Which statements are true about the auth-constraint element?
-
1) It only contains the element role-name (besides element description)
-
2) Only the role-name specified in security-role-ref can be used
-
3) It is a subelement of web-resource-collection
-
4) It is related to authentication
The auth-constraint element in web.xml specifies which roles are authorized to access protected resources. It contains role-name elements (plus optional description). Option A is correct. Option B is wrong because auth-constraint uses actual role names, not just those in security-role-ref. Option C is incorrect because auth-constraint is a subelement of security-constraint, not web-resource-collection. Option D is misleading - it's about authorization (who can access), not authentication (verifying identity).
Per the servlet web.xml schema, the auth-constraint element's only meaningful child is one or more role-name elements (plus an optional description) — it simply lists which security roles are permitted to access the constrained resources. It is a sibling of web-resource-collection inside security-constraint, not a subelement of it, and it governs authorization (who's allowed in), not authentication (proving who you are).