Oracle Oracle Certifications 1Z0-858 Questions & Answers

• Question 31:

  You have been contracted to create a web site for a free dating service. One feature is the ability for one client to send a message to another client, which is displayed in the latter client's private page. Your contract explicitly states that security is a high priority. Therefore, you need to prevent cross-site hacking in which one user inserts JavaScript code that is then rendered and invoked when another user views that content. Which two JSTL code snippets will prevent cross-site hacking in the scenario above? (Choose two.)

  A. ${message}

  B.

  C.

  D. ${message}

  E.

  Correct Answer: BC

• Question 32:

  A custom tag is defined to take three attributes. Which two correctly invoke the tag within a JSP page? (Choose two.)

  A.

  B.

  C.

  D.

  E.

  F.

  G. foobarbaz

  Correct Answer: AG

• Question 33:

  Which two statements are true about the security-related tags in a valid Java EE deployment descriptor? (Choose two.)

  A. Every tag must have at least one tag.

  B. A tag can have many tags.

  C. A given tag can apply to only one tag.

  D. A given tag can contain from zero to many tags.

  E. It is possible to construct a valid tag such that, for a given resource, no user roles can access that resource.

  Correct Answer: BE

• Question 34:

  Which element of a web application deployment descriptor element is required?

  A.

  B.

  C.

  D.

  E.

  Correct Answer: E

• Question 35:

  Which two are required elements for the element of a web application deployment descriptor? (Choose two.)

  A.

  B.

  C.

  D.

  E.

  Correct Answer: BD

• Question 36:

  Given:

  3.

  class MyServlet extends HttpServlet {

  4.

  public void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

  5.

  // servlet code here ...

  26.

  }

  27.

  }

  If the DD contains a single security constraint associated with MyServlet and its only tags and tags are:

  GET PUT Admin

  Which four requests would be allowed by the container? (Choose four.)

  A. A user whose role is Admin can perform a PUT.

  B. A user whose role is Admin can perform a GET.

  C. A user whose role is Admin can perform a POST.

  D. A user whose role is Member can perform a PUT.

  E. A user whose role is Member can perform a POST.

  F. A user whose role is Member can perform a GET.

  Correct Answer: ABCE

• Question 37:

  What is true about Java EE authentication mechanisms?

  A. If your deployment descriptor correctly declares an authentication type of CLIENT_CERT, your users must have a certificate from an official source before they can use your application.

  B. If your deployment descriptor correctly declares an authentication type of BASIC, the container automatically requests a user name and password whenever a user starts a new session.

  C. If you want your web application to support the widest possible array of browsers, and you want to perform authentication, the best choice of Java EE authentication mechanisms is DIGEST.

  D. To use Java EE FORM authentication, you must declare two HTML files in your deployment descriptor, and you must use a predefined action in the HTML file that handles your user's login.

  Correct Answer: D

• Question 38:

  Which two statements are true about using the isUserInRole method to implement security in a Java EE application? (Choose two.)

  A. It can be invoked only from the doGet or doPost methods.

  B. It can be used independently of the getRemoteUser method.

  C. Can return "true" even when its argument is NOT defined as a valid role name in the deployment descriptor.

  D. Using the isUserInRole method overrides any declarative authentication related to the method in which it is invoked.

  E. Using the isUserInRole method overrides any declarative authorization related to the method in which it is invoked.

  Correct Answer: BC

• Question 39:

  Given an HttpServletRequest request and an HttpServletResponse response:

  41.

  HttpSession session = null;

  42.

  // insert code here

  43.

  if(session == null) {

  44.

  // do something if session does not exist

  45.

  } else {

  46.

  // do something if session exists

  47.

  }

  To implement the design intent, which statement must be inserted at line 42?

  A. session = response.getSession();

  B. session = request.getSession();

  C. session = request.getSession(true);

  D. session = request.getSession(false);

  E. session = request.getSession("jsessionid");

  Correct Answer: D

• Question 40:

  You need to store a floating point number, called Tsquare, in the session scope. Which two code snippets allow you to retrieve this value? (Choose two.)

  A. float Tsquare = session.getFloatAttribute("Tsquare");

  B. float Tsquare = (Float) session.getAttribute("Tsquare");

  C. float Tsquare = (float) session.getNumericAttribute("Tsquare");

  D. float Tsquare = ((Float) session.getAttribute.("Tsquare")).floatValue();

  E. float Tsquare = ((Float) session.getFloatAttribute.("Tsquare")).floatValue;

  F. float Tsquare = ((Float) session.getNumericAttribute.("Tsquare")).floatValue;

  Correct Answer: BD