Java Enterprise and Web Technologies

In J2EE, the EJB container handles all database access (data storage and retrieval) for container-managed persistence (CMP) entity beans. Thin clients, deployment descriptors, and JAR files do not execute database operations or manage bean persistence directly.

Bean-managed persistence means the bean developer writes explicit SQL/JDBC code in the bean's methods to handle database operations. Container-managed persistence (the alternative) lets the container handle storage automatically. The J2EE server shutdown and crash scenarios are unrelated to the persistence mechanism type.

Life cycle methods (ejbCreate, ejbRemove, etc.) are called by the bean's container, not by clients, the server directly, or database calls. The container manages bean instances and invokes these methods at appropriate times during the bean's life cycle. This is fundamental to EJB architecture.

Page Class is correct because all ASP.NET Web Forms inherit from the System.Web.UI.Page class, which provides the base functionality for web pages. Master Page (A) is used for consistent layouts but is not the base class, Session Class (C) manages state, and 'None of the Above' is incorrect.

In Pega PRPC, Rule-Connect-SOAP is the rule type used to connect to SOAP-based web services for fetching data. Rule-Connect-WebService is a more generic connector, but Rule-Connect-SOAP is specifically designed for SOAP services which is what the question asks about.

In Pega, Router, Notify, and Utility shapes in a flow rule execute activities. All activities are instances of the Rule-Obj-Activity rule type, with their specific behavior type (like Router or Utility) specified in their Security tab.

Transaction S330 is used in CICS environments to view MQ (Message Queue) contents between Mainframes and Java applications. The other transaction IDs (S340, S350, S360) are not the standard queue monitoring transactions.

To answer this question, the user needs to have knowledge of common web application attacks and their impact on web services.

Now, let's go through each option and explain whether it is right or wrong:

A. SQL Injection: This type of attack targets the database layer of the application and is not specific to web service interfaces. However, if a web service is accessing a database and is not properly secured against SQL injection attacks, then the web service can be compromised. Therefore, SQL injection can be a threat to web services but is not specific to them.

B. Denial of Service: This type of attack floods the target with traffic or requests, making it unavailable to legitimate users. Web services are often targeted by denial of service attacks because they are critical components of many applications. Therefore, denial of service attacks are a threat to web services.

C. XML Injection: This type of attack exploits vulnerabilities in the way XML data is processed by an application. Although web services often use XML to exchange data, XML injection is not specific to web services. However, if a web service is not properly secured against XML injection attacks, then it can be compromised. Therefore, XML injection can be a threat to web services but is not specific to them.

D. All of the above: This option is correct because all of the attacks listed (SQL injection, denial of service, and XML injection) can be a threat to web services. Web service interfaces are exposed to the same attacks as other web applications and must be secured accordingly.

The Answer is: D

Session scope stores data that persists across multiple requests from the same user session, making it specific to that user. Page scope is for a single page, request scope lasts only for one HTTP request, and application scope is shared across all users and sessions. Session data typically includes user identity, shopping cart contents, or preferences.

Request scope exists only for the duration of processing a single HTTP request/response cycle. Variables in request scope are created when the request arrives and destroyed after the response is sent. This is shorter than session scope (A) and application scope (D).

The login method throws EnterpriseSecurityException, which is a custom exception specific to the security framework being used. Standard Java exceptions like LoginException, SecurityException, or IntrusionException are not the correct custom exception for this API.

The setNoCacheHeaders() method takes an HttpServletResponse parameter and sets cache-control headers to prevent browsers and proxies from caching sensitive content. It doesn't need HttpServletRequest, doesn't return a boolean, and doesn't throw ServletException.

The addCSRFToken() method is specifically designed to add CSRF protection tokens to links, which is the primary defense against cross-site request forgery attacks. The other methods serve different purposes: encryption, secure communication verification, and content type setting.

The isSecureRequest method checks both SSL channel (HTTPS) and POST method. This dual check is important because sensitive data should be transmitted over SSL and state-changing operations should use POST, not GET.