Joe adds security features to his code by adding attributes; he does not have to write any other specific security code.
-
Declarative Security
-
Role-Based Security Permissions
-
Code Access Permissions
-
Identity Permissions
-
Imperative Security
Declarative security uses attributes to declare security requirements directly in code metadata, without writing imperative security checks. Options B through C are actual .NET security mechanisms but require imperative code logic - they don't rely solely on attributes. Declarative security is the ONLY approach where adding attributes alone provides security functionality.
The correct answer is 'Declarative Security'. In .NET, declarative security is applied by decorating classes, methods, or assemblies with security attributes (e.g., permission attributes) declared in metadata, without writing any additional in-line security logic — exactly the scenario described (Joe adds attributes and writes no other security code). This contrasts with imperative security, which requires explicit code that creates permission objects and calls Demand/Assert at runtime. 'Role-Based Security Permissions', 'Code Access Permissions', and 'Identity Permissions' are categories of permissions, not the attribute-based enforcement mechanism the question describes. The database marks 'Role-Based Security Permissions', which is incorrect; the attribute-driven, no-extra-code approach is the definition of Declarative Security (id 597353).