Oracle 1Z0-574 Online Practice Questions and Exam Preparation

Oracle 1Z0-574 Online Questions & Answers

• Question 121:

  The Oracle Reference Architecture provides a specific definition of SOA Service. Which statement best describes the relationship between SOA Service and Web Service?

  A. A Web Service is one possible type of SOA Service.
  B. A SOA Service is a Web Service with a defined Service Contract.
  C. A SOA Service may be implemented using a Web Service Interface.
  D. All SOA Services are Web Services, but not all Web Services are SOA Services.
  E. All Web Services are SOA Services, but not all SOA Services are Web Services.
  C. A SOA Service may be implemented using a Web Service Interface.

  ---

  In service-oriented integration the consumer is decoupled from the source system via the SOA Service that encapsulates and abstracts the source systems behind a service interface. Consumers of the SOA Service should need no details about the underlying source system. They should base the service usage solely on the contract provided by the SOA Service. Unfortunately, simply adding a wrapper (e.g. Web service) to an existing system does not eliminate point- to-point integration. In fact point-to-point integration can be accomplished quite nicely using Web service interfaces. To be truly service-oriented, the SOA Services created must be well designed and constructed so the source system details do not bleed through. Service infrastructure that provides capabilities such as service discovery and routing is also essential to decouple service providers and consumers.

• Question 122:

  DES, 3DES and AES are types of:

  A. message digest algorithms
  B. symmetric key algorithms
  C. asymmetric key algorithms
  D. SSL identity tokens
  B. symmetric key algorithms

  ---

  Symmetrickey cryptography uses the same key to encrypt and decrypt data. Therefore the sender and receiver must each have a copy of the key. It is important that no other entity gains access to the key otherwise they would be able to decrypt the data as well. Common key algorithms include the Data Encryption Standard (DES), Triple DES (3DES), and Advanced Encryption Standard (AES).

• Question 123:

  Which of the following are common uses of an Attribute Service?

  A. to maintain metadata pertaining to audit log entries and attestation reports
  B. to acquire data that are necessary to make access-control decisions
  C. to securely supply personally identifiable information to applications
  D. to determine which security policy is assigned to a Web Service
  B. to acquire data that are necessary to make access-control decisions
  C. to securely supply personally identifiable information to applications

  ---

  The Attribute Service(AS) retrieves user information from an attribute store. The AS retrieves user information associated with a user from variety of authoritative identity stores including, but not limited to, LDAP and database stores.

• Question 124:

  What additional functions might an authentication service perform aside from performing basic authentication?

  A. directory management
  B. strong authentication
  C. risk profiling based on conditional factors such as time of day, device, or location
  D. initiating challengequestions based on conditional factors such as time of day, device
  E. forwarding users to password update and reset services
  E. forwarding users to password update and reset services

  ---

  The authentication service can detect when the user's password needs to be reset or changed and redirect the user to a self-service management interface.

• Question 125:

  Which of the following statements are true concerning, data formats used In Service-Oriented Integration (SOI)?

  A. SOA Services used in SOI should use application-specific data formats to ensure accurate transmission of data entities from the source systems.
  B. A single, canonical data model must be created to successfully build an enterprise-wide SOI.
  C. Data formats should be based on logical representations of business-level entities to facilitate composite application assembly.
  D. Application-specific data formats should be translated to and from normalized data formats.
  E. Data formats should use third normal form because this is the most efficient format for transmitting data.
  F. Binary data formats should not be used because they are costly and difficult to maintain.
  G. XML data formats should not be used because they are too verbose and result in poor performance.
  C. Data formats should be based on logical representations of business-level entities to facilitate composite application assembly.
  D. Application-specific data formats should be translated to and from normalized data formats.
  F. Binary data formats should not be used because they are costly and difficult to maintain.

  ---

  C:Logical Data Representations Message and data formats should be based on logical representations of business objects rather than native application data structures.

  D: Providing consumer representations and reading from and writing to multiple source systems leads to the issue of data format transformations. For a very small number of source systems, point-to-point transformations can be used by the SOA Services. However, this approach becomes untenable as the number of source systems increases. Thus, a better approach is to create a normalized format for the data entities and then provide transformations to and from the normalized format for each source system.

  Normalized Data Formats

  Data transformations are to and from normalized formats. Normalized data formats facilitate composition and reduce the number of transformations that must be created and maintained.

  F: Binary data formats would be awkward.

• Question 126:

  Service Oriented Integration (SOI) exposes capabilities from existing source systems. Which statement best describes the Impact SOI has on existing source systems?

  A. Because SOI exposes only existing capabilities, any new required functionality will be implemented by modifying the existing source systems.
  B. No modifications to existing source systems are allowed because SOA Services expose all the necessary capabilities from the source systems.
  C. Modifications to existing source systems should be avoided, but may be necessary to support SOA Service creation.
  D. To support SOA Service connectivity, modifications will be required for the existing source systems incorporated into the SOI architecture.
  C. Modifications to existing source systems should be avoided, but may be necessary to support SOA Service creation.

  ---

  Some minor modifications may be required to support connectivity, but requiring extensive modifications defeats a major reason for integration.

  It must be noted that creating a SOA Service from existing assets generally requires a good deal more than just adding a standards-based interface, i.e. simply service enabling existing assets is insufficient. The SOA Service needs to expose process, functionality, and data that is usable in a broader context than the source of the capability was designed to meet. Therefore, creating a SOA Service usually entails some amount of aggregation, transformation, or expansion of existing capabilities provided by the source systems. This requires a SOA Services layer between the existing assets and the consumers as illustrated in the figure.

  

  Note: The primary goal of service-oriented integration is to better leverage existing systems within the IT environment by applying service-oriented principles. Ultimately, the goal is to enable the assembly of composite applications, with little or no custom coding, that include capabilities sourced from existing systems. Composite applications are applications that pull together data, functionality, and process from multiple existing sources to solve a business problem or create new business value. Service-oriented integration is the mechanism to expose existing sources of data, functionality, and process so that those sources can be readily consumed by a composite application. Service construction includes creating entirely new SOA Services and also exposing existing assets as SOA Services.

• Question 127:

  Audit logging is a form of what type of access control mechanism?

  A. detective control
  B. preventive control
  C. deterrent control
  D. corrective control
  E. compensating control
  F. recovery control
  A. detective control

  ---

  There are many different forms of access control, which in turn can be classified into one or more categories.

  Detective - Detective controls are meant to record all activities. They are passive systems that are aware of events but are not designed to prevent them from happening. Audit logging is a form of detective access control.

• Question 128:

  The three common goals of Information security are known as the CIA triad. CIA stands for:

  A. Confidentiality, Integrity and Auditing
  B. Confidentiality, Integrity and Availability
  C. Confidentiality, Integrity and Access Control
  D. Confidentiality, Integrity and Authentication
  E. Confidentiality,Integrity and Authorization
  B. Confidentiality, Integrity and Availability

  ---

  For over twenty years, information security has held confidentiality, integrity and availability (known as the CIA triad) to be the core principles of information security. There is continuous debate about extending this classic trio.

  Note:

  Confidentiality is the term used to prevent the disclosure of information to unauthorized individuals or systems.

  In information security, integrity means that data cannot be modified undetectably. For any information system to serve its purpose, the information must be available when it is needed.

• Question 129:

  Which of the following are examples of dynamic modeling?

  A. Behavior Modeling
  B. Interaction Modeling
  C. Static Modeling
  D. Data Modeling
  A. Behavior Modeling
  B. Interaction Modeling

  ---

  Static modeling focuses on capturing the instance attributes and snapshots of nodes and objects. Dynamic modeling generally refers to one or both of the following

  *

  Behavior modeling that focuses on the internal state changes

  *

  Interaction modeling that focuses on external collaborations.

  Note: Modeling is a prime and foremost activity of the engineering process. Modeling bridges the gap between business and technology worlds through the language common to both sides.

• Question 130:

  Which of the following statements pertaining to role-based and group-based user classifications are true?

  A. A role is a subset of a group where all users share a commonidentity.
  B. Users can belong to one and only one role.
  C. A role can have any number of users.
  D. A group is a collection of users that perform the same function. A role is a collection of groups.
  E. Access privileges can be assigned to roles or groups.
  C. A role can have any number of users.
  E. Access privileges can be assigned to roles or groups.

  ---

  A group is a set of users, classified by common trait. A role is an abstract name for the permission to access a particular set of resources in an application. Multiple users can be mapped to a role.

  Users can be mapped to multiple roles.

  Incorrect answers A, B: Just wrong.

  D: A group is a collection of users, but a role does not need to be a collection of groups.

  Note: Given the potentially large number of users of a system, access privileges are generally not assigned at the user level. Instead, users are assigned to groups (mimicking the organizational structure of a company), or roles (defined based on job functions that users perform), or some combination of the two. Access privileges are then assigned to groups and/or roles. The most natural case is that they are assigned to roles, since roles align more closely with operations users naturally perform to accomplish their job. The industry term for this is Role-Based Access Control (RBAC). RBAC is more flexible than defining access rights based on usernames or static groups and enables an organization to be more versatile when allocating resources. With RBAC the system must determine if the subject (user or client) is associated with a role that has been granted access to a resource. This process of user to role ascertainment is called role mapping.