Total Pageviews

Sunday, 24 January 2016

THE JSP TECHNOLOGY MODEL—THE BASICS

Q.1 Consider the following code and select the correct statement about it from the options below. (Select one)
<html><body>
    <%! int aNum=5 %>
        The value of aNum is <%= aNum %>
</body>
</html>
a. It will print "The value of aNum is 5" to the output.
b. It will flag a compile-time error because of an incorrect declaration.
c. It will throw a runtime exception while executing the expression.
d. It will not flag any compile time or runtime errors and will not print anything to the
output.
Answer: b Explanation
It will flag a compile-time error because the variable declaration <%! int aNum=5 %> is missing a ; at the end. It should be
<%! int aNum=5; %>
Q.2 Which of the following tags can you use to print the value of an expression to the
output stream? (Select two)
a. <%@ %>
b. <%! %>
c. <% %>
d. <%= %>
e. <%-- --%>
Answers: c and d Explanation
You can use a JSP expression to print the value of an expression to the output stream. For example, if the expression is x+3, you can write <%= x+3 %>. Answer d is a JSP expression and is therefore the correct answer. But you can also use a scriptlet to print the value of an expression to the output stream as <% out.print(x+3); %>. Answer c is a scriptlet and is therefore also correct. If the exam asks you to select one correct option, then select the expression syntax, as in answer d. But if the exam asks for two correct answers, then select the scriptlet syntax as well.
Q.3 Which of the following methods is defined by the JSP engine? (Select one)
a. jspInit()
b. _jspService()
c. _jspService(ServletRequest, ServletResponse)
d. _jspService(HttpServletRequest, HttpServletResponse)
e. jspDestroy()
Answer: d Explanation
The _jspService() method of the javax.servlet.jsp.HttpJspPage class is defined by the JSP engine. HttpJspPage is meant to serve HTTP requests, and therefore the _jspService() method accepts the javax.servlet. http.HttpServletRequest and javax.servlet.http.HttpServlet - Response parameters.
Q.4 Which of the following exceptions may be thrown by the _jspService() method? (Select one)
a. javax.servlet.ServletException
b. javax.servlet.jsp.JSPException
c. javax.servlet.ServletException and javax.servlet.jsp.JSPException
d. javax.servlet.ServletException and java.io.IOException
e. javax.servlet.jsp.JSPException and java.io.IOException
Answer: d Explanation
The _jspService() method may throw a javax.servlet.ServletException, a java. io. IOException, or a subclass of these two exception classes. Note that the _jspService() method does not define javax.servlet.jsp. JspException in its throws clause.
Q.5 Write the name of the method that you can use to initialize variables declared in a JSP declaration in the space provided. (Write only the name of the method. Do not write the return type, parameters, or parentheses.)
a [_____________]
Answer: jspInit Explanation
The jspInit() method is the first method called by the JSP engine on a JSP page. It is called only once to allow the page to initialize itself. You can use this method to initialize variables declared in JSP declarations (<%! %>).
6. Which of the following correctly declares that the current page is an error page and also enables it to take part in a session? (Select one)
a. <%@ page pageType="errorPage" session="required" %>
b. <%@ page isErrorPage="true" session="mandatory" %>
c. <%@ page errorPage="true" session="true" %>
d. <%@ page isErrorPage="true" session="true" %>
e. None of the above.
Answer: d Explanation
The isErrorPage attribute accepts a Boolean value (true or false) and indicates whether the current page is capable of handling errors. The session attribute accepts a Boolean value (true or false) and indicates whether the current page must take part in a session. Therefore, answer d is correct. Since the pageType attribute is not a valid attribute for a page directive, answer a is not correct. The mandatory value is not a valid value for the session attribute, which means answer b is not correct. The errorPage attribute is a valid
attribute, but it is used for specifying another page as an error handler for the current
page. Therefore, answer c is also incorrect.
THE JSP TECHNOLOGY MODEL—ADVANCED TOPICS
1. What will be the output of the following code? (Select one)
<html><body>
<% x=3; %>
<% int x=5; %>
<%! int x=7; %>
x = <%=x%>, <%=this.x%>
</body></html>
a. x = 3, 5
b. x = 3, 7
c. x = 5, 3
d. x = 5, 7
e. Compilation error
Answer: c Explanation
The above code will translate to servlet code similar to the following:
public class ... {
    int x = 7;
    public void _jspService(…) {
        ...
        out.print("<html><body>");
        x = 3;
        int x = 5;
        out.write("x = "); out.print(x);
        out.write(","); out.print(this.x);
        out.print("</body></html>");
    }
}
The declaration will create a member variable x and initialize it to 7. The first scriptlet, x=3, will change its value to 3. Then, the second scriptlet will declare a local variable x and initialize it to 5. The first expression refers to the local variable x and will therefore print 5. The second expression uses the keyword this to refer to the member or instance variable x, which was set to 3. Thus, the correct answer is c, x = 5, 3.
Q.2 What will be the output of the following code? (Select one)
<html><body>
    The value is <%=""%>
</body></html>
a. Compilation error
b. Runtime error
c. The value is
d. The value is null
Answer: c Explanation
The expression is converted to
out.print("");
Thus, the correct answer is c.
Q.3 Which of the following implicit objects is not available to a JSP page by default?
(Select one)
a application
b session
c exception
d config
Answer: c Explanation
The implicit variables application and config are always available to a JSP page. The implicit variable session is available if the value of the page directive’s session attribute is set to true. Since it is set to true by default, the implicit variable session is also available by default. The implicit variable exception is available only if the value of the page directive’s isErrorPage attribute is set to true. It is set to false by default, so the implicit variable exception is not available by default. We have to explicitly set it to true:
    <%@ page isErrorPage="true" %>
The correct answer, therefore, is c.
Q.4 Which of the following implicit objects can you use to store attributes that need to be accessed from all the sessions of a web application? (Select two)
a. application
b. session
c. request
d. page
e. pageContext
Answers: a and e Explanation
To store attributes that are accessible from all the sessions of a web application, we have to put them in the application scope. To achieve this, we have to use the implicit object application. If the exam asks you to select one answer, then select application. If the exam asks for two correct answers, then read the question carefully. It says, “Which of the following implicit objects can you use to store attributes that need to be accessed from all the sessions of a web application?” We can also use pageContext to store objects in the application scope as pageContext.setAttribute("name", object, ageContext.APPLICATION_
SCOPE); and pageContext.getAttribute("name", PageContext. APPLICATION_SCOPE);.
Q.5 The implicit variable config in a JSP page refers to an object of type: (Select one)
a. javax.servlet.PageConfig
b. javax.servlet.jsp.PageConfig
c. javax.servlet.ServletConfig
d. javax.servlet.ServletContext
Answer: c
The implicit variable config in a JSP page refers to an object of type javax.servlet.ServletConfig.
Q.6 A JSP page can receive context initialization parameters through the deployment descriptor of the web application. 
a True
b False
Answer: a Explanation
Context initialization parameters are specified by the <context-param> tags in web.xml. These parameters are for the whole web application and not specific to any servlet or JSP page. Thus, all components of a web application can access context initialization parameters.
7. Which of the following will evaluate to true? (Select two)
a. page == this
b. pageContext == this
c. out instanceof ServletOutputStream
d. application instanceof ServletContext
Answers: a and d Explanation
The implicit variable page refers to the current servlet, and therefore answer a will evaluate to true. The application object refers to an object of type ServletContext, which means answer d will also evaluate to true. The pageContext object refers to an object of type PageContext and not to the servlet, which means answer b will evaluate to false. The out implicit variable refers to an instance of javax.servlet.jsp.JspWriter and not to an instance of javax.servlet.ServletOutputStream, so answer c evaluates to false. Note that JspWriter is derived from java.io.Writer, while Servlet-OutputStream is derived from java.io.OutputStream.
Q.8 Select the correct statement about the following code. (Select one)
<%@ page language="java" %>
<html><body>
    out.print("Hello ");
    out.print("World ");
</body></html>
a. It will print Hello World in the output.
b. It will generate compile-time errors.
c. It will throw runtime exceptions.
d. It will only print Hello.
e. None of above.
Answer: e Explanation
The lines out.print("Hello ") and out.print("World ") are not contained in a scriptlet (<%...%>). The JSP engine assumes they are a part of the template text and sends them to the browser without executing them on the server. Therefore, it will print the two statements in the browser window: out.print("Hello ");out.print("World ");
Q.9 Select the correct statement about the following code. (Select one)
<%@ page language="java" %>
<html><body>
    <%
        response.getOutputStream().print ("Hello ");
        out.print("World");
    %>
</body></html>
a. It will print Hello World in the output.
b. It will generate compile-time errors.
c. It will throw runtime exceptions.
d. It will only print Hello.
e. None of above.
Answer: c Explanation
As explained in chapter 4, “The Servlet model,” the OutputStream of a response object is used for sending binary data to the client while the Writer object is used for sending character data. However, we cannot use both on the same response object. Since the JSP engine automatically gets the JspWriter from the response object to output the content of the JSP as character data, the call to getOutputStream() throws a java.lang.IllegalStateException. Thus, the correct answer is c.
Q.10 Which of the following implicit objects does not represent a scope container? (Select one)
a. application
b. session
c. request
d. page
e. pageContext
Answer: d Explanation
The implicit objects application, session, and request represent the containers for the scopes, application, session, and request, respectivelyThe implicit object page refers to the generated Servlet and does not represent any scope container. The implicit object pageContext represents the page scope container, so the correct answer is d.
Q.11 What is the output of the following code? (Select one)
<html><body>
<% int i = 10 ;%>
<% while(--i>=0) { %>
out.print(i);
<% } %>
</body></html>
a. 9876543210
b. 9
c. 0
d. None of the above.
Answer: d Explanation
The statement out.print(i) is not inside a scriptlet and is part of the template text. The above JSP page will print 
out.print(i);out.print(i);out.print(i);......
ten times.
When in doubt, always convert a JSP code to its equivalent servlet code step by step:
out.write("<html><body>");
int i = 10;
while (--i>=) {
    out.write("out.print(i); ");
}
out.write("<html><body>");
Q.12 Which of the following is not a valid XML-based JSP tag? (Select one)
a. <jsp:directive.page />
b. <jsp:directive.include />
c. <jsp:directive.taglib />
d. <jsp:declaration></jsp:declaration>
e. <jsp:scriptlet></jsp:scriptlet>
f. <jsp:expression></jsp:expression>
Answer: c Explanation
The tag <jsp:directive.taglib> is not a valid XML-based tag. Remember that tag library information is provided in the <jsp:root> element.
Q.13 Which of the following XML syntax format tags do not have an equivalent in JSP syntax format? (Select two)
a. <jsp:directive.page/>
b. <jsp:directive.include/>
c. <jsp:text></jsp:text>
d. <jsp:root></jsp:root>
e. <jsp:param/>
Answers: c and d Explanation
The equivalent of <jsp:directive.page/> is <%@ page %>. The equivalent of <jsp:directive.include/> is <%@ include %>. The <jsp:param/> tag is the same for both the syntax formats. Thus, the correct answers are c and d. The tags <jsp:text> and <jsp:root> have no equivalent in the JSP syntax format.
Q.14 Which of the following is a valid construct to declare that the implicit variable
session should be made available to the JSP page? (Select one)
a. <jsp:session>true</jsp:session>
b. <jsp:session required="true" />
c. <jsp:directive.page>
        <jsp:attribute name="session" value="true" />
    </jsp:directive.page>
d. <jsp:directive.page session="true" />
e. <jsp:directive.page attribute="session" value="true" />
Answer: d Explanation
The correct way to declare that the implicit variable session should be made available to the JSP page in XML format is shown in answer d: <jsp:directive. page session="true" />.

Saturday, 23 January 2016

DEVELOPING SECURE WEB APPLICATIONS

Q.1 Which of the following correctly defines data integrity? (Select one)
a. It guarantees that information is accessible only to certain users.
b. It guarantees that the information is kept in encrypted form on the server.
c. It guarantees that unintended parties cannot read the information during transmission between the client and the server.
d. It guarantees that the information is not altered during transmission between the client and the server.
Answer: d Explanation
Answers a and c describe authorization and confidentiality. Encrypting data kept on the server may be part of some security plans, but is not covered by the servlet specification.
Q.2 What is the term for determining whether a user has access to a particular resource? (Select one)
a. Authorization
b. Authentication
c. Confidentiality
d. Secrecy
Answer: a Explanation
Authentication is the process of identifying a user. Confidentiality ensures that third parties cannot eavesdrop on client-server communication. Encrypting communications between the client and server can prevent secrecy attacks.
Q.3 Which one of the following must be done before authorization takes place? (Select one)
a. Data validation
b. User authentication
c. Data encryption
d. Data compression
Answer: b Explanation
First, a user is authenticated. Once the identity of the user is determined using any of the authentication mechanisms, authorization is determined on a per resource basis.
Q.4 Which of the following actions would you take to prevent your web site from being attacked? (Select three)
a. Block network traffic at all the ports except the HTTP port.
b. Audit the usage pattern of your server.
c. Audit the Servlet/JSP code.
d. Use HTTPS instead of HTTP.
e. Design and develop your web application using a software engineering methodology.
f. Use design patterns.
Answers: a, c, and d Explanation
Answer a is correct because this will prevent network congestion and will close all possible entry points to the server except HTTP. Answer b seems correct, but it is wrong because auditing the usage pattern will help you in finding out the culprits only after the site has been attacked—it will not prevent an attack. Answer c is correct because auditing the Servlet/JSP code will ensure that no malicious code exists inside your server that can open a backdoor for hackers. Answer d is correct because HTTPS will prevent hackers from sniffing the communication between the clients and the server, thereby preventing the leakage of sensitive information such as usernames and passwords. Answers e and f are good for developing an industrial-strength system but are not meant for making a system attack proof.
Q.5. Identify the authentication mechanisms that are built into the HTTP specification. (Select two)
a. Basic
b. Client-Cert
c. FORM
d. Digest
e. Client-Digest
f. HTTPS
Answers: a and d Explanation
The HTTP specification only defines Basic and Digest authentication mechanisms.
Q.6 Which of the following deployment descriptor elements is used for specifying the
authentication mechanism for a web application? (Select one)
a. security-constraint
b. auth-constraint
c. login-config
d. web-resource-collection
Answer: c Explanation
The authentication mechanism is specified using the login-config element; for example:
<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>sales</realm-name>
    <form-login-config>
        <form-login-page>/formlogin.html</form-login-page>
        <form-error-page>/formerror.html</form-error-page>
    </form-login-config>
</login-config>
The security-constraint, auth-constraint, and web-resource-collection elements are used for specifying the authorization details of the resources.
Q.7 Which of the following elements are used for defining a security constraint? Choose only those elements that come directly under the security constraint element. (Select three)
a. login-config
b. role-name
c. role
d. transport-guarantee
e. user-data-constraint
f. auth-constraint
g. authorization-constraint
h. web-resource-collection
Answers: e, f, and h Explanation
Remember that, logically, you need three things to define a security constraint: a collection of resources (i.e., web-resource-collection), a list of roles who are authorized to access the collection of resources (i.e., auth-constraint), and finally, the way the application data has to be transmitted between the clients and the server (i.e., user-data-constraint).
The following is the definition of the security-constraint element:
    <!ELEMENT security-constraint (display-name?, web-resource-collection+, auth-                 constraint?, user-data-constraint?)>
Q.8 Which of the following web.xml snippets correctly identifies all HTML files under the sales directory? (Select two)
a. <web-resource-collection>
         <web-resource-name>reports</web-resource-name>
         <url-pattern>/sales/*.html</url-pattern>
     </web-resource-collection>
b. <resource-collection>
         <web-resource-name>reports</web-resource-name>
         <url-pattern>/sales/*.html</url-pattern>
     </resource-collection>
c. <resource-collection>
         <resource-name>reports</resource-name>
         <url-pattern>/sales/*.html</url-pattern>
     </resource-collection>
d. <web-resource-collection>
         <web-resource-name>reports</web-resource-name>
         <url-pattern>/sales/*.html</url-pattern>
         <http-method>GET</http-method>
     </web-resource-collection>
Answers: a and d Explanation
A collection of web resources is defined using the web-resource-collection element, which is defined as follows:
<!ELEMENT web-resource-collection (web-resource-name, description?, url-pattern*, http-method*)>
Observe that http-method is optional. The absence of the http-method element is equivalent to specifying all HTTP methods.
Q.9 You want your PerformanceReportServlet to be accessible only to managers. This servlet generates a performance report in the doPost() method based on a FORM submitted by a user. Which of the following correctly defines a security constraint for this purpose? (Select one)
a. <security-constraint>
         <web-resource-collection>
             <web-resource-name>performance report</web-resource-name>
             <url-pattern>/servlet/PerformanceReportServlet</url-pattern>
             <http-method>GET</http-method>
         </web-resource-collection>
         <auth-constraint>
             <role-name>manager</role-name>
         </auth-constraint>
         <user-data-constraint>
             <transport-guarantee>NONE</transport-guarantee>
         </user-data-constraint>
    </security-constraint>
b. <security-constraint>
         <web-resource-collection>
             <web-resource-name>performance report</web-resource-name>
             <url-pattern>/servlet/PerformanceReportServlet</url-pattern>
             <http-method>*</http-method>
         </web-resource-collection>
         <accessibility>
              <role-name>manager</role-name>
         </accessibility>
         <user-data-constraint>
             <transport-guarantee>CONFIDENTIAL</transport-guarantee>
         </user-data-constraint>
      </security-constraint>
c. <security-constraint>
         <web-resource-collection>
             <web-resource-name>performance report</web-resource-name>
             <url-pattern>/servlet/PerformanceReportServlet</url-pattern>
             <http-method>POST</http-method>
         </web-resource-collection>
         <accessibility>
             <role-name>manager</role-name>
         </accessibility>
         <user-data-constraint>
             <transport-guarantee>CONFIDENTIAL</transport-guarantee>
         </user-data-constraint>
      </security-constraint>
d. <security-constraint>
         <web-resource-collection>
             <web-resource-name>performance report</web-resource-name>
             <url-pattern>/servlet/PerformanceReportServlet</url-pattern>
             <http-method>POST</http-method>
         </web-resource-collection>
          <auth-constraint>
               <role-name>manager</role-name>
          </auth-constraint>
Explanation
Since the question states that the servlet generates the report in the doPost() method, either the <http-method> must specify POST or there should be no <http-method> (which means the restriction applies to all the methods). Thus, answer a is incorrect. Further, the question states that the report should be accessible only to managers. This needs to be specified using the <auth-constraint> element. There is no such element as <accessibility>. Therefore, answers b and c are incorrect. Answer d is correct because both of the above requirements are satisfied. The question does not say anything about the <user-data-constraint> element, which is optional anyway.
Q.10 Which of the following statements regarding authentication mechanisms are correct?
(Select two)
a. The HTTP Basic mechanism transmits the username/password “in the open.”
b. The HTTP Basic mechanism uses HTML FORMs to collect usernames/passwords.
c. The transmission method in the Basic and FORM mechanisms is the same.
d.The method of capturing the usernames/passwords in the Basic and FORM mechanisms is the same.
Answers: a and c Explanation
The HTTP Basic mechanism uses a browser-specific way (usually a dialog box) to capture the username and password, while the FORM mechanism uses an HTML FORM to do the same. However, both mechanisms transmit the captured values in clear text without any encryption. Therefore, answers a and c are correct.
Q.11 Which of the following statements are correct for an unauthenticated user? (Select two)
a. HttpServletRequest.getUserPrincipal() returns null.
b. HttpServletRequest.getUserPrincipal() throws SecurityException.
c. HttpServletRequest.isUserInRole() returns false.
d. HttpServletRequest.getRemoteUser() throws a SecurityException.
Answers: a and c Explanation
None of the three methods—getUserPrincipal(), isUserInRole(), and getRemoteUser()—throws an exception. We suggest you read the description of these methods in the JavaDocs.

Java OOPs Concepts

The programming paradigm where everything is represented as an object, is known as truly object-oriented programming language.
OOPs (Object Oriented Programming System)
java oops conceptsObject means a real word entity such as pen, chair, table etc. Object-Oriented Programming is a methodology or paradigm to design a program using classes and objects. It simplifies the software development and maintenance by providing some concepts:
  • Object
  • Class
  • Inheritance
  • Polymorphism
  • Abstraction
  • Encapsulation
Object
Any entity that has state and behavior is known as an object. For example: chair, pen, table, keyboard, bike etc. It can be physical and logical.
Inheritance
When one object acquires all the properties and behaviours of parent object i.e. known as inheritance. It provides code reusability. It is used to achieve runtime polymorphism.
Polymorphism
When one task is performed by different ways i.e. known as polymorphism. For example: to convense the customer differently, to draw something e.g. shape or rectangle etc.
In java, we use method overloading and method overriding to achieve polymorphism.
Another example can be to speak something e.g. cat speaks meaw, dog barks woof etc.
polymorphism in java oops concepts
Abstraction
Hiding internal details and showing functionality is known as abstraction. For example: phone call, we don’t know the internal processing.
In java, we use abstract class and interface to achieve abstraction.
Encapsulation
Binding (or wrapping) code and data together into a single unit is known as encapsulation. For example: capsule, it is wrapped with different medicines.
encapsulation in java oops concepts
A java class is the example of encapsulation. Java bean is the fully encapsulated class because all the data members are private here.
Advantage of OOPs over Procedure-oriented programming language
1)OOPs makes development and maintenance easier where as in Procedure-oriented programming language it is not easy to manage if code grows as project size grows.
2)OOPs provides data hiding whereas in Procedure-oriented programming language a global data can be accessed from anywhere.
3)OOPs provides ability to simulate real-world event much more effectively. We can provide the solution of real word problem if we are using the Object-Oriented Programming language.
Global DataObject Data
What is difference between object-oriented programming language and object-based programming language?
Object based programming language follows all the features of OOPs except Inheritance. JavaScript and VBScript are examples of object based programming languages.