Java Core Classes and Threads

The isAuthorizedForData() method returns a boolean because authorization checks result in a yes/no decision - either the subject has permission to access the data or they don't. This is the standard return type for authorization methods across security frameworks.

CSRF tokens are typically generated as random strings that are included in forms or requests and validated on the server. String is the standard return type for token generation methods because tokens need to be transportable in HTTP headers, form fields, or URLs. Numeric types would not serve this purpose.

The sign() method takes only the data parameter and throws SecurityException because signing operations are critical security operations that can fail for various reasons (invalid key format, cryptographic errors, etc.). Unlike method A which incorrectly requires a key parameter, the signature method implies the key is managed internally. Option C is incorrect because signing can fail and should signal errors.

The seal() method signature includes both the data and timestamp parameters, throwing SecurityException because cryptographic sealing operations can fail. The timestamp is essential for implementing expiration, as described in the seal() functionality. Option B incorrectly specifies EncryptionException - security API methods throw SecurityException to signal security-related failures.

When encoding user input for URLs, you must encode only the parameter value, not the entire URL string. encodeForURL applied to the whole URL (option B) would break the URL structure. encodeForJavaScript (option A) is for JavaScript context, not URLs. Option C correctly encodes only the dangerous user input portion before concatenating it with the safe URL structure.

SecurityException is the most common exception thrown by validation methods in the security API because it serves as the base class for security-related failures. When validation fails due to security violations (invalid input, malicious patterns, policy violations), the API throws SecurityException or its subclasses. Validation, Encoding, and Encryption exceptions are not standard exception types in this API.

EnterpriseSecurityException is the base class for all security-related exceptions in the TCS security API. It provides a common ancestor for specific security exceptions like authorization failures, validation errors, and authentication issues. SecurityException alone might not capture the enterprise context, and EnterpriseException is too broad for security-specific failures.

To prevent Path Traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName() which validate that paths don't contain dangerous patterns like '../' or absolute paths. These methods check if the input is safe for the given context before allowing file system access. Path traversal attacks attempt to access files outside the intended directory, so validating both directory paths and filenames is essential defense.

Blacklist validation is weak because attackers can bypass it using various character encoding techniques: URL encoding, Unicode encoding, hex encoding, double-encoding, mixed encoding, and case variation. It's impossible to enumerate every possible malicious pattern. Options A and C are incorrect - the issue isn't about hard-coding or POST methods. Option D describes whitelist validation, not blacklist.

HashMap allows null keys and null values, whereas Hashtable does not permit either. Hashtable is synchronized (thread-safe) while HashMap is unsynchronized, making HashMap faster for non-concurrent use. The key distinction is HashMap's null support and Hashtable's legacy synchronized design.

Cloneable is a marker interface - it has no methods and serves only to flag that an object can be cloned. Collection, Reader, and Runnable all declare methods. Marker interfaces like Cloneable, Serializable, and Remote are used to signal special JVM treatment rather than define behavior contracts.

GetROProperty (Get Runtime Object Property) retrieves the current actual property value of objects from the application during runtime. GetTOProperty gets test object properties (descriptive), while GetVisibleText retrieves visible text content.

GetItemsCount() is the standard QTP method for retrieving the number of items in a list box or combo box. GetCount and GetItemCount are not valid QTP methods.

Java has no sizeof operator or built-in way to get object size at runtime. The malloc method doesn't exist in Java (memory management is automatic), and Object class has no getObjectSize method. Object size is implementation-dependent and not directly accessible.

When you call a static method on a null reference (x.m() where x is null and m is static), Java doesn't throw NullPointerException because static methods are bound to the class, not the instance. The other options are false: null instanceof Object is false, and passing null to anonymous inner class constructor is generally problematic.