Enthuware test question

[Amit Hetawal]

Hello All,
Can someone help me with the answer for this question.

Consider the web.xml snippet. 
In which of the following cases will the user be prompted for username/password? 

<web-app>
	...
	<security-constraint>
		<web-resource-collection>
			<web-resource-name>test</web-resource-name>
			<url-pattern>/servlet/*</url-pattern>
		</web-resource-collection>
		<auth-constraint>
			<role-name>manager</role-name>
		</auth-constraint>
	</security-constraint>
	...
</web-app>

Select 1 correct option. 
a  When the user clicks on a hyperlink displayed by <a >Test</a>   
        
b  When the user clicks on the submit button of a form starting with: <form action="/servlet/TestServlet" method="POST">   
        
c  For both a and b.   
        
d  For neither of a or b. 

Ans: C

According to me, shouldn't the answer be Option D, since there is not <http-method> defined, all the methods will be inaccessible,
so the user should not be prompted for any of the Http methods ?

Please advise.

Thanks,

[Christophe Verré]

If no HTTP methods are specified, then the security constraint applies to all HTTP methods. So if a url matches a security-constraint, then the user will have to login.

[Amit Hetawal]

Thank you, it took me a while to clear my understanding on this ..