107 APIs for dynamically registering servlets and filters can be called at:
(A) Context initialization time
(B) Any time
(C) There is no way to dynamically register servlets and filters
(D) Context destruction time
(E) Injected into a servlet context

103 Which of following annotations can be used in a servlet class? (i) @javax.annotation.Resource (ii) @javax.annotation.PreDestroy (iii) @javax.annotation.security.RunAs (iv) @javax.annotation.security.RolesAllowed (v) @javax.servlet.annotation.WebServlet (A) (v) only (B) (i) and (v) (C) (i), (ii), (iii) and (v) (D) (i), (ii), (iv) and (v) (E) (i), (ii), (iii), (iv) and (v)

104 All of your JSPs need to have a link that permits users to email the web master. This web application is licensed to many small businesses, each of which have a different email address for the web master. You have decided to use a context parameter that you specify in the deployment descriptor, like this:  42. ＜context-param＞  43. ＜param-name＞webmasterEmail＜/param-name＞  44. ＜param-value＞master@example.com＜/param-value＞  45. ＜/context-param＞ Which JSP code snippet creates this email link? (A) ＜a href='mailto:${contextParam.webmaterEmail}'＞contact us＜/a＞ (B) ＜a href='mailto:${applicationScope.webmaterEmail}'＞contact us＜/a＞ (C) ＜a href='mailto:${contextInitParam.webmaterEmail}'＞contact us＜/a＞ (D) ＜a href='mailto:${initParam.webmaterEmail}'＞contact us＜/a＞

105 Refer to the Exhibit. Assuming the tag library in the exhibit is imported with the prefix forum, which custom tag invocation procedures a transaction error in a jsp page? (A) ＜forum:message from="My Name" subject="My Subject" /＞ (B) ＜forum:message subject="My Subject"＞My message body.＜/forum:message＞ (C) ＜forum:message from="My Name" subject="${param.subject}"＞${param.body}＜/forum:message＞ (D) ＜forum:message from="My Name" subject="My Subject"＞＜%= request.getParameter( "body" ) %＞＜/forum:message＞ (E) ＜forum:message from="My Name"subject="＜%= request.getParameter( "subject" ) %＞"＞My message body.＜/forum:message＞

106 Which statement is true about web container session management? (A) Access to session-scoped attributes is guaranteed to be thread-safe by the web container. (B) To activate URL rewriting, the developer must use the HttpServletResponse.setURLRewriting method. (C) If the web application uses HTTPS, then the web container may use the data on the HTTPS request stream to identify the client. (D) The JSESSIONID cookie is stored permanently on the client so that a user may return to the web application and the web container will rejoin that session.

108 For manageability purposes, you have been told to add a "count" instance variable to a critical JSP Document so that a JMX MBean can track how frequent this JSP is being invoked. Which JSP code snippet must you use to declare this instance variable in the JSP Document? (A) ＜jsp:declaration＞int count = 0;＜jsp:declaration＞ (B) ＜%! int count = 0; %＞ (C) ＜jsp:declaration.instance＞int count = 0;＜jsp:declaration.instance＞ (D) ＜jsp:scriptlet.declaration＞int count = 0;＜jsp:scriptlet.declaration＞

複選題109 A cookie may be set to be an HttpOnly cookie. Setting a cookie to be HttpOnly results in (Choose two) (A) Client to not expose the cookie to client side scripting code (B) Does not work with https protocol (C) prevent certain types of cross-site scripting attacks (D) There is no such thing as an HttpOnly cookie

複選題110 Which two security mechanisms can be directed through a sub-element of the ＜user-dataconstraint＞ element in a web application deployment descriptor? (Choose two.) (A) authorization (B) data integrity (C) confidentiality (D) authentication

111 Users of your web application have requested that they should be able to set the duration of their sessions. So for example, one user might want a webapp to stay connected for an hour rather than the webapp's default of fifteen minutes; another user might want to stay connected for a whole day. Furthermore, you have a special login servlet that performs user authentication and retrieves the object from the database. You want to augment this code to set up the user's specified session duration. Which code snippet in the login servlet will accomplish this goal? (A) User user = / / retrieves the user objects object from the databasesession.setDurationInterval (user.getSessionDuration()); (B) User user = / / retrieves the User objects from the databasesession.setInactiveInterval (user.getSessionDuration()); (C) User user = / / retrieves the user objects object from the databasesession.setInactiveInterval (user.get.SessionDuration()); (D) User user = / / retrieves the user objects object from the databasesession.setDuration (user.getSessionDuration()); (E) User user = / / retrieves the user objects object from the databasesession.setMaxInactiveInterval (user.getSessionDuration());

112 View the exhibit. Assume the tag library in the exhibit is placed in a web application in the path /WEBINF/tld/example.tld.1.2. ＜ex:hello /＞ Which JSP code, inserted at line 1, completes the JSP code to invoke the hello tag? (A) ＜%@ taglib prefix="ex" uri="/WEB-INF/tld" %＞ (B) ＜%@ taglib uri="/WEB-INF/tld/example.tld" %＞ (C) ＜%@ taglib prefix="ex"uri:="http://localhost:8080/tld/example.tld" % ＞ (D) ＜%@ taglib prefix="ex"uri:="http://example.com/tld/example" % ＞

複選題113 Given:  3. class MyServlet extends HttpServlet {  4. public void doPut(HttpServletRequest req,     HttpServletResponse resp)     throws ServletException, IOException {  5. // servlet code here ...  26. }  27. } If the DD contains a single security constraint associated with MyServlet and its only ＜http-method＞ tags and ＜auth-constraint＞ tags are: ＜http-method＞GET＜/http-method＞ ＜http-method＞PUT＜/http-method＞ ＜auth-constrain＞Admin＜/auth-constrain＞ Which four requests would be allowed by the container? (Choose four) (A) A user whose role is Admin can perform a PUT. (B) A user whose role is Admin can perform a GET. (C) A user whose role is Admin can perform a POST. (D) A user whose role is Member can perform a PUT. (E) A user whose role is Member can perform a POST.