A web component accesses a local EJB session bean with a component interface of com.example.Account with a home interface of com.example.AccountHome and a JNDI reference of ejb/Account. Which makes the local EJB component accessible to the web components in the web application deployment descriptor?

• A. <resource-ref>
  <ejb-ref-name>ejb/Account</ejb-ref-name>
  <ejb-ref-type>Session</ejb-ref-type>
  <local-home>com.example.AccountHome</local-home>
  <local>com.example.Account</local> </resource-ref>
• B. <ejb-remote-ref>
  <ejb-ref-name>ejb/Account</ejb-ref-name>
  <ejb-ref-type>Session</ejb-ref-type>
  <local-home>com.example.AccountHome</local-home>
  <local>com.example.Account</local>
  </ejb-remote-ref>
• C. <ejb-local-ref>
  <ejb-ref-name>ejb/Account</ejb-ref-name>
  <ejb-ref-type>Session</ejb-ref-type>
  <local-home>com.example.AccountHome</local-home>
  <local>com.example.Account</local>
  </ejb-local-ref>
• D. <env-ref>
  <ejb-ref-name>ejb/Account</ejb-ref-name>
  <ejb-ref-type>Session</ejb-ref-type>
  <local-home>com.example.AccountHome</local-home>
  <local>com.example.Account</local>
  </env-ref>

Given:
6.<myTag:foo bar='42'>
7.<%="processing" %>
8.</myTag:foo>
and a custom tag handler for foo which extends TagSupport.
Which two are true about the tag handler referenced by foo? (Choose two.)

• A. The doAfterBody method is NOT called.
• B. The EVAL_PAGE constant is a valid return value for the doEndTag method.
• C. The SKIP_PAGE constant is a valid return value for the doStartTag method.
• D. The doStartTag method is called once.
• E. The EVAL_BODY_BUFFERED constant is a valid return value for the doStartTag method.

Which statement is true about web container session management?

• A. If the web application uses HTTPS, then the web container may use the data on the HTTPS request stream to identify the client.
• B. To activate URL rewriting, the developer must use the HttpServletResponse.setURLRewriting method.
• C. Access to session-scoped attributes is guaranteed to be thread-safe by the web container.
• D. The JSESSIONID cookie is stored permanently on the client so that a user may return to the web application and the web container will rejoin that session.

You are building JSP pages that have a set of menus that are visible based on a user's security role. These menus are hand-crafted by your web design team; for example, the SalesManager role has a menu in the file /WEB-INF/html/sales-mgr-menu.html. Which JSP code snippet should be used to make this menu visible to the user?

• A. <jsp:if test='request.isUserInRole("SalesManager")'> <jsp:include file='/WEB-INF/html/sales-mgr-menu.html' /> </jsp:if>
• B. <% if ( request.isUserInRole("SalesManager") ) { %> <jsp:include file='/WEB-INF/html/sales-mgr-menu.html' /> <% } %>
• C. <% if ( request.isUserInRole("SalesManager") ) { %> <%@ include file='/WEB-INF/html/sales-mgr-menu.html' %> <% } %>
• D. <jsp:if test='request.isUserInRole("SalesManager")'> <%@ include file='/WEB-INF/html/sales-mgr-menu.html' %> </jsp:if>

Which two are valid values for the <transport-guarantee> element inside a <securityconstraint> element of a web application deployment descriptor? (Choose two.)

• A. SECURE
• B. ENCRYPTED
• C. CONFIDENTIAL
• D. INTEGRAL
• E. NULL