SCWCD Questions 231- 240

QUESTION NO: 231


Which two statements are true about the security-related tags in a valid Java EE deployment
descriptor? (Choose two.)
A. Every <security-constraint> tag must have at least one <http-method> tag.
B. A <security-constraint> tag can have many <web-resource-collection> tags.
C. A given <auth-constraint> tag can apply to only one <web-resource-collection> tag.
D. A given <web-resource-collection> tag can contain from zero to many <url-pattern> tags.
E. It is possible to construct a valid <security-constraint> tag such that, for a given resource, no
user roles can access that resource.

Answer: B,E


QUESTION NO: 232


Which element of a web application deployment descriptor <security-constraint> element is
required?
A. <realm-name>
B. <auth-method>
C. <security-role>
D. <transport-guarantee>
E. <web-resource-collection>

Answer: E


QUESTION NO: 233


Which two are required elements for the <web-resource-collection> element of a web application
deployment descriptor? (Choose two.)
A. <realm-name>
B. <url-pattern>
C. <description>
D. <web-resource-name>
E. <transport-guarantee>

Answer: B,D


QUESTION NO: 234


Given:
3. class MyServlet extends HttpServlet {
4. public void doPut(HttpServletRequest req,
HttpServletResponse resp)
throws ServletException, IOException {
5. // servlet code here
...
26. }
27. }
If the DD contains a single security constraint associated with MyServlet and its only <httpmethod>
tags and <auth-constraint> tags are:
<http-method>GET</http-method>
<http-method>PUT</http-method>
<auth-constraint>Admin</auth-constraint>
Which four requests would be allowed by the container? (Choose four.)
A. A user whose role is Admin can perform a PUT.
B. A user whose role is Admin can perform a GET.
C. A user whose role is Admin can perform a POST.
D. A user whose role is Member can perform a PUT.
E. A user whose role is Member can perform a POST.
F. A user whose role is Member can perform a GET.

Answer: A,B,C,E


QUESTION NO: 235


What is true about Java EE authentication mechanisms?
A. If your deployment descriptor correctly declares an authentication type of CLIENT_CERT, your
users must have a certificate from an official source before they can use your application.
B. If your deployment descriptor correctly declares an authentication type of BASIC, the container
automatically requests a user name and password whenever a user starts a new session.
C. If you want your web application to support the widest possible array of browsers, and you want
to perform authentication, the best choice of Java EE authentication mechanisms is DIGEST.
D. To use Java EE FORM authentication, you must declare two HTML files in your deployment
descriptor, and you must use a predefined action in the HTML file that handles your user's login.

Answer: D


QUESTION NO: 236


Which two statements are true about using the isUserInRole method to implement security in a
Java EE application? (Choose two.)
A. It can be invoked only from the doGet or doPost methods.
B. It can be used independently of the getRemoteUser method.
C. Can return "true" even when its argument is NOT defined as a valid role name in the
deployment descriptor.
D. Using the isUserInRole method overrides any declarative authentication related to the method
in which it is invoked.
E. Using the isUserInRole method overrides any declarative authorization related to the method in
which it is invoked.

Answer: B,C


QUESTION NO: 237


Given an HttpServletRequest request and an HttpServletResponse response:
41. HttpSession session = null;
42. // insert code here
43. if(session == null) {
44. // do something if session does not exist
45. } else {
46. // do something if session exists
47. }
To implement the design intent, which statement must be inserted at line 42?
A. session = response.getSession();
B. session = request.getSession();
C. session = request.getSession(true);
D. session = request.getSession(false);
E. session = request.getSession("jsessionid");

Answer: D


QUESTION NO: 238


You need to store a floating point number, called Tsquare, in the session scope. Which two code
snippets allow you to retrieve this value? (Choose two.)
A. float Tsquare = session.getFloatAttribute("Tsquare");
B. float Tsquare = (Float) session.getAttribute("Tsquare");
C. float Tsquare = (float) session.getNumericAttribute("Tsquare");
D. float Tsquare = ((Float) session.getAttribute.("Tsquare")).floatValue();
E. float Tsquare = ((Float) session.getFloatAttribute.("Tsquare")).floatValue;
F. float Tsquare = ((Float) session.getNumericAttribute.("Tsquare")).floatValue;

Answer: B,D


QUESTION NO: 239


A web application uses the HttpSession mechanism to determine if a user is "logged in." When a
user supplies a valid user name and password, an HttpSession is created for that user.
The user has access to the application for only 15 minutes after logging in. The code must
determine how long the user has been logged in, and if this time is greater than 15 minutes, must
destroy the HttpSession.
Which method in HttpSession is used to accomplish this?
A. getCreationTime
B. invalidateAfter
C. getLastAccessedTime
D. getMaxInactiveInterval

Answer: A


QUESTION NO: 240


Which method must be used to encode a URL passed as an argument to
HttpServletResponse.sendRedirect when using URL rewriting for session tracking?
A. ServletResponse.encodeURL
B. HttpServletResponse.encodeURL
C. ServletResponse.encodeRedirectURL
D. HttpServletResponse.encodeRedirectURL

Answer: D