===============================================================================
              MCQ QUIZ - TOPIC 4: GEN AI (STAGE 2)
              100 Hours Java Backend Developer Pedagogy
===============================================================================
  Instructions:
  - Total 30 questions (10 questions for each of the 3 sessions).
  - Choose the best option (a, b, c or d) for each question.
  - Answers are given in the ANSWER SHEET at the end of this file.
===============================================================================


===============================================================================
SESSION 1 - GENAI FOR THE WEB LAYER (SERVLET & JSP)
===============================================================================

Q1. The same servlet API exists under two package names (javax.servlet and
    jakarta.servlet) because:
    a) Oracle removed the API from Java 9
    b) two different companies wrote the API
    c) Java EE moved to the Eclipse Foundation, but the javax name could
       not move with it - one rename, two incompatible worlds
    d) jakarta is only for Kotlin projects

Q2. The jakarta.servlet.* namespace is correct for:
    a) Apache Tomcat 9 and earlier
    b) Apache Tomcat 10+ (Jakarta EE 9+)
    c) Java EE 8 and earlier
    d) any container - it does not matter

Q3. Which is the JSTL core URI for Jakarta EE 9+ / Tomcat 10+?
    a) jakarta.tags.core
    b) http://java.sun.com/jsp/jstl/core
    c) http://java.sun.com/jstl/core
    d) jakarta/jsp/jstl/core

Q4. Using a wrong taglib URI in a JSP causes:
    a) a compile error in the servlet
    b) an immediate ClassNotFoundException with a stack trace
    c) HTTP 404 for the whole application
    d) no exception at all - the browser simply prints the tag as literal
       text on the page

Q5. Thirty students hit the same URL at once and the displayed order
    count is lower than the actual number of orders, with no exception in
    the logs. What is the most likely cause?
    a) The container created a new servlet instance per request, each one
       starting counting from zero
    b) A counter held in a servlet instance field is shared across
       threads, and count++ is not atomic (read-modify-write)
    c) doGet was missing throws ServletException, IOException
    d) The count was stored in session scope instead of request scope

Q6. A generated servlet keeps
    private SimpleDateFormat fmt = new SimpleDateFormat("dd/MM/yyyy");
    as an instance field. Under load this:
    a) is the recommended pattern for performance
    b) is thread-safe because SimpleDateFormat is immutable
    c) is not thread-safe and garbles the dates under load
    d) causes a compilation error

Q7. A user submits <script>alert('hacked')</script> as their name. Which
    of the following renders it as harmless text?
    a) <c:out value="${param.name}"/>
    b) ${param.name}
    c) <%= request.getParameter("name") %>
    d) All of the above escape the input

Q8. The prompted replacement for the scriptlet version of a welcome page
    uses:
    a) only <% String name = request.getParameter("name"); %>
    b) plain HTML only, no logic
    c) EL and JSTL, e.g. <c:if test="${not empty param.name}"> with
       <c:out value="${param.name}"/> - the XSS defence comes free
    d) JavaScript document.write

Q9. Which statement about forward versus redirect is correct?
    a) Redirect keeps request-scope attributes; forward loses them
    b) Forward keeps request-scope attributes; redirect starts a fresh
       request and loses them
    c) Both keep all attributes
    d) Neither transfers any data

Q10. The web-layer validation checklist known as the "3 W's" is:
     a) What, Where, When
     b) Why, What, Who
     c) Which file, Which line, Which method
     d) W1 which namespace, W2 what happens with two users (concurrency),
        W3 where user input reaches the page (escaping)


===============================================================================
SESSION 2 - PROMPT ENGINEERING FOR SQL
===============================================================================

Q1. Schema-aware prompting means:
    a) paste the schema (tables, columns, relationships), state the
       dialect (e.g. MySQL 8) and give the exact question with filters,
       sort and limit
    b) ask for the shortest possible query
    c) run the same prompt several times and pick one
    d) avoid mentioning the database at all

Q2. The AI writes WHERE o.total > 1000, but the schema has amount, not
    total. This is:
    a) a dialect problem only
    b) a hallucination - a column not in your schema, which fails with
       "unknown column" or is silently wrong
    c) a SQL injection vulnerability
    d) correct SQL

Q3. To filter departments with average CGPA above 8.0, you must use:
    a) WHERE AVG(cgpa) > 8.0 before GROUP BY
    b) ORDER BY AVG(cgpa)
    c) HAVING AVG(cgpa) > 8.0 after GROUP BY, because a condition on an
       aggregate must be applied after grouping
    d) LIMIT 8.0

Q4. Revenue per city suddenly doubles after adding a second one-to-many
    join, with no error raised. What is the cause and how is it caught?
    a) The amount column was hallucinated - rename it
    b) A hidden syntax error was silently ignored by the database
    c) The wrong SQL dialect was used
    d) The one-to-many join multiplied the order rows, so SUM counted
       each order once per item; catch it by running on small known
       sample data and comparing against a hand-calculated total

Q5. The safe way to write
    "... WHERE email = '" + email + "' AND active = 1" is:
    a) a PreparedStatement with email = ? and pstmt.setString(1, email)
    b) manually escape single quotes in email, then concatenate
    c) check that email is under 100 characters, then concatenate
    d) keep the concatenation but wrap executeQuery in a try-catch

Q6. PreparedStatement prevents SQL injection because:
    a) it encrypts the query before sending it
    b) it validates the data types only
    c) the driver sends the value as data separate from the SQL text, so
       it can never be parsed and executed as code
    d) it blocks network access to the database

Q7. A generated method closes Connection, PreparedStatement and
    ResultSet manually at the end of the method, but row-mapping
    exceptions skip the close calls. What is the best fix?
    a) No fix needed - the garbage collector closes them eventually
    b) Declare all three in a try-with-resources block, since they are
       all AutoCloseable and are closed automatically even when an
       exception is thrown
    c) Move the .close() calls into a catch block
    d) Add a "// remember to close" comment above the method

Q8. A DAO file contains a real JDBC URL with a password and real customer
    email addresses, and you want to paste it into a public chatbot. What
    is the correct approach?
    a) Remove or replace the credentials and real customer data (or use a
       licensed/enterprise tool) - treat a public LLM like a public forum
       and you remain accountable for what you submit
    b) Paste the whole file - the model needs full context
    c) Paste it, but add "please don't remember or store this"
    d) Paste only the customer emails; a connection string isn't
       sensitive

Q9. "It ran" means:
    a) the query is correct
    b) the query is fast
    c) the query is injection-safe
    d) nothing - a wrong query runs fine and returns plausible-but-wrong
       data, and a JOIN can inflate a COUNT or SUM with no error at all

Q10. The stated order of importance when validating a generated JDBC
     method is:
     a) correctness first, security last
     b) resource leaks first, then security
     c) security first, then leaks, then correctness, then behaviour
     d) documentation first


===============================================================================
SESSION 3 - GENAI FOR REST API DESIGN
===============================================================================

Q1. The prompt says "Java 17, plain Servlet API, no framework", yet the
    generated code imports com.fasterxml.jackson.databind.ObjectMapper.
    What is the most accurate diagnosis?
    a) The Context Block was underspecified - "no framework" does not
       exclude a JSON library, which the model treats as a separate
       default
    b) A hallucination - Jackson does not provide an ObjectMapper class
    c) A concurrency defect - ObjectMapper is unsafe as a servlet field
    d) The prompt was overloaded with routing and serialisation at once

Q2. A servlet is mapped with @WebServlet("/api/orders/*") and doGet
    begins String id = req.getPathInfo().substring(1);. A client requests
    GET /api/orders to retrieve the full collection. What happens?
    a) getPathInfo() returns "", so substring(1) throws
       StringIndexOutOfBoundsException
    b) getPathInfo() returns "/", so id becomes "" and the lookup quietly
       returns nothing
    c) getPathInfo() returns null, so substring(1) throws
       NullPointerException -> 500, on a request that is completely valid
    d) The container never routes /api/orders to this servlet, so the
       client receives 404

Q3. A mobile app POSTs {"city":"Coimbatore","total":480} with
    Content-Type: application/json. The servlet runs
    String city = request.getParameter("city"); and every field comes
    back null, but the server returns 200 and logs nothing. Why?
    a) The JSON was malformed, so the container discarded the body before
       the servlet ran
    b) getParameter() reads only the query string and form-encoded
       bodies - a JSON body is invisible to it; the raw body must be read
       with request.getReader() and parsed
    c) setCharacterEncoding("UTF-8") was not called
    d) getParameter() does not populate on POST requests

Q4. doGet calls dao.find(id), gets null (no such order), writes
    toJson(null) to the response and never calls setStatus. Why is this
    worse than crashing?
    a) The client receives 200 OK, treats the request as successful, and
       displays an empty screen with no error and no retry
    b) It is not worse - a 200 with an empty body is a valid way to
       signal "no result"
    c) The container substitutes 500 because the response was committed
    d) toJson(null) throws NullPointerException, so the client receives
       500

Q5. Which implementation is correct for returning "order not found" as
    JSON, and why?
    a) resp.sendError(SC_NOT_FOUND); - it sets the status and lets the
       container handle the body
    b) write the JSON body first, then setStatus(SC_NOT_FOUND), then
       setContentType("application/json")
    c) resp.setStatus(SC_NOT_FOUND);
       resp.setContentType("application/json"); then write the JSON
       body - status, then headers, then body
    d) resp.setContentType("text/html"); resp.sendError(404, "order not
       found")

Q6. Generated documentation documents a DELETE /api/orders/{id} endpoint
    returning 204 No Content, but the servlet overrides only doGet and
    doPost. What actually happens when a client calls DELETE?
    a) The container returns 404, because no doDelete means the route
       does not exist
    b) HttpServlet returns 405 Method Not Allowed; the documentation is a
       phantom endpoint and nothing in the toolchain will flag the
       mismatch
    c) The container returns 501, and the model was right to document
       DELETE because REST requires it
    d) The DELETE succeeds, because doPost handles unmatched verbs

Q7. Which status code should be returned when a new order is created
    successfully by POST?
    a) 201 (SC_CREATED)
    b) 200 (SC_OK)
    c) 204 (SC_NO_CONTENT)
    d) 404 (SC_NOT_FOUND)

Q8. Why should setStatus + a JSON body be used instead of sendError for
    an API?
    a) sendError is faster than setStatus
    b) sendError writes the JSON body automatically
    c) setStatus requires authentication
    d) sendError makes the container return its own HTML error page; a
       mobile app expecting JSON receives HTML, so JSON.parse() throws -
       crash or blank screen

Q9. With mapping @WebServlet("/api/orders/*") and a request for
    GET /api/orders/7, getPathInfo() returns:
    a) /api/orders/7
    b) /api/orders
    c) /7
    d) null

Q10. The fourth W (W4) added to the validation checklist for APIs is:
     a) What does it return when it fails? - does it actually set 404 /
        400, is the error body JSON, and does the documentation promise
        anything the code does not do?
     b) Which namespace?
     c) What happens with two users?
     d) Where does user input reach the page?


===============================================================================
                               ANSWER SHEET
===============================================================================

SESSION 1 - GENAI FOR THE WEB LAYER (SERVLET & JSP)
-------------------------------------------
  Q1  : c    Q2  : b    Q3  : a    Q4  : d    Q5  : b
  Q6  : c    Q7  : a    Q8  : c    Q9  : b    Q10 : d

SESSION 2 - PROMPT ENGINEERING FOR SQL
-------------------------------------------
  Q1  : a    Q2  : b    Q3  : c    Q4  : d    Q5  : a
  Q6  : c    Q7  : b    Q8  : a    Q9  : d    Q10 : c

SESSION 3 - GENAI FOR REST API DESIGN
-------------------------------------------
  Q1  : a    Q2  : c    Q3  : b    Q4  : a    Q5  : c
  Q6  : b    Q7  : a    Q8  : d    Q9  : c    Q10 : a

===============================================================================
                     END OF QUIZ - 30 QUESTIONS TOTAL
===============================================================================