You want to allow one set of roles to POST to a resource and another set of roles to GET it. Which two configuration options should you use? (Choose two.)

Question

Options

• Atwo separate @HttpMethodConstraints annotations and sets of roles
• Ba single @HttpMethodContstraint annotation and a map of method to roles
• Ctwo <web-resource-collection> with different <http-method> in the deployment descriptor
• Da single <web-resource-collection> with two <auth-constraint> with different <http-method> in

Explanation

Options A and C are correct.

A is correct because @ServletSecurity accepts an array of @HttpMethodConstraint annotations via its httpMethodConstraints attribute, letting you specify a distinct set of rolesAllowed per HTTP method - one for GET, another for POST, on the same resource. C is correct because in web.xml the standard pattern is to define two separate <security-constraint> blocks, each with its own <web-resource-collection> scoped to one <http-method> and its own <auth-constraint> listing the permitted roles for that method.

B is wrong because @HttpMethodConstraint has no "map of method to roles" concept - each annotation covers exactly one method, so a single annotation cannot express two different method/role pairings. D is wrong because <auth-constraint> is a child of <security-constraint>, not of <web-resource-collection>, and you cannot place <http-method> inside <auth-constraint>; the schema simply doesn't allow this structure.

Memory tip: Think in pairs - one constraint per method, whether you're writing annotations (@HttpMethodConstraint × 2) or XML (<security-constraint> × 2). Whenever you need different roles for different verbs, you need two separate constraint blocks, not one block trying to do double duty.

No community discussion yet for this question.