Which two statements are true about the security-related tags in a valid Java EE deployment descriptor？（）
A、Every <security-constraint> tag must have at least one <http-method> tag.</http-method></security-constraint>
B、A <security-constraint> tag can have many <web-resource-collection> tags.</web-resource-collection></security-constraint>
C、A given  tag can apply to only one <web-resource-collection> tag.</web-resource-collection>
D、A given <web-resource-collection> tag can contain from zero to many <url-pattern> tags.</url-pattern></web-resource-collection>
E、It is possible to construct a valid <security-constraint> tag such that，for a given resource，no user rolescan access that resource.</security-constraint>
查看答案
