When the CacheRolesInCookie property is set to true in the Web.config file, role information for each user is stored in a cookie. When role management checks to see whether a user is in a particular role, the roles cookie is checked before the role provider is called to check the list of roles at the data source. The cookie is dynamically updated to cache the most recently validated role names.

a) As far as I understand the above text, even though role management checks the roles cookie, role provider still checks the list of roles at the data source?

b) Above text talks about role management, which is invoked before role provider is called. What class acts as a role management?

thanx