What else must the developer do to ensure that the intended security goal is achieved（）？  

• A、 Create a user called vip in the security realm
• B、 Define a group within the security realm and call it vip
• C、 Define a security-role named vip in the development descriptor
• D、 Declare a security-role-ref for vip in the deployment descriptor