Java Enterprise and Web Technologies

isUserInRole(String role) is used to check if the authenticated user belongs to a specified security role. The element in the DD maps a role name used in code (like isUserInRole calls) to an actual security role defined in the container. getUserPrincipal() returns the Principal object, getCookies() retrieves cookies, and getHeader() reads HTTP headers - none of these relate to role-based security reference mapping.

Form-based authentication requires a specific HTML form with action j_security_check, username field j_username, and password field j_password. The container requires this exact HTML structure to handle the authentication process. Basic, Digest, and Client Certificate authentication use HTTP headers or SSL certificates - they don't require application-provided HTML forms with specific action attributes.

The Transfer Object pattern (also called Value Object) creates a serializable object containing multiple data items that can be sent to the client in a single method call instead of multiple fine-grained calls. This reduces network roundtrips between client and EJB. MVC is about separation of concerns, Business Delegate reduces coupling between presentation tier and business tier, and Intercepting Filter is about request/response preprocessing.

HttpServlet provides doGet(), doPost(), doHead(), doPut(), doDelete(), doOptions(), doTrace(), and do methods for other HTTP verbs. These are the standard service methods you override to handle specific HTTP request types. doError() is not a valid HttpServlet method - error handling is done through HttpServletResponse.sendError() or error-page configuration.

The 'application' implicit object in JSP represents the ServletContext and provides access to application-scope attributes. ServletContext is the object that stores application-wide data and attributes accessible across all sessions. 'request' is for request scope, 'server' is not a standard JSP implicit object, and 'context' is not used for this purpose in JSP.

EJB 2.0 containers must provide transaction management across all bean types to ensure data integrity. JNDI 1.2 namespace support is mandatory for resource lookup and naming services. GUI deployment tools are vendor-specific conveniences, not specification requirements. Remote client views are optional - beans can have local-only interfaces.

EJB 2.0 introduced several major enhancements: EJB QL for portable finder queries (eliminating the need for Finder methods in home interfaces), enhanced container-managed persistence with relationships (CMR), local interfaces to avoid remote call overhead for co-located beans, and standardized XML deployment descriptors. Local interfaces apply to both session and entity beans, improving performance for in-process calls.

Container-managed relationships (CMR) in EJB 2.0 support one-to-one, one-to-many, and many-to-many relationships between entity beans. Get methods for relationships return java.util.Collection or java.util.Set, not Map. Remote interfaces are NOT required - local interfaces work fine. Entity beans can only have CMR relationships with other entity beans, not message-driven beans.

When a remote client invokes a method on an entity bean that has been removed, the container throws javax.rmi.NoSuchObjectException. This differs from local client views (which throw NoSuchObjectLocalException) and is specifically for RMI-based remote invocations. The exception indicates the referenced EJB object no longer exists.

EJB QL (EJB Query Language) supports parameters in queries using positional syntax (?1, ?2, etc.). The FROM clause designates the query domain (the entity abstract schema types), not SELECT. The WHERE clause filters results but doesn't determine types - that's FROM's job. Both FROM and SELECT are typically required (SELECT can be optional only for aggregate queries).

The JSP page directive syntax is <%@ page attributeName="value" %>. This is the standard JSP 1.2 and later syntax for declaring page directives. Multiple attributes can be included in a single directive, or multiple directives can be used. The statement shown is syntactically correct.

The TRACE method echoes the received request back to the client so they can see what the intermediate servers received. It's used for debugging and diagnostic purposes - the final server sends back essentially the same request message it received. OPTIONS asks for available communication options, HEAD returns only headers, and DEBUG is not a standard HTTP method.

In a WAR file, compiled Java classes must be stored in /WEB-INF/classes directory following the standard WAR structure. This is part of the servlet specification. The /classes, /META-INF/classes, and /root/classes paths are not standard locations for compiled classes in a WAR file.

The HttpServletResponse interface has a setContentType(String) method that sets the content type of the response. This method is used to specify the MIME type (like text/html, application/json) and optionally the character encoding. The other options (setResponseContentType, setContent, setType) are not valid methods in HttpServletResponse.

JSF (JavaServer Faces) is a Java web application framework for building component-based user interfaces. It simplifies web development by providing reusable UI components, managing state, and handling server-side logic. It is NOT a programming language (A), protocol (B), or web server (D) - it's a framework that runs on web servers.