You want to allow one set of roles to POST to a resource and another set of roles to GET it.
Which two configuration options should you use? (Choose two.)
You want to allow one set of roles to POST to a resource and another set of roles to GET it.
Which two configuration options should you use? (Choose two.)
To allow one set of roles to POST to a resource and another set of roles to GET it, you should use two separate @HttpMethodConstraints annotations with sets of roles, which would enable specifying different roles for different HTTP methods directly in the code. Additionally, another option is to use two <web-resource-collection> elements with different <http-method> elements in the deployment descriptor, allowing fine-grained role management based on HTTP methods in the configuration file.
Answer is : A,C
Answer A, C https://docs.oracle.com/cd/E19226-01/820-7627/bncbl/index.html @ServletSecurity(httpMethodConstraints = { @HttpMethodConstraint(value="GET", rolesAllowed={"user"}), @HttpMethodConstraint(value="POST", rolesAllowed={"admin"})})