複選題
110 Which two security mechanisms can be directed through a sub-element of the ＜user-dataconstraint＞ element in a web application deployment descriptor? (Choose two.)
(A) authorization
(B) data integrity
(C) confidentiality
(D) authentication

106 Which statement is true about web container session management? (A) Access to session-scoped attributes is guaranteed to be thread-safe by the web container. (B) To activate URL rewriting, the developer must use the HttpServletResponse.setURLRewriting method. (C) If the web application uses HTTPS, then the web container may use the data on the HTTPS request stream to identify the client. (D) The JSESSIONID cookie is stored permanently on the client so that a user may return to the web application and the web container will rejoin that session.

107 APIs for dynamically registering servlets and filters can be called at: (A) Context initialization time (B) Any time (C) There is no way to dynamically register servlets and filters (D) Context destruction time (E) Injected into a servlet context

108 For manageability purposes, you have been told to add a "count" instance variable to a critical JSP Document so that a JMX MBean can track how frequent this JSP is being invoked. Which JSP code snippet must you use to declare this instance variable in the JSP Document? (A) ＜jsp:declaration＞int count = 0;＜jsp:declaration＞ (B) ＜%! int count = 0; %＞ (C) ＜jsp:declaration.instance＞int count = 0;＜jsp:declaration.instance＞ (D) ＜jsp:scriptlet.declaration＞int count = 0;＜jsp:scriptlet.declaration＞

複選題109 A cookie may be set to be an HttpOnly cookie. Setting a cookie to be HttpOnly results in (Choose two) (A) Client to not expose the cookie to client side scripting code (B) Does not work with https protocol (C) prevent certain types of cross-site scripting attacks (D) There is no such thing as an HttpOnly cookie

111 Users of your web application have requested that they should be able to set the duration of their sessions. So for example, one user might want a webapp to stay connected for an hour rather than the webapp's default of fifteen minutes; another user might want to stay connected for a whole day. Furthermore, you have a special login servlet that performs user authentication and retrieves the object from the database. You want to augment this code to set up the user's specified session duration. Which code snippet in the login servlet will accomplish this goal? (A) User user = / / retrieves the user objects object from the databasesession.setDurationInterval (user.getSessionDuration()); (B) User user = / / retrieves the User objects from the databasesession.setInactiveInterval (user.getSessionDuration()); (C) User user = / / retrieves the user objects object from the databasesession.setInactiveInterval (user.get.SessionDuration()); (D) User user = / / retrieves the user objects object from the databasesession.setDuration (user.getSessionDuration()); (E) User user = / / retrieves the user objects object from the databasesession.setMaxInactiveInterval (user.getSessionDuration());

112 View the exhibit. Assume the tag library in the exhibit is placed in a web application in the path /WEBINF/tld/example.tld.1.2. ＜ex:hello /＞ Which JSP code, inserted at line 1, completes the JSP code to invoke the hello tag? (A) ＜%@ taglib prefix="ex" uri="/WEB-INF/tld" %＞ (B) ＜%@ taglib uri="/WEB-INF/tld/example.tld" %＞ (C) ＜%@ taglib prefix="ex"uri:="http://localhost:8080/tld/example.tld" % ＞ (D) ＜%@ taglib prefix="ex"uri:="http://example.com/tld/example" % ＞

複選題113 Given:  3. class MyServlet extends HttpServlet {  4. public void doPut(HttpServletRequest req,     HttpServletResponse resp)     throws ServletException, IOException {  5. // servlet code here ...  26. }  27. } If the DD contains a single security constraint associated with MyServlet and its only ＜http-method＞ tags and ＜auth-constraint＞ tags are: ＜http-method＞GET＜/http-method＞ ＜http-method＞PUT＜/http-method＞ ＜auth-constrain＞Admin＜/auth-constrain＞ Which four requests would be allowed by the container? (Choose four) (A) A user whose role is Admin can perform a PUT. (B) A user whose role is Admin can perform a GET. (C) A user whose role is Admin can perform a POST. (D) A user whose role is Member can perform a PUT. (E) A user whose role is Member can perform a POST.

複選題114 Given a header in an HI IP request: X-Retries: 4 A Which two retrieve the value of the header from a given HttpServletRequest request? (Choose two ) (A) request-getHeader("X-Retries") (B) request.getlntHeader("X-Retries") (C) request.getRequestHeader("X-Retries") (D) request.getHeaders{"X-Retries").get(0) (E) request.getRequestHeaders("X-Retries").get(0)

複選題115 Your web application uses a simple architecture in which servlets handle requests and then forward to a JSP using a request dispatcher. You need to pass information calculated in the servlet to the JSP for view generation. This information must NOT be accessible to any other servlet, JSP or session in the webapp. Which two techniques can you use to accomplish this goal? (Choose two) (A) Add attributes to the session object. (B) Add attributes on the request object. (C) Add parameters on the request object. (D) Use the pageContext object to add request attributes. (E) Add parameters to the JSP's URL when generating the request dispatcher.

複選題116 A servlet class is injected with a JDBC data source. After injection has occurred, the servlet needs to create a cache out of some of the data in the database, so as to improve responsiveness. Which two methods can host the cache creation code? (Choose two) (A) Servlet.init() (B) Servlet.destroy() (C) A method annotated with @Init (D) A method annotated with @PostConstruct (E) A method annotated with @PreDestroy