I have faced this question in my Interview as well. I do have many confusion with Session Scope & it management in java.
In web.xml we do have the entry :
we have 4 ways to manage a session.
1.Cookies 2.URL rewriting 3.Hidden form fields 4.HTTP session
the fourth one is powerful and mostly used now-a-days.