Computer Knowledge

Java Enterprise and Web Technologies

2,279 Questions

Java enterprise and web technologies questions focus on J2EE architecture, web services like SOAP, and servlet functionalities. These topics frequently appear in IT officer and specialist scale examinations. Regular practice ensures familiarity with enterprise application components.

HttpServlet methodsSOAP and web servicesEJB architecture rolesJ2EE componentsJSP servlet callingUDDI concepts

Java Enterprise and Web Technologies Questions

Multiple choice technology programming languages

Select all correct statements.

  1. EJBs are not allowed to open a socket to connect to a FTP server and download a document.

  2. EJBs are not allowed to log an error to a file on disk.

  3. EJBs are allowed to install a new security manager when they have to perform highly secure jobs.

  4. EJBs are allowed to invoke Class.getResource in order to retrieve bundled resources (images, texts, properties, etc).

  5. EJBs are allowed to create small java.awt.Window components in order to display business processing errors or exception messages.

  6. EJBs are allowed to spawn their own threads in order to perform some time-consuming tasks, for example.
Reveal answer Fill a bubble to check yourself
B,D Correct answer
Explanation

According to the EJB specification restrictions, beans are not allowed to access the local file system directly or manage security properties. They are allowed to retrieve resources using Class.getResource. Other options like creating AWT windows or spawning threads are strictly prohibited.

Multiple choice technology programming languages

Which of the following combinations (Design Pattern - Functionality) regarding Design Patterns is correct?

  1. Business Delegate - Reduces the coupling between presentation-tier clients and business services.

  2. Data Access Object - Multiple View using the same model.

  3. MVC - Enables easier migration to different persistence storage implementation.

  4. Value Object - Reduces Network Traffic
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The Value Object (or Transfer Object) pattern reduces network traffic by grouping multiple attributes into a single object transfer, minimizing remote calls. Business Delegate abstracts business service lookups, DAO abstracts data persistence, and MVC decouples model, view, and controller components.

Multiple choice technology security

What is the method name of the Java Class "Cookie" to be used to indicate to the browser whether the cookie should only be sent using a secure protocol, such as HTTPS or SSL?

  1. setSSL()

  2. setCookieSSL()

  3. setCookieSecure()

  4. setSecure()
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The Java javax.servlet.http.Cookie class provides the setSecure(boolean flag) method to signal to the browser that the cookie should only be sent over secure protocols like HTTPS. Other options like setSSL, setCookieSSL, and setCookieSecure do not exist in the standard Servlet API.

Multiple choice technology security

As per the JavaScript Security Model,scripts can interact only with elements that originate from the same server as the page to which the script belongs.This is commonly known as

  1. Same Source Policy

  2. Same Server Policy

  3. Same Domain Policy

  4. Same Origin Policy
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The Same-Origin Policy (SOP) restricts scripts on one page from accessing sensitive data on another unless they share the same scheme, host, and port. The other options are incorrect terms.

Multiple choice technology security

Using a custom build process to enable specific features in the Apache Web server is an example of what design principle?

  1. Least Privilege

  2. Leveraging existing components

  3. Economy of mechanism

  4. Fail safe
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Economy of mechanism advocates for simple, small designs to minimize attack surface. By custom building Apache to include only necessary features, complexity is reduced. Least privilege applies to user permissions, fail-safe defines default secure states, and leveraging components reuses code.

Multiple choice technology security

Which of the following API's associates a Subject with the thread of execution?

  1. Subject.doAs ()

  2. AccessController.checkPermission()

  3. SecurityManager.checkAccess()

  4. None of the above
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Subject.doAs() executes a specified action as a particular JAAS Subject, associating it with the current thread of execution. Other methods like checkPermission() and checkAccess() only verify authorization policies and do not bind or manage user identities on threads.

Multiple choice technology security

List the correct entries in the web.xml deployment descriptor for Exception & Error Handling

  1. <error-page> <exception-type>java.lang.Throwable</exception-type> <location>/error.jsp</location> </error-page>

  2. <error-page> <error-code>500</error-code> <location>/error.jsp</location> </error-page>

  3. <error-page> <location>/error.jsp</location> </error-page>

  4. a & b
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

web.xml error-page configuration can handle both exceptions (via exception-type) and HTTP error codes (via error-code). Option A shows exception-type configuration for Throwable. Option B shows error-code configuration for 500 errors. Option C is missing required elements. Both A and B are correct entries.

Multiple choice technology security

Choose the correct answer:

  1. HTTP PUT & DELETE method can be disabled in web.xml from the below code: <Web-resource-collection> <web-resource-name>Disallowed Location</web-resource-name> <url-pattern>/*</url-pattern> <http-method>PUT</http-m

  2. HTTP PUT & DELETE methods are disabled by default

  3. HTTP PUT & DELETE methods should not be disabled

  4. HTTP PUT & DELETE methods cannot be disabled
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

HTTP methods like PUT and DELETE can be restricted in web.xml using security-constraint with http-method elements. Option A shows the correct syntax for disabling PUT (though truncated in the content). PUT and DELETE are enabled by default in servlet containers and should be explicitly disabled if not needed for REST APIs.

Multiple choice technology security

Identify the line on which the vulnerability exists:

1 public class performSearchAction extends HttpServlet{ 
2 // Servlet for Search Action  
3  public void doPost(HttpServletRequest req, HttpServletResponse res)  
4  { 
5   try 
6   { 
7       ArrayList arrSearch =  Util.performSearchAction(req, res); 
8       req.setAttribute(“SearchResults”,arrSearch); 
9       RequestDispatcher rd = getServletContext().getRequestDispatcher("/SearchResult.jsp"); 
10      rd.forward(req,res); 
11  } catch (Exception e) { 
12               log.debug(“Exception occurred:”+e); 
13               } 
14  } //End of doPost method 
15  public void doGet(HttpServletRequest req, HttpServletResponse res) 
16  { 
17    doPost(req,res); 
18  } //End of doGet method 
19 } //End of Class

  1. Line # 12

  2. Line # 9

  3. Line # 17

  4. Line # 8
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Line 17 delegates doGet requests directly to doPost. Accepting state-changing requests (like search or database queries) via GET requests without CSRF protection exposes the system to Cross-Site Request Forgery or caching issues. However, the question lacks clear security context, making it potentially controversial.

Multiple choice technology security

Identify the name of the vulnerability exist in the below code: 

1 ...   
2 public class ShowUserDetailsAction extends HttpServlet   
3 {   
4 private String currentUser;     
5 public void doPost(HttpServletRequest req, HttpServletResponse res)   
6 {   
7 try   
8 {   
9  currentUser = req.getParameter("userID");  
10  RequestDispatcher rd = getServletContext().getRequestDispatcher ("/ShowDetails.jsp");  
11  if (!"".equals(currentUser))  
12  {  
13     
14   ArrayList userInfo = new ArrayList();  
15   LoginDAO objLoginDAO = new LoginDAO();  
16   userInfo = objLoginDAO.getUserInfo(currentUser);  
17     
18   if (userInfo!=null &amp;&amp; (userInfo.size()!= 0))  
19   {  
20    req.setAttribute("UserInfo", userInfo);  
21   }  
22   else  
23   {  
24    req.setAttribute("NoUser", "true");  
25   }  
26  }  
27  rd.forward(req,res);  
28 } catch (Exception e)  
29 {  
30  log.debug(“Error Occurred:”+ e);  
31 }  
32 }  
33 }   
34 ...

  1. URL Tampering

  2. Brute Forcing

  3. Race Condition

  4. HTML Injection
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The servlet uses a shared instance variable currentUser (line 4) to store state across requests. Because servlets are singletons by default and handle multiple concurrent threads, this leads to a race condition where one user's ID can overwrite another's, disclosing incorrect data.

Multiple choice technology security

Identify the weakness in the below JSP file: 

1  ...   
2     
3    
4  &lt;%   
5  if("Admin".equals(session.getAttribute("user-type")))   
6  {   
7  %&gt;   
8     
9  &lt;%  
10  }%&gt;  
11    
12   
13    
14  function doBack()  
15  {  
16   history.go(-1);  
17  }  
18  function doDelete()  
19  {  
20   document.forms[0].action="/DeleteUsersAction";  
21   document.forms[0].submit();  
22  }  
23    
24  ...

  1. SQL Injection

  2. Cross Site Scripting

  3. Broken Access Control

  4. Improper Resource Initialization
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code checks the session for the 'Admin' role to decide whether to render the 'Delete Users' button. However, the action endpoint /DeleteUsersAction is triggered via client-side JavaScript without verifying permission on the server side, representing a broken access control vulnerability.

Multiple choice technology security

Identify the weakness in the below JSP file:

1    
2  ...   
3  Dear User,   
4    
5  If you liked our services, then you would like to refer it to your friends.   
6    
7  Click on the below link:    
8    
9  <a href="/CWE/ReferAFriendAction?pageRedirect=">"&gt;  "Refer a Friend"!</a>  10  ...  
11

  1. Information Disclosure

  2. Cross Site Scripting

  3. Usage of Risky Encryption

  4. All of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code uses Base64 encoding to obfuscate the redirect URL. Base64 is a reversible encoding scheme, not encryption, representing a usage of risky/non-existent encryption to secure sensitive parameter values. Since other options are also relevant, 'Usage of Risky Encryption' is the specific implementation flaw shown here.

Multiple choice technology security

Authentication and session management are security concerns of which programming language?

  1. C

  2. Java

  3. .NET

  4. Managed Code
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

To solve this question, the user needs to have knowledge about security concerns related to programming languages.

Authentication and session management are security concerns that are relevant to web applications. They ensure that users are who they claim to be and that the information stored on the server is secure.

Now, let's go through each option and explain why it is right or wrong:

A. Java: This option is correct. Java is a popular programming language for web applications, and it has built-in features for authentication and session management. Java web applications use a session ID to identify each user's session, and the server uses this ID to retrieve the user's session data.

B. .NET: This option is also correct. .NET is a framework for building web applications, and it includes features for authentication and session management. .NET web applications use cookies to store session information, and the server retrieves this information using the session ID in the cookie.

C. Managed Code: This option is too broad to be correct or incorrect. Managed code refers to code that is executed by a runtime environment, such as Java or .NET. While both Java and .NET use managed code, this option does not specify which language or framework is being referred to.

D. C: This option is incorrect. C is a programming language that is not commonly used for web applications, and it does not have built-in features for authentication and session management. While it is possible to implement these features in C, it would require more manual coding than using a language like Java or .NET.

The Answer is: A or B

Multiple choice technology security

What provides a standard for Web application security and summarizes primary Web application security vulnerabilities based on input from security experts?

  1. The British Standards Institute (BSI) 7799

  2. ISO 27002

  3. The Open Web Application Security Project (OWASP) Top Ten Project

  4. TSP-Secure
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The OWASP Top Ten Project is the widely recognized standard that lists and explains the most critical security vulnerabilities for web applications based on consensus from security experts. ISO 27002 and BSI 7799 are broader information security standards, and TSP-Secure is not a standard web vulnerability list.