Computer Knowledge

Java Enterprise and Web Technologies

2,183 Questions

Java enterprise and web technologies questions focus on J2EE architecture, web services like SOAP, and servlet functionalities. These topics frequently appear in IT officer and specialist scale examinations. Regular practice ensures familiarity with enterprise application components.

HttpServlet methodsSOAP and web servicesEJB architecture rolesJ2EE componentsJSP servlet callingUDDI concepts

Java Enterprise and Web Technologies Questions

Multiple choice technology security

Given url – http://www.abc.com/viewpage.jsp?page=catalog&productid=12345 where page parameter indicate a unique page and the productid retrieves pages for a particular product. How would you optimally configure appscan to test this application? Choose 2 answers

  1. Track the page parameter

  2. Set the link limit to 2

  3. Set the redundant path limit to 5

  4. Ignore the productid parameter
Reveal answer Fill a bubble to check yourself
A,D Correct answer
Explanation

Tracking the page parameter allows AppScan to recognize different page types (catalog, checkout, etc.) while ignoring productid prevents redundant crawling of thousands of product URLs that share the same underlying page structure. This optimizes scan coverage without wasting resources on duplicate page patterns.

Multiple choice technology security

Appscan injected the following into a test request GET /bank/customize.aspx?lang=Foobar%3f%0d%0aAppScanHeader:%20AppScanValue%2f1%2e2%2d3%0d%0aSecondAppScanHeader: %20whatever HTTP/1.0. What kind of vulnerability is appscan testing for?

  1. Cross site request forgery

  2. Cross site scripting

  3. HTTP Response Splitting

  4. SQL injection
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The injected payload %0d%0a (CRLF characters) in the URL parameter attempts to inject arbitrary HTTP headers, which is the signature of HTTP Response Splitting attacks. These CRLF sequences allow attackers to manipulate HTTP responses by injecting counterfeit headers or content, potentially enabling cache poisoning or XSS attacks.

Multiple choice technology security

While analyzing your application you observed that a part of your application is accessed using the domain name whereas the login url is defined as http://10.1.52.3/apps/login.asp. How will you configure appscan to test this application?

  1. Add the domain name in the “Additional servers and domains” section in the scan configuration

  2. Add 10.1.52.3 in the “Additional servers and domains” section in the scan configuration

  3. Put the domain name in the login url

  4. Change the application code to reflect the domain name every where
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Since AppScan only scans the host defined in the starting URL, any additional host or domain accessed by the application must be added to the 'Additional servers and domains' settings. This ensures AppScan is authorized to crawl and test those components.

Multiple choice technology security

Which type of vulnerability can occur when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter?

  1. Cross-site Scripting

  2. Insecure Direct Object Reference

  3. Injection Flaw

  4. Cross Site Request Forgery
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Insecure Direct Object Reference (IDOR) occurs when internal implementation references (file paths, database keys, directory names) are exposed in URLs or parameters. Attackers can modify these references to access unauthorized objects. Cross-site Scripting (A) injects scripts, Injection Flaws (C) manipulate commands, CSRF (D) tricks users - none involve direct object references.

Multiple choice technology programming languages

Which one we prefer in validating dynamic row functionality of our application?

  1. Javascript

  2. struts validator

  3. cannot validate

  4. dynamic rows cannot be done in JSP
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

JavaScript is the preferred choice for validating dynamic row functionality because it operates on the client side and can handle dynamically added DOM elements in real-time. Struts validators are server-side and cannot validate rows added after page load without a round trip.

Multiple choice technology

which of the following can be done in rules execution server?

  1. deploying ruleapps

  2. monitoring rules execution

  3. deploying rule projects

  4. BOM to XOM mapping
Reveal answer Fill a bubble to check yourself
A,B,C Correct answer
Explanation

Rule Execution Servers handle runtime operations: deploying packaged ruleapps and rule projects, and monitoring their execution. BOM (business object model) to XOM (execution object model) mapping is a build-time transformation performed by development tools like Rule Studio, not the execution server.

Multiple choice technology architecture

Which of the properties in the list below are unique to Enterprise JavaBeans but not for JavaBeans?

  1. They are components.

  2. A container manages them.

  3. More than one of them can be combined in a single program (not application).

  4. They live on the server side of an application.

  5. They can be part of a transaction.
Reveal answer Fill a bubble to check yourself
B,D,E Correct answer
Explanation

Enterprise JavaBeans (EJBs) differ from regular JavaBeans in three key ways: EJBs are managed by an EJB container that handles lifecycle, security, and transactions; they execute on the server side in application servers; and they can participate in distributed transactions. Regular JavaBeans are simple reusable components that run client-side without container management.

Multiple choice technology architecture

What are valid activities of the container when a request arrives for a method of a bean instance?

  1. Acknowledge receipt of the request to the client

  2. Start a transaction

  3. Check security for the client

  4. Discard the request.

  5. Directly and immediately pass the request to the bean's methods.
Reveal answer Fill a bubble to check yourself
B,C Correct answer
Explanation

When a request arrives for an EJB method, the container performs several preprocessing tasks before invoking the bean: it can start a transaction context if the method requires one, and it checks security credentials to verify the client's authorization. The container does not simply pass requests directly - it provides these middleware services first.

Multiple choice technology architecture

Which of the following properties of stateful session beans are true:Please select the best answer.

  1. There is a many-to-one relationship between the client and the session bean instance.

  2. Session bean instances live forever.

  3. The container may discard the bean instance arbitrarily, when and if it needs to, for performance reasons.

  4. Stateful session beans may have initial state information passed to them from the client when they are created.

  5. Stateful session bean intances are created when the bean is deployed in the container.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Stateful session beans maintain conversational state with a specific client. The correct answer is D because stateful session beans can receive initial state information through arguments in their create methods. Option A is incorrect because while there's a relationship, it's not accurately described as many-to-one. Option B is false because bean instances have a finite lifecycle. Option C is incorrect because the container doesn't arbitrarily discard stateful beans - passivation/activation follows specific rules. Option E is false because instances are created on client demand, not deployment.

Multiple choice technology architecture

Which of the properties of entity beans are true: Please select the best answer.

  1. Clients of entity beans have a one-to-one relationship with entity bean instances.

  2. Entity bean instances may not be discarded by the container if it needs to free up resources.

  3. Each entity bean instance has a unique identity.

  4. Entity beans map to one or more pieces of data, each one of which has a unique primary key.

  5. None of above
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

Entity beans represent persistent business data. Option D is correct because entity beans represent persistent data with unique primary key identification. Option A is incorrect because multiple clients can access the same entity bean instance. Option B is false because containers can discard/passivate entity beans to manage resources. Option C is misleading because while instances have identity within the container, the question's phrasing is imprecise. Entity beans fundamentally exist to represent data in persistent storage.

Multiple choice technology architecture

Is Entitybean has one to one client relationship ?

  1. True

  2. False
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Entity beans represent data in persistent storage that can be accessed by multiple clients concurrently. The answer is False because entity beans do NOT have a one-to-one relationship with clients. Multiple clients can access the same entity bean instance (representing the same underlying data) simultaneously. Entity beans are designed for shared access to persistent data, unlike stateful session beans which maintain exclusive conversational state with one client.

Multiple choice technology architecture

Can we write a bean extends clause for extending remote interface in bean?

  1. True

  2. False
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

In EJB, a bean's remote interface can extend other remote interfaces using Java's extends clause. This is True because remote interfaces are standard Java interfaces that follow normal inheritance rules. A bean's remote interface can extend from other remote interfaces (or regular interfaces), allowing interface hierarchies and code reuse. The bean implementation class then implements this extended interface, inheriting all method signatures.