I selected b. but answer given is a. with below explanation.I think this is wrong.
HttpSessionAttributesListener is configured in deployment descriptor and this does not notify the object that is being added to or removed from the session. It notifies the object that is registered to listen to such events.
b)The implicit variable 'out' is same as returned by response.getWriter()
Initially, out is a new JspWriter object. This object may be different from the stream object returned from response.getWriter() , and may be considered to be interposed on the latter in order to implement buffering (see Section JSP.2.10.1, "The page Directive"). This is the initial out object. JSP page authors are prohibited from writing directly to either the PrintWriter or OutputStream associated with the ServletResponse .
I did check the Spec couldent get any clarity on this.
HttpSessionAttributeListener is configured in deployment descriptor and this does not notify the object that is being added to or removed from the session. It notifies the object that is registered to listen to such events.
The container will notify a listener implementing HttpSessionAttributeListener when attribute are added/removed/replaced. This listener is configured in the deployment descriptor. If you want the containter to notify an attribute when it is being bound/unbound in/from a session, you make the attribute implement HttpSessionBindingListener. There's no need to configure anything in this case, as the container will automatically detect that the attribute implements HttpSessionBindingListener.
You'll also find a useful document about listeners here.
You could use HttpSessionAttributeListener for the same purpose, using the HttpSessionBindingEvent passed in attributeAdded, but you would need a special method in UserClass to tell it that it was added to the session. I think the question would have been something like : "You need to track which attribute is added to the session automatically"