I dont undertand why option 2.) Response Attribute is right.
Neither do I, since there are no such things as "response attributes"! I think this was a mistake in the question (perhaps that option was meant to fool you, and yet they accidentically gave it as a correct answer).
The only thread-safe scopes are request and page (for JSPs). Session and context attributes are by default not guarded against concurrent access, so synchronisation on the session or context objects is recommended when there is the possibility for a simultaneous multiple modification or concurrent retrieval and modification.
Charles Lyons (SCJP 1.4, April 2003; SCJP 5, Dec 2006; SCWCD 1.4b, April 2004)
Author of OCEJWCD Study Companion for Oracle Exam 1Z0-899 (ISBN 0955160340 / Amazon Amazon UK )