Java Enterprise and Web Technologies

When part of the app uses a domain name but login uses IP (10.1.52.3), AppScan needs to know about both to test the complete application. Adding the domain to 'Additional servers and domains' allows AppScan to follow links and test all parts. Adding only the IP or changing code are incorrect approaches.

The injected payload contains %0d%0a (CRLF - carriage return + line feed) used to split HTTP responses. AppScan tests for HTTP Response Splitting by injecting these characters to attempt injecting arbitrary headers or splitting the response body. This can lead to cache poisoning, XSS, or other attacks. CRLF injection is the key indicator.

Parameter tracking ensures AppScan tests each unique page value separately. If you ignore or limit it, AppScan might only test one value and miss vulnerabilities on other pages.

.NET web services traditionally use SOAP, where parameters are embedded in the XML SOAP envelope. AppScan modifies these SOAP parameters to inject test payloads, not the HTTP-level GET/POST parameters or cookies.

Track the page parameter because each value represents a distinct application page that needs testing. Ignore the productid parameter because it's just a filter within pages - testing one productid value per page is sufficient, testing all values creates redundant tests.

WEBrick (Web Engine from Ruby) is the built-in web server that ships with Rails. It's included in Ruby's standard library and used by default when you run 'rails server' in development. Options A, B, and D are fictitious names meant to sound similar but don't exist.

In the MVC architecture, the Controller is responsible for handling incoming HTTP requests from web browsers. It processes the request, interacts with the Model for data operations, and selects the appropriate View for rendering the response. The Model and View don't directly handle browser requests.

The login() method throws SecurityException when authentication fails or security violations occur. This is the standard exception type for security-related failures in this particular API. LoginException and EnterpriseSecurityException are not the correct exception types for this framework, and IntrusionException would be used for detecting malicious behavior patterns, not normal login failures.

The setNoCacheHeaders() method takes HttpServletResponse as a parameter because it needs to modify HTTP response headers to prevent caching. Request parameters don't control caching behavior - only response headers like Cache-Control and Pragma do. The method returns void and doesn't throw ServletException as header setting is a straightforward operation.

CSRF (Cross-Site Request Forgery) attacks trick authenticated users into performing unwanted actions. Adding CSRF tokens to URLs is a primary defense because the token is unpredictable and tied to the user's session, making forged requests invalid. encryptHiddenField, verifySecureComm, and setSafeContentType address different security concerns like data encryption or transport security, not CSRF specifically.

isSecureRequest() performs two critical checks: it verifies the request came over SSL/TLS (HTTPS) for encryption in transit, and confirms it's a POST request because sensitive operations should not be performed via GET (which can be cached, logged, or bookmarked). Only checking one of these conditions would be insufficient - both are required for a truly secure request.

EnterpriseSecurityException contains two separate messages: a Log Message (with technical details for debugging, written to logs but unsafe to show users), and a User Message (sanitized, safe to display). This separation prevents information leakage while still providing useful feedback. Single-message exceptions would either leak sensitive info (showing log messages to users) or provide no debugging value.

OWASP WebScarab is a security analysis framework that intercepts and analyzes HTTP/HTTPS traffic between a browser and web application. Its most common usage is as an intercepting proxy that allows security testers to inspect, modify, and replay requests to identify vulnerabilities. It is not an insecure application, static analyzer, or dedicated penetration testing tool - it's a traffic analysis framework.

Nikto is an open source web server scanner licensed under GPL that performs comprehensive vulnerability scanning. It checks for outdated server versions, dangerous files/programs, and configuration issues. Sqlmap is for SQL injection testing, O2 is a security tool framework, and GreaseMonkey is a userscript manager for browsers.

Web services are vulnerable to all three attack types listed. SQL Injection targets database queries, Denial of Service aims to exhaust resources, and XML Injection specifically targets XML parsers used in SOAP/WSDL services. XML External Entity (XXE) attacks are particularly dangerous to web services, making 'All of the above' the correct answer.