Enthuware

I think option 1 is the correct one because getCallerPrincipal and isCallerInRole methods are accessible by any session bean, not just stateful bean.

I think option 3 is not the correct option.

1 is not correct because programmatic control is not required. You can use declarative also.
3 is a correct statement because it doesn't say "only" stateful session bean.