[Ans: B, C, D]

A stateful session bean's creation is a direct result of a client invoking the create() method on the home. As a result, a stateful session bean can retrieve the security information about the client in the ejbCreate() method.

However, before the ejbCreate() is invoked, the client's security information cannot be retrieved. Hence, it is not possible to call getCallerPrincipal() in the setSessionContext() and session bean's constructor.