I found security and Legacy system connectivity very tough in exam. They are no match with that in the mock tests. BTW, I don't have any real time experience as an architect, I studied everything for the exam. lack of experience reflected in the exam
Michael, security always seemed okay to me while doing practice tests, however I failed miserably in the real test. In my view, Security and Legacy System connectivity are the toughest ones in the test.
Head First EJB's Head First Design Patterns Martin Folwer - UML and all the tutorials/ white papers and notes prepared by 'John Wetherbie' and others. ( all from SCEA online resources at JavaRanch). also some notes by Balaji and sample questions from SCEA_prep yahoo groups helped me.