Answer E is questionable, but you can define one <method-permission> element allowing all methods by "admin" like this:
however the phrasing of the sentence is odd. The problem statement says the majority of methods will be used by the role "admin". In other words: there will be methods that won't be used by the role "admin", but by other roles. This is then not implementable byusing one <method-permission> element (because of the union).