Apache Tomcat is the most widely used open-source server for running Java web applications. It appears in interviews for Java developers, middleware administrators and DevOps engineers. These Apache Tomcat interview questions cover its architecture, configuration, deployment, tuning and security.
Basics
1. What is Apache Tomcat?
Tomcat is an open-source implementation of Jakarta EE web specifications, mainly Jakarta Servlet, Jakarta Pages (JSP), Expression Language and WebSocket. The Apache Software Foundation maintains it. It is a servlet container, not a full Jakarta EE application server.
2. Tomcat vs a full application server?
Full servers, such as WildFly or Payara, support the whole Jakarta EE platform, including features like EJB and JMS. Tomcat supports the web profile basics, so it is lighter and simpler. Many Spring Boot applications embed Tomcat directly.
3. What changed with Tomcat 10?
Tomcat 10 moved from the javax.* package names to jakarta.*, following the move of Java EE to the Eclipse Foundation. Older applications need migration, for example with the Apache Tomcat migration tool, before running on Tomcat 10 or 11.
Architecture
4. Name Tomcat’s main components.
- Catalina: the servlet container.
- Coyote: the connector that handles HTTP and AJP traffic.
- Jasper: the JSP engine that compiles pages into servlets.
- Cluster: support for session replication across nodes.
5. Describe the request flow.
A connector receives the request, then passes it through the Engine, Host and Context (the web application) to the right servlet. Filters and valves can process requests along the way.
6. Which default ports does Tomcat use?
- 8080: HTTP connector.
- 8443: HTTPS connector, when configured.
- 8005: shutdown port, listening on localhost.
- 8009: AJP connector, which is disabled by default in current versions.
Configuration and deployment
7. Which configuration files matter most?
| File | Purpose |
|---|---|
conf/server.xml | Connectors, engine, hosts and global settings |
conf/web.xml | Default settings for all web applications |
conf/context.xml | Default context settings, such as resources |
conf/tomcat-users.xml | Users and roles for built-in authentication |
bin/setenv.sh | JVM options, such as memory settings |
8. How do you deploy an application?
Copy a WAR file into the webapps directory, and Tomcat unpacks and deploys it automatically if auto-deploy is on. Alternatively, use the Manager application or a CI/CD pipeline.
9. How do you set JVM memory?
Create bin/setenv.sh with CATALINA_OPTS="-Xms1g -Xmx2g". Then restart Tomcat.
Performance and troubleshooting
10. How do you tune Tomcat?
Adjust connector thread pools (maxThreads, acceptCount), connection timeouts and JVM heap and garbage collection settings. In addition, put a reverse proxy, such as Nginx, in front for TLS and static files.
11. Where are the logs?
In the logs directory: catalina.out or catalina.<date>.log, localhost.<date>.log and access logs if enabled.
12. What causes “OutOfMemoryError: Java heap space”?
The application needs more heap than allowed, or it leaks memory. Increase -Xmx if the workload requires it, and analyse a heap dump to find leaks.
Security
13. How do you secure Tomcat?
- Keep Tomcat and Java updated.
- Remove default sample apps and restrict or remove the Manager app.
- Use strong passwords in
tomcat-users.xml, or integrate external authentication. - Run Tomcat as a non-root user.
- Keep the AJP connector disabled, or secure it with a secret. The 2020 “Ghostcat” vulnerability (CVE-2020-1938) abused exposed AJP ports.
- Hide version details in error pages.
- Terminate TLS with strong settings, either in Tomcat or a reverse proxy.
14. How do you run Tomcat behind Nginx?
Configure Nginx as a reverse proxy to port 8080, and set the RemoteIpValve in Tomcat so it sees the original client IP. See our Nginx interview questions.
Keep preparing
Practise each answer out loud, and run the commands in a lab rather than memorising them. Interviewers often ask follow-up questions, so make sure you understand why each answer is true.
Sources
Preparing for an interview? Browse more questions in our interview preparation hub. For businesses, we also offer security services such as VAPT, server hardening and ISO 27001 readiness.
