Enthuware

For option 3's explanation: <security-identity> is specified by application assembler.
Can the bean provider specify <security-identity> ?
The bean provider can use @RunAs("...") to specify the security identity in the code. @RunAs is the same as <security-identity> 's <run-as> element.

So, I believe the bean provider can use either @RunAs or the <run-as> to specify the identity.

Yes, the bean provider can use @RunAs but the option specifically asks about the <security-identity> element.

HTH,
Paul.

Hi Paul. Thanks for your clarification.
So, bean provider can also use <security-identity> to define security identity with a deployment descriptor.

In the exam, we need to know the security roles of bean provider, deployer and application assembler.
Based on JSR 318, the bean provider can do the same tasks as the application assembler.

You are talking about bean provider but the question is asking about Deployer.