Originally posted by V Gala: But in errata page they have made changes like option a (page 662)
Errata in page 662 doesn't mention about the answer options. It's about the question. It mentions the code was given in a wrong way. The auth-constraint elements which had 'Bob' and 'Alice' didn't have the <role-name> tag inside the <auth-constraint> which was corrected in the errata. In the question it's mentioned that each of these <auth-constraint> tags belong to three valid <security-constraint> elements in a deployment descriptor.