Java Enterprise and Web Technologies

Track the page parameter because each value represents a distinct application page that needs testing. Ignore the productid parameter because it's just a filter within pages - testing one productid value per page is sufficient, testing all values creates redundant tests.

WEBrick (Web Engine from Ruby) is the built-in web server that ships with Rails. It's included in Ruby's standard library and used by default when you run 'rails server' in development. Options A, B, and D are fictitious names meant to sound similar but don't exist.

In the MVC architecture, the Controller is responsible for handling incoming HTTP requests from web browsers. It processes the request, interacts with the Model for data operations, and selects the appropriate View for rendering the response. The Model and View don't directly handle browser requests.

The login() method throws SecurityException when authentication fails or security violations occur. This is the standard exception type for security-related failures in this particular API. LoginException and EnterpriseSecurityException are not the correct exception types for this framework, and IntrusionException would be used for detecting malicious behavior patterns, not normal login failures.

The setNoCacheHeaders() method takes HttpServletResponse as a parameter because it needs to modify HTTP response headers to prevent caching. Request parameters don't control caching behavior - only response headers like Cache-Control and Pragma do. The method returns void and doesn't throw ServletException as header setting is a straightforward operation.

CSRF (Cross-Site Request Forgery) attacks trick authenticated users into performing unwanted actions. Adding CSRF tokens to URLs is a primary defense because the token is unpredictable and tied to the user's session, making forged requests invalid. encryptHiddenField, verifySecureComm, and setSafeContentType address different security concerns like data encryption or transport security, not CSRF specifically.

isSecureRequest() performs two critical checks: it verifies the request came over SSL/TLS (HTTPS) for encryption in transit, and confirms it's a POST request because sensitive operations should not be performed via GET (which can be cached, logged, or bookmarked). Only checking one of these conditions would be insufficient - both are required for a truly secure request.

EnterpriseSecurityException contains two separate messages: a Log Message (with technical details for debugging, written to logs but unsafe to show users), and a User Message (sanitized, safe to display). This separation prevents information leakage while still providing useful feedback. Single-message exceptions would either leak sensitive info (showing log messages to users) or provide no debugging value.

OWASP WebScarab is a security analysis framework that intercepts and analyzes HTTP/HTTPS traffic between a browser and web application. Its most common usage is as an intercepting proxy that allows security testers to inspect, modify, and replay requests to identify vulnerabilities. It is not an insecure application, static analyzer, or dedicated penetration testing tool - it's a traffic analysis framework.

Nikto is an open source web server scanner licensed under GPL that performs comprehensive vulnerability scanning. It checks for outdated server versions, dangerous files/programs, and configuration issues. Sqlmap is for SQL injection testing, O2 is a security tool framework, and GreaseMonkey is a userscript manager for browsers.

Web services are vulnerable to all three attack types listed. SQL Injection targets database queries, Denial of Service aims to exhaust resources, and XML Injection specifically targets XML parsers used in SOAP/WSDL services. XML External Entity (XXE) attacks are particularly dangerous to web services, making 'All of the above' the correct answer.

Session scope stores data specific to a user's session, persisting across multiple requests from the same user. Page scope is for a single page, request scope exists only for one HTTP request, and application scope is shared across all users and sessions. Session scope is the correct choice for user-specific data that needs to persist during the user's interaction with the application.

Request scope exists only for the duration of processing a single HTTP request from when it's received until the response is sent. Session scope spans multiple requests during a user's visit, and application scope persists across all users until server restart.

The OWB Design Browser Client is a web-based interface for viewing metadata objects, generating reports, and performing lineage analysis (tracing data flow) and impact analysis (determining effects of changes). It provides read-only access to the metadata repository. The OWB Client is for design, Repository is storage, Runtime tools are for execution.

The OWB Deployment Manager is the runtime component responsible for deploying mapping definitions and other objects to the target environment, and for executing the deployed ETL processes. It manages the connection between the design-time repository and the runtime execution engine, handling both deployment and execution of data integration workflows. The Repository stores metadata, the Client is for design, and there is no separate Mapping Compiler component.