks, still
the browser would safeguard the data stored into cookies flagged as HTTPOnly.
Incorrect:
Not D: If Secure flag is set for Cookie then it may only be transmitted over secure channel (SSL/HTTPS)
ensuring that data is always encrypted while transmitting from client to server.

QUESTION 101

Which java code snippet checks whether the user is of the role "MANAGER" for a given HttpServRequest,
httpServletRequest?

A. httpServletRequest.isUserInRole("MANAGER");
B. httpServletRequest.isCallerInRole("MANAGER");
C. httpServletRequest.isPrincipalInRole("MANAGER");
D. httpServletRequest.isAuthnticatedUserInRole("MANAGER");

Correct Answer: A

Explanation/Reference:
isUserInRole
public boolean isUserInRole(java.lang.String role)
Returns a boolean indicating whether the authenticated user is included in the specified logical "role". Roles and
role membership can be defined using deployment descriptors. If the user has not been authenticated, the
method returns false.
Parameters:
role - a String specifying the name of the role
Returns:
a boolean indicating whether the user making this request belongs to a given role; false if the user has not been
authenticated
Incorrect:
Not B: isCallerInRole is depreciated.

QUESTION 100

Given this fragment in a servlet:
23. if(reg.isUserInRole("Admin")) {
24. // do stuff
25. }
And the following fragment from the related Java EE deployment descriptor:
812. <security-role-ref>
813. <role-name>Admin</role-name>
814. <role-link>Administrator</role-link>
815. </security-role-ref>
900. <security-role>
901. <role-name>Admin</role-name>
902. <role-name>Administrator</role-name>
903. </security-role>
What is the result?

A. Line 24 can never be reached.
B. The deployment descriptor is NOT valid.
C. If line 24 executes, the user's role will be Admin.
D. If line 24 executes, the user's role will be Administrator.
E. If line 24 executes, the user's role will NOT be predictable.

Correct Answer: D

QUESTION 99

Given:
3. class MyServlet extends HttpServlet {
4. public void doPut(HttpServletRequest req,
HttpServletResponse resp)
throws ServletException, IOException {
5. // servlet code here
.. .
26. }
27. }
If the DD contains a single security constraint associated with MyServlet and its only <http- method> tags and
<auth-constraint> tags are:
< http-method>GET</http-method>
< http-method>PUT</http-method>
< auth-constrain>Admin</auth-constrain>
Which four requests would be allowed by the container? (Choose four)

A. A user whose role is Admin can perform a PUT.
B. A user whose role is Admin can perform a GET.
C. A user whose role is Admin can perform a POST.
D. A user whose role is Member can perform a PUT.
E. A user whose role is Member can perform a POST.
F. A user whose role is Member can perform a GET.

Correct Answer: ABCE

QUESTION 98

Given the java code snippet in contextInitialized method of a ServletContextListner:
ServletRegistration.Dynamic sr = (ServletRegistration.Dynamic)sc.addServlet ("myServlet", myServletClass);
sr.addMapping("/abc");
sr.setServletSecurityElement(servletSecurityElement); sr.addMapping("/def");
Which statement is true?

A. "/abc" is mapped to "myservlet". The servletSecurityElementy applies to both "/abc" and "/def".
B. Both "/abc" and "/def" are mapped to "myservlet". The servletSecurityElementy applies to "/abc".
C. Both "/abc" and "/def" are mapped to "myservlet". The servletSecurityElementy applies to "/def".
D. Both "/abc" and "/def" are mapped to "myservlet". The servletSecurityElementy applies to both "/abc" and "/def".
E. Both "/abc" and "/def" are mapped to "myservlet". The servletSecurityElementy applies to "/abc", but the behavior for "/def" is not specified.

Correct Answer: E
Explanation/Reference:
Note:
* addMapping
public void addMapping(java.lang.String namespace,
java.lang.String name,
java.lang.Class clazz)
Defines a direct mapping from a namespace and name to a java class (and vice versa)

QUESTION 97

Which java code snippet roles "MANAGER" and "EMPLOYEE" in a given application?

A.
    @DeclareRoles({ "MANAGER", "EMPLOYEE" })
    public class MyServlet extends HttpServlet {}
B.
    @SecurityRoles({ "MANAGER", "EMPLOYEE" })
    public class MyServlet extends HttpServlet {}
C.
    @DeclareRoles("MANAGER")
     @DeclareRoles("EMPLOYEE")
    public class MyServlet extends HttpServlet {}
D.
    @DeclareRole("MANAGER")
    @DeclareRole("EMPLOYEE")
    public class MyServlet extends HttpServlet {}

Correct Answer: A

Explanation/Reference:
* The syntax for declaring more than one role is as shown in the following example:
@DeclareRoles({"Administrator", "Manager", "Employee"})
* @DeclareRoles
This annotation declares the security roles defined by the application.
* javax.annotation.security
Annotation Type DeclareRoles
@Documented
@Retention(value=RUNTIME)
@Target(value=TYPE)
public @interface DeclareRoles
Used by application to declare roles. It can be specified on a class.

QUESTION 96

Which security mechanism uses the concept of a realm?

A. authorization
B. data integrity
C. confidentiality
D. authentication

Correct Answer: D

QUESTION 95

Which Java expression can be used to check whether the web container is currently configured to track

A. servletContext.getSessionCookiesConfiq() .isHttpOnly()
B. servletContext.getSessionCookiesConfiq() .isSecure()
C. servletContext.getDefaultSessionTrackingModes() .contains(SessionTrackingMode.URL)
D. servletContext.getEffectiveSessionTrackingModes() .contains (SessionTrackingMode.URL)

Correct Answer: D

QUESTION 94

Which method must be used to encode a URL passed as an argument to HttpServletResponse. sendRedirect
when using URL rewriting for session tracking?

A. ServletResponse.encodeURL
B. HttpServletResponse.encodeURL
C. ServletResponse.encodeRedirectURL
D. HttpServletResponse.encodeRedirectURL

Correct Answer: D

QUESTION 93

Your web application requires the adding and deleting of many session attributes during a complex use case. A
bug report has come in that indicates that an important session attribute is being deleted too soon and a
NullPointerException is being thrown several interactions after the fact. You have decided to create a session
event listener that will log when attributes are being deleted so you can track down when the attribute is
erroneously being deleted. Which listener class will accomplish this debugging goal?

A. Create an HttpSessionAttributeListener class and implement the attributeDeleted method and log the attribute name using the getName method on the event object.
B. Create an HttpSessionAttributeListener class and implement the attributeRemoved method and log the attribute name using the getName method on the event object.
C. Create an SessionAttributeListener class and implement the attributeRemoved method and log the attribute name using the getAttributeName method on the event object.
D. Create an SessionAttributeListener class and implement the attributeDeleted method and log the attribute name using the getAttributeName method on the event object.

Correct Answer: B

QUESTION 92

Given the definition of Myobject and that an instance of Myobject is bound as a session attribute:
8. package com.example;
9. public class Myobject implements
10. javax.servlet.http.HttpSessionBindingListener {
11. // class body code here
12. }
Which is true?

A. Only a single instance of Myobject may exist within a session
B. The unbound method of the Myobject instance is called when the session to which it is bound times out
C. The com.example.MyObject must be declared as a servlet event listener in the web application deployment descriptor
D. The valueUnbound method of the Myobject instance is called when the session to which it is bound times out

Correct Answer: D

QUESTION 91

As a convenience feature, your web pages include an Ajax request every five minutes to a special servlet that
monitors the age of the user's session. The client-side JavaScript that handles the Ajax callback displays a
message on the screen as the session ages. The Ajax call does NOT pass any cookies, but it passes the
session ID in a request parameter called sessionID. In addition, assume that your webapp keeps a hasmap of
session objects by the ID. Here is a partial implementation of this servlet:
10. public class SessionAgeServlet extends HttpServlet {
11. public void service(HttpServletRequest request, HttpServletResponse) throws IOException {
12. String sessionID = request.getParameter("sessionID");
13. HttpSession session = getSession(sessionID);
14. long age = // your code here
15. response.getWriter().print(age);
16. }
.. . // more code here
47. }
Which code snippet on line 14, will determine the age of the session?

A. session.getMaxInactiveInterval();
B. session.getLastAccessed().getTime() session.getCreationTime().getTime();
C. session.getLastAccessedTime().getTime() session.getCreationTime().getTime();
D. session.getLastAccessed() - session.getCreationTime();
E. session.getMaxInactiveInterval() session.getCreationTime();
F. session.getLastAccessedTime() session.getCreationTime();

Correct Answer: F

QUESTION 90

Given an HttpServletRequest request:
22. String id = request.getParameter("jsessionid");
23. // insert code here
24. String name = (String) session.getAttribute("name")
Which three can be placed at line 23 to retrieve an existing HttpSession object? (Choose three)

A. HttpSession session = request.getSession();
B. HttpSession session = request.getSession(id);
C. HttpSession session = request.getSession(true);
D. HttpSession session = request.getSession(false);
E. HttpSession session = request.getSession("jsessionid");

Correct Answer: ACD