About Question enthuware.oce-ejbd.v6.2.491 :

[himaiMinh]

I think option 1 is the correct one because getCallerPrincipal and isCallerInRole methods are accessible by any session bean, not just stateful bean.

I think option 3 is not the correct option.

[admin]

1 is not correct because programmatic control is not required. You can use declarative also.
3 is a correct statement because it doesn't say "only" stateful session bean.