CSE 190: Internet E-Commerce

1. CSE 190: Internet E-Commerce Sample Final Exam Questions

2. SQL, DB Design 1. Given these tables, write an appropriate SQL query:real_estate_agent (id, name, region)sales (id, agent_id, property_id, price, date)property (id, address) • Show who sold what property during the last month. select a.name, p.address from real_estate_agent a, sales s, property p where s.agent_id = a.id and s.property_id = p.id and s.date >= ’02/01/2002’ 2. Show total sales by region after ’01/01/2002’ select a.region, sum(s.price) from real_estate_agent a, sales s where s.agent_id = a.id and s.date > ’01/01/2002’group by a.region

3. SQL, DB Design 2. Put the following table design in 3-NF.Workflow_event (document_name, source_name, source_email, destination_name, destination_email, date) ‘Source’ and ‘destination’ are the people, with names and email addresses. Document_name is a name identifying a document being passed between people, usually unchanged through a multi-step transaction.workflow_events(document_id,source_id,dest_id,date)documents(document_id, document_name)people(source_id, source_name, source_email)

4. DB Coding 3. Write ADO code to query the preceding design for all of today’s work flow events. See lecture notes 4. Write JSP code to query the preceding design for all of today’s work flow events. See lecture notes

5. Operations 5. What is the purpose of robots.txt?Exclude automated programs from accessing certain pages or sections of your web site. This is done for efficiency (pages may be soon obsolete), security (pages may have sensitive content), and operational reasons (access may be being abused by the robot). Of course, automated programs might ignore the file, as this cannot be automatically enforced. 6. What is the purpose of a data center? Provide facilities to host the servers of a web site. The data center may be owned by the firm or be a third-party to whom data center services are outsourced. Generally, data centers provide security, power, bandwidth, and monitoring services.

6. Security 7. Sketch how to write a buffer overflow attack on the following code: char body[ BUFSIZ ];int bodyByteCount = parseHeader( header ); int rc = recv( sock, body, bodyByteCount ); The receiving end writes code similar to this: for( 1..n ) { // n is much greater than BUFSIZsend( sock, 0x90 ); // send NOP code character // which depends on the platform}char hostileCode[] = “\xEB……./bin/sh\”…….”;/* hostileCode = byte codes for this code: execve( “/bin/sh”, args ); return;*/send( sock, hostileCode );

7. Security 8. Explain the difference between the entropy of a session key and its length. How do you exploit a session key with low entropy?The entropy of a session key is the negative log of the inverse of the probability of predicting the session key. The length of the session key is the count of bits representing the key. The length is always greater than the entropy. A good session key has a high entropy, and is compact if the session key length is close to the entropy.If the session key has a low entropy, then regardless of the length of the session key, it is vulnerable to the following attack: generate random session keys using some predictive model. Test the generated key; if it works, as expected with a low entropy, then you now have a valid session. Repeat until you have a valid session.This is why generating a random session key from a user’s password gains no security advantage over storing a one way hash of the password; the entropy of the key is the same as the entropy of the password, which is low.

8. Performance 9. Why might you use client IP affinity instead of no affinity for load balancing? What is the trade off?If you have resources which are cached at the server (e.g. an SSL session) which are expensive to re-establish at a fresh server, you may use client IP affinity to insure that requests from the same client are repeatedly satisfied by the same server during this session. The trade off is that the load may be unevenly distributed. This organization is still robust to failure though. 10. What is the difference between network and application load balancing?Application load balancing chooses the least loaded server to handle the newest incoming request. Network load balancing treats all servers as equal, regardless of their load, and assigns requests in a round-robin or random manner. In other words, application load balancing uses some knowledge about the application’s run-time behavior and network load balancers limit their knowledge to the network layer.

9. 11. How is XML different from HTML? Both are an application of SGML. However, XML is similar to SGML because it allows the document author to invent their own tags. Both XML and HTML may be validated against their DTD (document type definition.) 12. What’s the result of applying this stylesheet to this XML document? See lecture exampleXml: <?xml version="1.0" encoding="ISO-8859-1" ?> <!-- Edited with XML Spy v4.2 --> - <CATALOG> - <CD> <TITLE>Empire Burlesque</TITLE> <ARTIST>Bob Dylan</ARTIST> <COUNTRY>USA</COUNTRY> <COMPANY>Columbia</COMPANY> <PRICE>10.90</PRICE> <YEAR>1985</YEAR> </CD> - <CD> <TITLE>Hide your heart</TITLE> <ARTIST>Bonnie Tyler</ARTIST> <COUNTRY>UK</COUNTRY> <COMPANY>CBS Records</COMPANY> <PRICE>9.90</PRICE> <YEAR>1988</YEAR> </CD> </CATALOG> XSL: XSL: <?xml version="1.0" encoding="ISO-8859-1" ?> - <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> - <xsl:template match="/"> - <html> - <body> - <table border="1"> - <tr> <th>Title</th> <th>Artist</th> </tr> - <xsl:for-each select="catalog/cd"> - <tr> - <td> <xsl:value-of select="title" /> </td> - <td> <xsl:value-of select="artist" /> </td> </tr> </xsl:for-each> </table> </body> </html> </xsl:template> </xsl:stylesheet XML, XSL

10. SOAP 13. Show the function call that corresponds to this SOAP request, in any programming language.<soap:Envelope><soap:Body><xmlns:m= "http://www.amzn.org/books"/>    <m:GetBookPrice> <m:BookName>Fast Food Nation</m:BookName>   </m:GetBookPrice> </soap:Body> </soap:Envelope> In Java: float GetBookPrice( String BookName );

11. WML 14. What is WML for? What criticism could you offer for representing web content this way? WML = Web Markup Language. Used to communicate online content to mobile devices (wireless) through the WAP protocol. It was designed to be a simpler, more constrained subset of HTML, with more limited display capabilities.Arguably WML should not exist, and wireless devices should read HTML and render it using its more limited display capabilities, as was originally intended by HTML’s authors. WML asks content authors to effectively create a second web, parallel to the HTML web, which is possibly an expensive proposition.