Enthuware

regarding the second option it says that

Even is a session is invalidated (say it times out), the page can still access the session variable.

how is it true?

if session is invalidated then we wont be able to access the session variable . am i missing something?

Yes.
HttpSession sess = request.getSession();
sess.invalidate();
//sess variable is still accessbile here.

In the explanation of the last option :

The first request "create" a new session. The user joins the session in subsequent request....

But how about this : If there is no session, a session won't be created. So, the first request won't create a new session.

It is a wrong option. The explanation just gives one reason why it wrong. Your reason is also valid. The explanation further says, "However, it has nothing to do with what this question is asking.".