Java Enterprise and Web Technologies

java.security is the correct Java API that provides the security framework. It includes classes and interfaces for authentication, authorization, encryption, digital signatures, and other security features. java.io is for I/O operations, java.rmi is for remote method invocation, making java.security the only security-related package among the options.

The FTP Site location option in Visual Studio enables direct deployment to remote web servers via FTP. This allows you to create and modify ASP.NET applications on a remote server as if working locally, with changes synchronized automatically through the FTP connection.

Session_Start fires when a new user session begins, which happens on the first request from a user. Application_Start runs once when the application starts (not per user), Application_BeginRequest fires on every request, and Session_OnBegin is not a valid event name - the correct syntax is Session_Start.

MMExecute() is the specific ActionScript function that allows executing Flash JavaScript API (JSAPI) commands from within ActionScript. This enables communication between ActionScript and the Flash authoring environment or Flash Player. The other functions listed (_execute() and the options) are not standard ActionScript/Flash JSAPI functions.

EJB 2.0 spec restricts beans to managed container environments: they cannot act as socket servers (C) because the container manages all network resources, and cannot use java.io (D) to prevent direct file system access. Option A is false - beans can use Sockets (as clients), and B is false - instance variables can be static/final.

All listed statements are FALSE: home interfaces can be reused (not single-use), session beans share one EJBHome (not per-instance), InitialContext narrowing is implementation-specific (not universal), and local clients DO need home interfaces for certain operations. Therefore F (None of the above) is correct.

In EJB, remote references (R) can be passed to local clients (L) because remote interfaces are designed for network serialization. However, local references (L) cannot be passed to remote clients - local interfaces are not serializable and exist only within the same JVM. Option C correctly notes that whether L can call methods on R depends on R's actual type and location - this isn't about the local/remote client distinction but about the specific object being referenced. L can always call methods on B since that's its designated session bean.

A stateful bean is instantiated when the client calls create on its home interface, and a stateless bean’s create call may not result in a new instance because the container can pool instances. The other statements misstate removal semantics or client capabilities.

The isCallerInRole() method requires an established security context, which is available only after setSessionContext() has been called. For stateless session beans, ejbCreate() is called BEFORE setSessionContext(), so the security context isn't available yet. For stateful session beans, setSessionContext() is called BEFORE ejbCreate(), making the security context available. The setSessionContext() method itself cannot call isCallerInRole() because the context is still being initialized.

The EJB container is responsible for calling lifecycle methods like ejbCreate() when a client invokes a create method. The container also provides implementations of context interfaces like EJBContext (specifically SessionContext for session beans). The bean developer is responsible for implementing the SessionBean interface, setSessionContext(), and ejbRemove() methods - these are part of the bean class code.

Option A is incorrect because the container manages stateful session beans in a pool - ejbRemove() makes the instance eligible for pooling, not immediate garbage collection. Option B is incorrect because stateful session beans can be created through various means including dependency injection or lookups, not just explicit client create calls. Option C is incorrect because security context isn't available in ejbCreate() for stateless beans. Option D is correct - setSessionContext() is called exactly once per bean instance when it's first created.

During setSessionContext(), the bean is still being initialized and doesn't have access to other beans or their methods. The security context and environment resources are not yet fully available. In ejbCreate(), ejbRemove(), and ejbPassivate(), the bean is fully initialized and can interact with other beans. This restriction applies specifically to the context initialization phase.

When a client invokes a session bean that no longer exists, the exception depends on the client type. Local clients receive javax.ejb.NoSuchObjectLocalException. Remote clients receive java.rmi.NoSuchObjectException (a RemoteException subtype). Option B's NoSuchObjectException and Option C's RemoveException are incorrect exception types. Option D's ObjectNotFoundException is typically for database operations, not EJB invocations.

The SessionContext interface defines methods for transaction control and EJB home access, including getRollbackOnly() and getEJBHome(). Lifecycle methods such as ejbCreate, ejbActivate, and setSessionContext belong to SessionBean or its ancestors, not SessionContext, so they are incorrect.

Calling remove() on an entity bean's component interface deletes the underlying entity from the database. The bean instance itself is not deleted - it's returned to the pool for reuse. Option C is incorrect because the entity is actually removed, not dissociated. Option D is incorrect because the remove operation is significant and not ignored.