The security-constraint tag in web.xml defines access rules for web resources, specifying URL patterns, HTTP methods, and authorized roles. This is the primary mechanism for declarative security in servlet applications. Option C correctly identifies this tag.