HttpSessionActivationListener
HttpSessionBindingListener
These two listeners do not need to be configured in the deployment descriptor.
Here's an excerpt taken from David Bridgewater's post in javaranch (
https://coderanch.com/t/170002/Web-Component-Certification-SCWCD/certification/HttpSessionActivationListener-configured-DD)
A part of the API
doc for HttpSessionActivationListener:
"Objects that are bound to a session may listen to container events notifying them that sessions will be passivated and that session will be activated. A container that migrates session between VMs or persists sessions is required to notify all attributes bound to sessions implementing HttpSessionActivationListener."
It's the objects that do the listening (not the container) - so no need for a DD entry.
For the 2nd you know the answer.