The <security-role-ref> element is used to specify the declaration of a security role reference in the web application’s code. The declaration of the element consists of the following elements:

1. <description>:It is an optional element that specifies the information about the reference.
2. <role-name>:It is used to specify the security role name used in the code.
3. <role-link>: It specifies the value of the name of the security role that the user may be mapped into. This element is used to link a security role reference to a defined security role. This element must contain the name of one of the security roles defined in the security-role elements.

<security-constraint>
 <web-resource-collection>
    <web-resource-name>AccountServlet</web-resource-name>
    <description>This is an Account Servlet.</description>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>PUT</http-method>
    <http-method>DELETE</http-method>
    <url-pattern>acme/AccountServlet</url-pattern>
 </web-resource-collection>
</security-constraint>

It is not possible to define more than two http method in the web-resource-collection element.
B: The delete http method is not allowed in the http-method element declaration.
C: It is necessary that the web-resource-name must be specified in the web-resource-collection element.
D: It is necessary that the web-resource-name must be specified in the url of the url-pattern element.
E: If no http-method is specified in the web-resource-collection element, the security restriction will be applied to all http methods.
F: There should be at-least one url-pattern element otherwise, the will be ignored.

The valid parameters and return types for the Web service methods are as follows:

1. All primitive types
2. All wrapper types
3. java.lang.BigDecimal and java.lang.BigInteger
4. java.lang.Calendar
5. java.lang.Date

The doTrace() method allows a servlet to handle a TRACE request. It is called by the server via the service method. If the headers sent with the TRACE request, a TRACE is always returned to the client, so that they can be used in debugging. There’s no need to override this method. The following is the general format of the doTrace() method:

protected void doTrace(HttpServletRequest rq1, HttpServletResponse rsp1) throws ServletException, java.io.IOException