Explanation/Reference:
Not A, not C:
A security role reference defines a mapping between the name of a role that is called from a web component using isUserInRole(String role)and the name of a security role that has been defined for the application. If no security-role-ref element is declared in a deployment descriptor and the isUserInRolemethod is called, the container defaults to checking the provided role name against the list of all security roles defined for the web application. Using the default method instead of using the security-role-ref element limits your flexibility to change role names in an application without also recompiling the servlet making the call.
For example, to map the security role reference cust to the security role with role name bankCustomer, the syntax would be:
<servlet>
...
<security-role-ref>
<role-name>cust</role-name>
<role-link>bankCustomer</role-link>
</security-role-ref>
...
</servlet>
Note:
* A realm is a security policy domain defined for a web or application server. A realm contains a collection of users, who may or may not be assigned to a group.
* The protected resources on a server can be partitioned into a set of protection spaces, each with its own authentication scheme and/or authorization database containing a collection of users and groups. A realm is a complete database of users and groups identified as valid users of one or more applications and controlled by the same authentication policy.
* In some applications, authorized users are assigned to roles. In this situation, the role assigned to the user in the application must be mapped to a principal or group defined on the application server.
* A role is an abstract name for the permission to access a particular set of resources in an application. A role can be compared to a key that can open a lock. Many people might have a copy of the key. The lock doesn't care who you are, only that you have the right key.
Reference: The Java EE 6 Tutorial, Declaring and Linking Role References