which two, inserted independently at line 109, will allow users with role names of either SALES or MARKETING to access this resource?

Given the two security constraints in a deployment descriptor:

If the two security constraints have the same url-pattern and http-method, which two, inserted
independently at line 109, will allow users with role names of either SALES or
MARKETING to access this resource? (Choose two.)

A.
<auth-constraint/>

B.
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>

C.
<auth-constraint>
<role-name>ANY</role-name>
</auth-constraint>

D.
<auth-constraint>
<role-name>MARKETING</role-name>
</auth-constraint>

Explanation: