As a convenience feature, your web pages include an Ajax request every five minutes to a special servlet that monitors the age of the user's session. The client-side JavaScript that handles the Ajax callback displays a message on the screen as the session ages. The Ajax call does NOT pass any cookies, but it passes the session ID in a request parameter called sessionID. In addition, assume that your webapp keeps a hashmap of session objects by the ID. Here is a partial implementation of this servlet:
10.
public class SessionAgeServlet extends HttpServlet {
11.
public void service(HttpServletRequest request, HttpServletResponse) throws IOException {
12.
String sessionID = request.getParameter("sessionID");
13.
HttpSession session = getSession(sessionID);
14.
long age = // your code here
15.
response.getWriter().print(age);
16.
} ... // more code here
47. }
Which code snippet on line 14, will determine the age of the session?

• A. session.getLastAccessed() - session.getCreationTime();
• B. session.getLastAccessedTime().getTime() - session.getCreationTime().getTime();
• C. session.getMaxInactiveInterval();
• D. session.getLastAccessedTime() - session.getCreationTime();
• E. session.getMaxInactiveInterval() - session.getCreationTime();
• F. session.getLastAccessed().getTime() - session.getCreationTime().getTime();

A developer for the company web site has been told that users may turn off cookie support in their browsers. What must the developer do to ensure that these customers can still use the web application?

• A. The developer must add the string ?id=<sessionid> to the end of every URL to ensure that the conversation with the browser can continue.
• B. The developer must provide an alternate mechanism for managing sessions and abandon the HttpSession mechanism entirely.
• C. The developer must ensure that every URL is properly encoded using the appropriate URL rewriting APIs.
• D. The developer can ignore this issue. Web containers are required to support automatic URL rewriting when cookies are not supported.

Which interface must a class implement so that instances of the class are notified after any object is added to a session?

• A. javax.servlet.http.HttpSessionBindingListener
• B. javax.servlet.http.HttpSessionAttributeListener
• C. javax.servlet.http.HttpSessionValueListener
• D. javax.servlet.http.HttpSessionListener

The Squeaky Beans Inc. shopping application was initially developed for a non-distributed environment. The company recently purchased the Acme Application Server, which supports distributed HttpSession objects. When deploying the application to the server, the deployer marks it as distributable in the web application deployment descriptor to take advantage of this feature.
Given this scenario, which two must be true? (Choose two.)

• A. As per the specification, the J2EE web container ensures that distributed HttpSession objects will be stored in a database.
• B. The J2EE web container must support migration of objects that implement Serializable.
• C. The J2EE web container must use the native JVM Serialization mechanism for distributing HttpSession objects.
• D. Storing references to Enterprise JavaBeans components in the HttpSession object might NOT be supported by J2EE web containers.

Which two are true regarding a web application class loader? (Choose two.)

• A. Resources in the WAR class directory or in any of the JAR files within the library directory CANNOT be accessed using the J2SE semantics of getResource.
• B. A web application may override the web container's implementation classes.
• C. Resources in the WAR class directory or in any of the JAR files within the library directory may be accessed using the J2SE semantics of getResource.
• D. A web application class loader may NOT override any classes in the java.* and javax.* namespaces.
• E. A web application running in a J2EE product may override classes in the javax.* namespace.