Computer Knowledge

Java Enterprise and Web Technologies

2,183 Questions

Java enterprise and web technologies questions focus on J2EE architecture, web services like SOAP, and servlet functionalities. These topics frequently appear in IT officer and specialist scale examinations. Regular practice ensures familiarity with enterprise application components.

HttpServlet methodsSOAP and web servicesEJB architecture rolesJ2EE componentsJSP servlet callingUDDI concepts

Java Enterprise and Web Technologies Questions

Multiple choice technology programming languages

Which of the following statements are true about the given method declaration? MyEJBObject createWithName(String name) throws CreateException, RemoteException

  1. It is declared in the local home interface of a stateful session bean.

  2. It is declared in the local home interface of a stateless session bean.

  3. It is declared in the remote home interface of a stateful session bean.

  4. It is declared in the remote home interface of a stateless session bean.
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The method signature shows RemoteException in the throws clause, which is only present in remote interfaces (local interfaces don't throw RemoteException). The create method with parameters can be used by stateful session beans to initialize state during creation, whereas stateless session beans typically have no-arg create methods.

Multiple choice technology programming languages

Select all correct statements.

  1. EJBs are not allowed to open a socket to connect to a FTP server and download a document.

  2. EJBs are not allowed to log an error to a file on disk.

  3. EJBs are allowed to install a new security manager when they have to perform highly secure jobs.

  4. EJBs are allowed to invoke Class.getResource in order to retrieve bundled resources (images, texts, properties, etc).

  5. EJBs are allowed to create small java.awt.Window components in order to display business processing errors or exception messages.

  6. EJBs are allowed to spawn their own threads in order to perform some time-consuming tasks, for example.
Reveal answer Fill a bubble to check yourself
B,D Correct answer
Explanation

According to the EJB specification restrictions, beans are not allowed to access the local file system directly or manage security properties. They are allowed to retrieve resources using Class.getResource. Other options like creating AWT windows or spawning threads are strictly prohibited.

Multiple choice technology programming languages

Which of the following combinations (Design Pattern - Functionality) regarding Design Patterns is correct?

  1. Business Delegate - Reduces the coupling between presentation-tier clients and business services.

  2. Data Access Object - Multiple View using the same model.

  3. MVC - Enables easier migration to different persistence storage implementation.

  4. Value Object - Reduces Network Traffic
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The Value Object (or Transfer Object) pattern reduces network traffic by grouping multiple attributes into a single object transfer, minimizing remote calls. Business Delegate abstracts business service lookups, DAO abstracts data persistence, and MVC decouples model, view, and controller components.

Multiple choice technology security

What is the method name of the Java Class "Cookie" to be used to indicate to the browser whether the cookie should only be sent using a secure protocol, such as HTTPS or SSL?

  1. setSSL()

  2. setCookieSSL()

  3. setCookieSecure()

  4. setSecure()
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The Java javax.servlet.http.Cookie class provides the setSecure(boolean flag) method to signal to the browser that the cookie should only be sent over secure protocols like HTTPS. Other options like setSSL, setCookieSSL, and setCookieSecure do not exist in the standard Servlet API.

Multiple choice technology security

Which of the following API's associates a Subject with the thread of execution?

  1. Subject.doAs ()

  2. AccessController.checkPermission()

  3. SecurityManager.checkAccess()

  4. None of the above
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Subject.doAs() executes a specified action as a particular JAAS Subject, associating it with the current thread of execution. Other methods like checkPermission() and checkAccess() only verify authorization policies and do not bind or manage user identities on threads.

Multiple choice technology security

List the correct entries in the web.xml deployment descriptor for Exception & Error Handling

  1. <error-page> <exception-type>java.lang.Throwable</exception-type> <location>/error.jsp</location> </error-page>

  2. <error-page> <error-code>500</error-code> <location>/error.jsp</location> </error-page>

  3. <error-page> <location>/error.jsp</location> </error-page>

  4. a & b
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

web.xml error-page configuration can handle both exceptions (via exception-type) and HTTP error codes (via error-code). Option A shows exception-type configuration for Throwable. Option B shows error-code configuration for 500 errors. Option C is missing required elements. Both A and B are correct entries.

Multiple choice technology security

Choose the correct answer:

  1. HTTP PUT & DELETE method can be disabled in web.xml from the below code: <Web-resource-collection> <web-resource-name>Disallowed Location</web-resource-name> <url-pattern>/*</url-pattern> <http-method>PUT</http-m

  2. HTTP PUT & DELETE methods are disabled by default

  3. HTTP PUT & DELETE methods should not be disabled

  4. HTTP PUT & DELETE methods cannot be disabled
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

HTTP methods like PUT and DELETE can be restricted in web.xml using security-constraint with http-method elements. Option A shows the correct syntax for disabling PUT (though truncated in the content). PUT and DELETE are enabled by default in servlet containers and should be explicitly disabled if not needed for REST APIs.

Multiple choice technology security

Identify the line on which the vulnerability exists:

1 public class performSearchAction extends HttpServlet{ 
2 // Servlet for Search Action  
3  public void doPost(HttpServletRequest req, HttpServletResponse res)  
4  { 
5   try 
6   { 
7       ArrayList arrSearch =  Util.performSearchAction(req, res); 
8       req.setAttribute(“SearchResults”,arrSearch); 
9       RequestDispatcher rd = getServletContext().getRequestDispatcher("/SearchResult.jsp"); 
10      rd.forward(req,res); 
11  } catch (Exception e) { 
12               log.debug(“Exception occurred:”+e); 
13               } 
14  } //End of doPost method 
15  public void doGet(HttpServletRequest req, HttpServletResponse res) 
16  { 
17    doPost(req,res); 
18  } //End of doGet method 
19 } //End of Class

  1. Line # 12

  2. Line # 9

  3. Line # 17

  4. Line # 8
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Line 17 delegates doGet requests directly to doPost. Accepting state-changing requests (like search or database queries) via GET requests without CSRF protection exposes the system to Cross-Site Request Forgery or caching issues. However, the question lacks clear security context, making it potentially controversial.

Multiple choice technology security

Identify the name of the vulnerability exist in the below code: 

1 ...   
2 public class ShowUserDetailsAction extends HttpServlet   
3 {   
4 private String currentUser;     
5 public void doPost(HttpServletRequest req, HttpServletResponse res)   
6 {   
7 try   
8 {   
9  currentUser = req.getParameter("userID");  
10  RequestDispatcher rd = getServletContext().getRequestDispatcher ("/ShowDetails.jsp");  
11  if (!"".equals(currentUser))  
12  {  
13     
14   ArrayList userInfo = new ArrayList();  
15   LoginDAO objLoginDAO = new LoginDAO();  
16   userInfo = objLoginDAO.getUserInfo(currentUser);  
17     
18   if (userInfo!=null &amp;&amp; (userInfo.size()!= 0))  
19   {  
20    req.setAttribute("UserInfo", userInfo);  
21   }  
22   else  
23   {  
24    req.setAttribute("NoUser", "true");  
25   }  
26  }  
27  rd.forward(req,res);  
28 } catch (Exception e)  
29 {  
30  log.debug(“Error Occurred:”+ e);  
31 }  
32 }  
33 }   
34 ...

  1. URL Tampering

  2. Brute Forcing

  3. Race Condition

  4. HTML Injection
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The servlet uses a shared instance variable currentUser (line 4) to store state across requests. Because servlets are singletons by default and handle multiple concurrent threads, this leads to a race condition where one user's ID can overwrite another's, disclosing incorrect data.

Multiple choice technology security

Identify the weakness in the below JSP file: 

1  ...   
2     
3    
4  &lt;%   
5  if("Admin".equals(session.getAttribute("user-type")))   
6  {   
7  %&gt;   
8     
9  &lt;%  
10  }%&gt;  
11    
12   
13    
14  function doBack()  
15  {  
16   history.go(-1);  
17  }  
18  function doDelete()  
19  {  
20   document.forms[0].action="/DeleteUsersAction";  
21   document.forms[0].submit();  
22  }  
23    
24  ...

  1. SQL Injection

  2. Cross Site Scripting

  3. Broken Access Control

  4. Improper Resource Initialization
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code checks the session for the 'Admin' role to decide whether to render the 'Delete Users' button. However, the action endpoint /DeleteUsersAction is triggered via client-side JavaScript without verifying permission on the server side, representing a broken access control vulnerability.

Multiple choice technology security

Identify the weakness in the below JSP file:

1    
2  ...   
3  Dear User,   
4    
5  If you liked our services, then you would like to refer it to your friends.   
6    
7  Click on the below link:    
8    
9  <a href="/CWE/ReferAFriendAction?pageRedirect=">"&gt;  "Refer a Friend"!</a>  10  ...  
11

  1. Information Disclosure

  2. Cross Site Scripting

  3. Usage of Risky Encryption

  4. All of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code uses Base64 encoding to obfuscate the redirect URL. Base64 is a reversible encoding scheme, not encryption, representing a usage of risky/non-existent encryption to secure sensitive parameter values. Since other options are also relevant, 'Usage of Risky Encryption' is the specific implementation flaw shown here.