Computer Knowledge

Java Enterprise and Web Technologies

2,279 Questions

Java enterprise and web technologies questions focus on J2EE architecture, web services like SOAP, and servlet functionalities. These topics frequently appear in IT officer and specialist scale examinations. Regular practice ensures familiarity with enterprise application components.

HttpServlet methodsSOAP and web servicesEJB architecture rolesJ2EE componentsJSP servlet callingUDDI concepts

Java Enterprise and Web Technologies Questions

Multiple choice technology web technology

Which of the following technologies can be used to describe RESTful Webservices? Choose one answer.

  1. WSDL

  2. ebXML

  3. UDDI

  4. None of the above.
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

WSDL is designed for SOAP services and doesn't naturally describe REST's resource-oriented architecture. ebXML is for electronic business XML exchanges, UDDI is a registry for service discovery, and none of these are standard REST description languages. While WADL (Web Application Description Language) exists for REST, it's not widely adopted, making 'None of the above' the correct answer.

Multiple choice technology web technology

You are writing a web based utility that searches for existing web services provided by large companies. Your website searches these webservice, displays list and provides features through a very nice GUI to execute these webservices. In future, this utility can be enhanced to perform similar functionality for other enterprise services and need to be UI-rich. Which of the following APIs would you use for searching XML registries? Choose one answer.

  1. StaX

  2. JAXP

  3. JAXB

  4. JAXR
Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

JAXR (Java API for XML Registries) is specifically designed for accessing business and service registries like UDDI and ebXML. It provides a standard API to search, retrieve, and manage registry metadata. StAX is for streaming XML parsing, JAXP is for general XML processing, and JAXB is for XML-Java binding - none of these handle registry queries.

Multiple choice technology web technology

ABC company has a very old web application that was built on Servlets, JSP and a simple proprietary MVC framework which they must use. This application is mostly used for reporting purposes and retrieves data from DB2 through JDBC. They are planning to enhance the functionality of the application and also deploy on a Java EE application server. They approached you for suggestions to improve the application code. Which of the following would not be a valid recommendation (best-fit)? Choose one answer.

  1. Refactor the common scriptlet code into tag libraries wherever possible

  2. Create a common look & feel using templates, CSS files.

  3. Use Entities

  4. Use Expression Language
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The application uses JDBC directly with no persistence layer, so introducing JPA Entities would require significant architectural changes (new EntityManager, entity mappings, refactoring all JDBC code). This contradicts the 'improve with minimal costs' requirement. The other options are valid, low-risk improvements: tag libraries and EL reduce scriptlets, templates create consistent UI.

Multiple choice technology web technology

ABC Company has decided to migrate existing J2EE application built using servlets, JSP, JMS, session & entity Beans to Java EE. They have approached you for recommendations. Which of the following are valid recommendations? Select two choices. Choose at least one answer.

  1. Replace entity beans with JPA entity classes

  2. Use the new JMS API

  3. Replace session Beans with web services

  4. Use JCA
Reveal answer Fill a bubble to check yourself
A,B Correct answer
Explanation

JPA entity classes (option A) replace complex entity beans with simpler POJO-based persistence, reducing boilerplate. The JMS API in Java EE 5+ (option B) was significantly simplified with annotations and fewer interfaces, making it worthwhile to adopt. Replacing session beans with web services (C) changes the architecture unnecessarily, and JCA (D) is only needed for legacy system connections - not mentioned.

Multiple choice technology web technology

You are architecting a new web based labor claim management application. Currently the users have a Java Swing-based application running on their local PCs, and you want to implement the new web-based solution with a GUI that is similar to their desktop application. Once the users have filled in their hours then you must send the details to central labour system through a Web service. What of the following technologies would be required for building this application? (Choose two.) Choose at least one answer.

  1. JAX-WS

  2. JMS

  3. JSSE

  4. JCE

  5. JSF
Reveal answer Fill a bubble to check yourself
A,E Correct answer
Explanation

JSF (JavaServer Faces) is ideal for building components-based web GUIs that closely mimic desktop applications, while JAX-WS is the standard API for communicating with XML-based SOAP Web Services. JMS, JCE, and JSSE handle messaging and security.

Multiple choice technology security

For a given url -> http://www.example.com/smb.jsp&page=wireless where wireless indicates a unique page how would you configure appscan to test all unique pages?

  1. Ignore the page parameter

  2. Track the page parameter

  3. Set the redundant path limit to 1

  4. a.Set the depth limit to 1
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Tracking the page parameter tells AppScan that each value of 'page' represents a unique page that should be tested individually. Ignoring would skip those pages, redundant path limit limits duplicates, and depth limit limits crawl depth.

Multiple choice technology security

What information does difference displayed in the Request / Response tab provide?

  1. Difference between 2 tests

  2. How appscan modified the original web application page

  3. How appscan constructed the test http request

  4. How the vulnerability was resolved
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The Request/Response tab in AppScan displays the difference between the original request sent by the browser and the modified request that AppScan constructed for testing. Option C correctly states this shows how AppScan built the test HTTP request, which is essential for understanding what vulnerability tests were performed.

Multiple choice technology security

What parameters does Appscan modify when testing a .net webservice?

  1. POST parameters

  2. SOAP parameters

  3. GET parameters

  4. Cookies
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

When testing .NET web services, AppScan targets SOAP parameters since these are the primary input mechanism for SOAP-based web services. Unlike REST services that might use GET/POST parameters, .NET SOAP services communicate through XML-formatted SOAP messages, making SOAP parameters the correct attack surface.

Multiple choice technology security

Given url – http://www.abc.com/viewpage.jsp?page=catalog&productid=12345 where page parameter indicate a unique page and the productid retrieves pages for a particular product. How would you optimally configure appscan to test this application? Choose 2 answers

  1. Track the page parameter

  2. Set the link limit to 2

  3. Set the redundant path limit to 5

  4. Ignore the productid parameter
Reveal answer Fill a bubble to check yourself
A,D Correct answer
Explanation

Tracking the page parameter allows AppScan to recognize different page types (catalog, checkout, etc.) while ignoring productid prevents redundant crawling of thousands of product URLs that share the same underlying page structure. This optimizes scan coverage without wasting resources on duplicate page patterns.

Multiple choice technology security

Appscan injected the following into a test request GET /bank/customize.aspx?lang=Foobar%3f%0d%0aAppScanHeader:%20AppScanValue%2f1%2e2%2d3%0d%0aSecondAppScanHeader: %20whatever HTTP/1.0. What kind of vulnerability is appscan testing for?

  1. Cross site request forgery

  2. Cross site scripting

  3. HTTP Response Splitting

  4. SQL injection
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The injected payload %0d%0a (CRLF characters) in the URL parameter attempts to inject arbitrary HTTP headers, which is the signature of HTTP Response Splitting attacks. These CRLF sequences allow attackers to manipulate HTTP responses by injecting counterfeit headers or content, potentially enabling cache poisoning or XSS attacks.

Multiple choice technology security

While analyzing your application you observed that a part of your application is accessed using the domain name whereas the login url is defined as http://10.1.52.3/apps/login.asp. How will you configure appscan to test this application?

  1. Add the domain name in the “Additional servers and domains” section in the scan configuration

  2. Add 10.1.52.3 in the “Additional servers and domains” section in the scan configuration

  3. Put the domain name in the login url

  4. Change the application code to reflect the domain name every where
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Since AppScan only scans the host defined in the starting URL, any additional host or domain accessed by the application must be added to the 'Additional servers and domains' settings. This ensures AppScan is authorized to crawl and test those components.

Multiple choice technology security

Which type of vulnerability can occur when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter?

  1. Cross-site Scripting

  2. Insecure Direct Object Reference

  3. Injection Flaw

  4. Cross Site Request Forgery
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Insecure Direct Object Reference (IDOR) occurs when internal implementation references (file paths, database keys, directory names) are exposed in URLs or parameters. Attackers can modify these references to access unauthorized objects. Cross-site Scripting (A) injects scripts, Injection Flaws (C) manipulate commands, CSRF (D) tricks users - none involve direct object references.

Multiple choice technology programming languages

Which one we prefer in validating dynamic row functionality of our application?

  1. Javascript

  2. struts validator

  3. cannot validate

  4. dynamic rows cannot be done in JSP
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

JavaScript is the preferred choice for validating dynamic row functionality because it operates on the client side and can handle dynamically added DOM elements in real-time. Struts validators are server-side and cannot validate rows added after page load without a round trip.