You develop an application using the Cloud Foundry environment. What are some steps to restrict access to this application? Note: There are 2 correct answers to this question.

Question

Options

• ASet the Scopes element to the required scope name in the xs-app.json file.
• BSet the role-name attribute of the Security-role element in the web.xml file to the required
• Crole template name.
• DDefine the role template name in the role-templates element of the xs-security.json file.
• ESet the Scopes element to the required scope name in the xs-security.json file.

• A
  3% (1)
• B
  84% (26)
• C
  3% (1)
• E
  10% (3)

Explanation

In Cloud Foundry's security model, access restriction requires two coordinated layers: defining role templates in the XSUAA descriptor and enforcing them at the application level. Option D is correct because the role-templates element in xs-security.json creates the named roles that administrators assign to users - without this, no roles exist to grant or deny access. Option B is correct because the web.xml <security-role> element (with its role-name mapped to that role template) enforces authorization at the Java web container level, blocking unauthorized requests.

Why the distractors fail:

• A is wrong because xs-app.json (the Application Router config) uses a scope property per route, not a top-level "Scopes element" - and it governs routing, not the core security definition.
• E is wrong because defining scopes in xs-security.json alone doesn't restrict access; scopes must be wrapped in role templates (D) before they can be assigned to users and enforced.

Memory tip: Think of it as a two-key lock - xs-security.json (role-templates) is the key mold (defines what roles exist), and web.xml (security-role) is the lock on the door (enforces who gets in). You need both keys to actually restrict access; defining scopes alone (xs-security.json scopes / E) is just raw material, not a usable key.

No community discussion yet for this question.