Computer Knowledge

Java Enterprise and Web Technologies

2,279 Questions

Java enterprise and web technologies questions focus on J2EE architecture, web services like SOAP, and servlet functionalities. These topics frequently appear in IT officer and specialist scale examinations. Regular practice ensures familiarity with enterprise application components.

HttpServlet methodsSOAP and web servicesEJB architecture rolesJ2EE componentsJSP servlet callingUDDI concepts

Java Enterprise and Web Technologies Questions

Multiple choice technology testing

The function to Load the Object Repository is present in which of the following “.vbs” File

  1. OSS_Main

  2. OSS_API

  3. OSS_DriverScript

  4. Every component “.vbs” file will have the function defined
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The OSS_API.vbs file contains the function for loading the Object Repository. This centralizes repository loading logic at the API level rather than duplicating it across each component's .vbs file or placing it in OSS_Main or OSS_DriverScript. The API file provides common functions that components can call as needed.

Multiple choice technology platforms and products

Which of the following components are present in all configured services?

  1. Service Package

  2. Service Architecture

  3. Service Method

  4. Service Activity
Reveal answer Fill a bubble to check yourself
A,C,D Correct answer
Explanation

In PRPC service configuration, three components are mandatory: Service Package (container for services), Service Method (defines the interface/operation), and Service Activity (contains the implementation logic). Service Architecture is not a standard component in PRPC service configuration.

Multiple choice technology packaged enterprise solutions

The default SAP AS Java communication ports for dispatcher and server process meet which of the following requirements:

  1. The port value can be any number.

  2. For each cluster element the ports begin with 50000+100*instance_number, where instance_number is a two digit number from 00 to 99 specifying the number of central instance and dialog instances.

  3. For each cluster element the ports begin with 50000+instance_number, where instance_number is a two digit number from 00 to 99 specifying the number of central instance and dialog instances.

  4. The port value is a number over 50000
Reveal answer Fill a bubble to check yourself
B,D Correct answer
Explanation

SAP AS Java ports are calculated as 50000 + 100*instance_number + port_offset, where the offset (0-99) identifies the service within each cluster element. The 100*instance_number multiplier ensures unique ranges for different instances, and all ports are above 50000. Port values cannot be 'any number' - they must follow this scheme.

Multiple choice technology packaged enterprise solutions

SAP AS Java Central Services Instance's Enque Server Port has the format (where NN is the instance number)

  1. 32NN

  2. 3NN2

  3. NN32

  4. 2NN3
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

The SAP Central Services Instance Enqueue Server uses port format 32NN, where NN is the instance number. For instance 00, this is port 3200. The Enqueue Server handles lock table management for SAP applications. Option B reverses the digits, option C has NN at the start, and option D uses 2 instead of 3.

Multiple choice technology packaged enterprise solutions

SAP AS Java Central Services Instance's Http message server port at Instance Number NN has the value

  1. 8NN1

  2. 81NN

  3. 82NN

  4. 8NN2
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

The HTTP Message Server port for SAP Central Services at instance number NN is 81NN. For instance 00, this is port 8100. The Message Server handles load balancing and client connection requests. Options A (8NN1), C (82NN), and D (8NN2) have incorrect digit placement.

Multiple choice technology packaged enterprise solutions

SAP AS Java installed on Instance number NN with DI (development infrastructure) usage type listens for Design Time Repository (DTR) connections on which of the follwing port:

  1. 5NN10

  2. 51NN5

  3. 515NN

  4. 5NN15
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

SAP AS Java with Development Infrastructure (DI) type uses port 5NN15 for Design Time Repository (DTR) connections. DTR stores version-controlled development objects. For instance 00, this is port 50015. Options A (5NN10), B (51NN5), and C (515NN) have incorrect digit arrangements.

Multiple choice technology web technology

What is a thin-client application?

  1. A browser that uses a plug-in to process user data.

  2. A distributed application where the client program does not process data, but instead passes data for processing to an enterprise bean running on an application server.

  3. An application that cannot be stopped by a firewall.

  4. An application compiled with the -thin option of the javac command.
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

A thin-client application is one where the bulk of the processing occurs on the server. The client is primarily responsible for the user interface and passing data to the server-side components (like enterprise beans) for logic execution.

Multiple choice technology security

Identify the line on which the vulnerability exists: 1 public class performSearchAction extends HttpServlet{ 2 // Servlet for Search Action 3 public void doPost(HttpServletRequest req, HttpServletResponse res) 4 { 5 try 6 { 7 ArrayList arrSearch = Util.performSearchAction(req, res); 8 req.setAttribute(“SearchResults”,arrSearch); 9 RequestDispatcher rd = getServletContext().getRequestDispatcher("/SearchResult.jsp"); 10 rd.forward(req,res); 11 } catch (Exception e) { 12 log.debug(“Exception occurred:”+e); 13 } 14 } //End of doPost method 15 public void doGet(HttpServletRequest req, HttpServletResponse res) 16 { 17 doPost(req,res); 18 } //End of doGet method 19 } //End of Class

  1. Line # 12

  2. Line # 9

  3. Line # 17

  4. Line # 8

  5. Line # 14, 18 & 19
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The vulnerability is on line 17 where doGet() calls doPost(), which forwards to a JSP page using unvalidated user input from the request. This creates an XSS vulnerability because attacker-controlled input from the original request gets reflected in the JSP output without sanitization. The forward on line 9 itself isn't vulnerable - it's the data flow through line 17.

Multiple choice technology security

Which attack(s) are possible in the below code: protected void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException { String name = req.getParameter("name"); ... out.println("hello " + name.trim()); }

  1. Reflected Cross Site Scripting

  2. Improper Error Handling

  3. Directory Listing

  4. Phishing

  5. Option 1 AND Option 2 AND Option 4

  6. Option 1 AND Option 2
Reveal answer Fill a bubble to check yourself
E Correct answer
Explanation

Printing unvalidated user input directly to the response output stream enables Reflected Cross-Site Scripting (XSS). Phishing is also possible through URL manipulation, and improper error handling could occur if exceptions are unhandled.

Multiple choice technology security

Identify the name of the vulnerability exist in the below code: 1 ... 2 public class ShowUserDetailsAction extends HttpServlet 3 { 4 private String currentUser; 5 public void doPost(HttpServletRequest req, HttpServletResponse res) 6 { 7 try 8 { 9 currentUser = req.getParameter("userID"); 10 RequestDispatcher rd = getServletContext().getRequestDispatcher ("/ShowDetails.jsp"); 11 if (!"".equals(currentUser)) 12 { 13 14 ArrayList userInfo = new ArrayList(); 15 LoginDAO objLoginDAO = new LoginDAO(); 16 userInfo = objLoginDAO.getUserInfo(currentUser); 17 18 if (userInfo!=null && (userInfo.size()!= 0)) 19 { 20 req.setAttribute("UserInfo", userInfo); 21 } 22 else 23 { 24 req.setAttribute("NoUser", "true"); 25 } 26 } 27 rd.forward(req,res); 28 } catch (Exception e) 29 { 30 log.debug(“Error Occurred:”+ e); 31 } 32 } 33 } 34 ...

  1. URL Tampering

  2. Brute Forcing

  3. Race Condition

  4. HTML Injection

  5. XSS
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

The code accepts a userID parameter directly from the request without validating whether the current user has permission to access that specific user's information. This allows any user to input any userID and view that user's details.

Multiple choice technology security

Identify the weakness in the below JSP file: 1 ... 2 3 4 <% 5 if("Admin".equals(session.getAttribute("user-type"))) 6 { 7 %> 8 9 <% 10 }%> 11 12 13 14 function doBack() 15 { 16 history.go(-1); 17 } 18 function doDelete() 19 { 20 document.forms[0].action="/DeleteUsersAction"; 21 document.forms[0].submit(); 22 } 23 24 ...

  1. SQL Injection

  2. Cross Site Scripting

  3. Broken Access Control

  4. Improper Resource Initialization
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Access control is implemented only on the client-side using JavaScript and conditional rendering. An attacker can bypass this by directly calling /DeleteUsersAction URL or modifying the client-side code. Authorization must always be validated server-side.

Multiple choice technology security

Identify the weakness in the below JSP file: 1 2 ... 3 Dear User, 4 5 If you liked our services, then you would like to refer it to your friends. 6 7 Click on the below link: 8 9 ";> "Refer a Friend"! 10 ... 11

  1. Information Disclosure

  2. Cross Site Scripting

  3. Usage of Risky Encryption

  4. All of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code uses Base64 encoding to obfuscate a redirect path. Base64 is a reversible encoding scheme, not encryption, representing a risky and weak attempt at securing sensitive parameters.

Multiple choice technology security

Following list shows entries in the web.xml deployment descriptor for Exception & Error Handling. Please identify which one is correct a. java.lang.Throwable /error.jsp b. 500 /error.jsp c. /error.jsp

  1. a

  2. b

  3. c

  4. a AND b

  5. a AND b AND c
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Option A handles all exceptions via Throwable to redirect to error.jsp. Option B catches HTTP 500 errors to redirect to the same page. Both are valid error-page configurations in web.xml. Option C is invalid because an error-page must specify either exception-type or error-code.

Multiple choice technology security

Choose the correct answer: a. Session Timeouts can be defined in the web.xml as below: Time-in-minutes b. Session Timeouts can be defined in the server.xml as below: Time-in-minutes c. Session Timeouts cannot be defined in the deployment descriptor

  1. a

  2. b

  3. c

  4. a AND b
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Session timeout is configured in web.xml within the session-config element. This is the standard deployment descriptor for Java web applications. Server.xml is for server-wide global settings, not application-specific session configuration.

Multiple choice technology security

Choose the correct answer about the following code: public class SetCookie extends HttpServlet { public void doGet (HttpServletRequest req, HttpServletResponse res) { Cookie cookie = new Cookie ("Session Cookie”, req.getParameter(“value”)); cookie.setMaxAge (3600); response.addCookie (cookie); } ...

  1. 3600 is beyond the limit

  2. It is not recommended as it is using Persistent Cookies

  3. It leads to Cookie Poisoning Attack

  4. Option 1 AND Option 2

  5. Option 2 AND Option 3

  6. Option 1 AND Option 2 AND Option 3
Reveal answer Fill a bubble to check yourself
E Correct answer
Explanation

Using unvalidated user input directly in a cookie value enables cookie manipulation attacks. Setting MaxAge to 3600 seconds creates a persistent cookie stored across sessions, which amplifies the attack surface compared to session cookies.