JBridge: Certification Question Of The Day

Identify which of the following statements about web application security are true (2 correct answers)

The Answer

The correct statements are B and D.
A servlet can't be secured by name; only url patterns can be secured in the web deployment descriptor (so answer A is false).
Individual users cannot be excluded from web resources through the web deployment descriptor alone. Individual users can be associated with roles outside of the web deployment descriptor, through server-specific configuration (Tomcat has a configuration file called tomcat-users.xml for this purpose). The roles can then be protected within the web deployment descriptor. That is why answer C is false.
Finally, the parent tag for <form-login-page> is <form-login-config> (and the parent for <form-login-config> is <login-config>).