What should you do?

You are creating a Windows Communication Foundation (WCF) service that implements the following service contract.

[ServiceContract]
public interface IOrderProcessing
{
[OperationContract]
void ApproveOrder(int id);
}

You need to ensure that only users with the Manager role can call the ApproveOrder method. What should you do?

A.
In the method body, check the Rights PosessesProperty property to see if it contains Manager

B.
Add a PrincipalPermission attribute to the method and set the Roles property to Manager

C.
Add a SecurityPermission attribute to the method and set the SecurityAction to Demand

D.
In the method body, create a new instance of WindowsClaimSet.
Use the FindClaims method to locate a claimType named Role with a right named Manager

Explanation:
To demand user membership

Open the Windows Communication Foundation (WCF) code file that contains the implemented service contract code.
Apply the PrincipalPermissionAttribute attribute to each method that must be restricted to a specific group.
Set the Action property to Demand and the Role property to the name of the group.

For example:

// Only members of the CalculatorClients group can call this method.
[PrincipalPermission(SecurityAction.Demand, Role = “CalculatorClients”)]
public double Add(double a, double b)
{
return a + b;
}

How to: Restrict Access with the PrincipalPermissionAttribute Class
(http://msdn.microsoft.com/en-us/library/ms731200(v=vs.90).aspx)