Which two use cases can be addressed by the method level security annotation @PreAuthorize? (Choose two.)

Question

Options

• AAllow access to a method based on user identity.
• BAllow access to a method based on the returned object.
• CAllow access to a method based on HTTP method.
• DAllow access to a method based on request URL.
• EAllow access to a method based on roles.

• A
  73% (30)
• B
  7% (3)
• C
  2% (1)
• D
  17% (7)

Explanation

@PreAuthorize is a Spring Security method-level annotation that evaluates a SpEL (Spring Expression Language) expression before a method executes, making it ideal for checking who is calling (identity) and what roles they hold - which is why A and E are correct. For example, @PreAuthorize("hasRole('ADMIN') or #username == authentication.name") enforces both role-based (E) and identity-based (A) rules in a single expression.

Why the distractors are wrong:

• B describes @PostAuthorize, which evaluates after the method returns and can inspect the return value via returnObject.
• C and D describe HTTP-layer security (method type and URL patterns), which belongs in HttpSecurity configuration (e.g., requestMatchers(...).hasRole(...)), not on individual methods.

Memory tip: Think of @PreAuthorize as the "who are you, and what can you do?" guard - it checks the caller (identity + roles) before letting them in. Anything about what came back (B) or how the request arrived (C, D) is handled elsewhere.

No community discussion yet for this question.