Oracle 1Z0-574 Online Practice Questions and Exam Preparation

Oracle 1Z0-574 Online Questions & Answers

• Question 131:

  A customer with an existing WebCenter portal wants to expand his client device list to include a variety of mobile devices beyond basic browser support. What Oracle products are available to enable this expansion?

  A. OWC, OHS, ADF Mobile, and Java ME
  B. OWCA, ADF Mobile, OPSS, and Java ME
  C. OWC, OHS, and ADF Mobile
  D. OWCIC, ADF Mobile, and Java ME
  A. OWC, OHS, ADF Mobile, and Java ME

  ---

  Oracle HTTP Server (OHS) - provides a HTTP listener for Oracle WebLogic Server and the framework for hosting static content, dynamic content, and applications over the Web.

  Java Platform, Micro Edition (Java ME)(not C):meets the needs of developers creating applications for the consumer and embedded markets. No other technology provides such robust applications across so many types of size-constrained wireless and wireline devices, from mobile phones and PDAs to set-top boxes and vehicle telematics.c

• Question 132:

  BPM and SOA are frequently combined to provide greater business value than either technology provides independently. Which statements are true with regard to combining the BPM Technology Perspective and SOA Technology Perspective?

  A. A Business Process may invoke a SOA Services to perform specific tasks within the process flow.
  B. A Business Process may be exposed as a SOA Service.
  C. When combining SOA and BPM, all the tasks within a Business Process are accomplished via Services.
  D. A Business Process may invoke an SOA Service, but an SOA Service cannot invoke a Business Process.
  E. Every business Process is exposed as a SOA Service.
  A. A Business Process may invoke a SOA Services to perform specific tasks within the process flow.
  B. A Business Process may be exposed as a SOA Service.
  D. A Business Process may invoke an SOA Service, but an SOA Service cannot invoke a Business Process.

  ---

  

  Note E: BPM processes and sub-processes can (but are not required) themselves be exposed as SOA Services. This enables processes to be composed of SOA Services that are implemented as processes. It can be beneficial in two ways. First, it improves reuse of lower level system-centric processes (i.e. service orchestrations), and second, it offers a standard interface mechanism with which to invoke all types of business processes.

  Note: BPM and SOA are often used together, as they both support a closer alignment between business and IT, and they both promote agility. BPM targets alignment and agility at the process level, while SOA applies more at the activity level. Hence, business processes and SOA Services can represent business constructs, providing a mapping between the things business does and the way IT helps get it done. The convergence of BPM and SOA generally happens via process decomposition. That is when business processes are modeled as, (i.e. decomposed into), activities. All automated activities must be backed by some form of executable code or function call. These functions, if they are deemed worthy, can be engineered as SOA Services following service-oriented design principles. Agility at the process level is attained by changing the process model. Agility at the service level is achieved by deploying services that are loosely coupled and independently managed.

• Question 133:

  Which statement best describes the role of the Data Movement Layer within the logical view of the Service- Oriented Integration (SOI) architecture?

  A. The Data Movement Layer provides access to persistent data storage for the architecture.
  B. All write operations on persistent data are performed via the Data Movement Layer.
  C. All read operations on persistent data are performed via the Data Movement Layer.
  D. All create, read, update, and delete operations on persistent data are performed via the Data Movement Layer.
  E. The Data Movement Layer provides batch and bulk data operations for the architecture.
  E. The Data Movement Layer provides batch and bulk data operations for the architecture.

  ---

  The Data Movement Layer provides the batch and bulk data handling for the architecture. This layer exists primarily to offload bulk data movement from the upper layers in the architecture. Bulk data movement is a necessary evil in many enterprises, and therefore, the architecture must provide a mechanism to provide this capability in an efficient, controlled manner. Without this layer, the other layers in the architecture might be misused to move large blocks of data, a task for which the other layers are ill suited.

• Question 134:

  Service-Oriented Integration creates a catalog of SOA Services that expose capabilities from existing back-end systems. What are the three types of capabilities that the SOA Services expose?

  A. existing business processes
  B. existing management and monitoring functionality
  C. existing business functionality
  D. existing data entities
  E. existing application programming interfaces (APIs)
  A. existing business processes
  C. existing business functionality
  D. existing data entities

  ---

  The SOA Service needs to expose process, functionality, and data that is usable in a broader context than the source of the capability was designed to meet. Therefore, creating a SOA Service usually entails some amount of aggregation, transformation, or expansion of existing capabilities provided by the source systems.

  Note on D: Each existing application contains its own data model and data formats. This proliferation of data models and data formats is exacerbated by the fact that a single enterprise entity (e.g. customer, product, order) frequently has data elements stored in multiple existing applications. To be successful at exposing existing data via SOA Services, the integration approach must manage this complexity.

• Question 135:

  When mapping Oracle Products onto the Logical view, what is the best approach?

  A. Utilize management packs, connectors, and plug-ins to create a customized product mapping for the Logical view.
  B. Use Oracle Enterprise Manager to provide core capabilities required by the three layers for Oracle stack, and use management packs, connectors, and plug ins for non-Oracle stack.
  C. Use an Oracle Enterprise Manager product to provide all the capabilities required by the three layers in the Management and Monitoring architecture.
  D. Use a third-party to provide all capabilities required by the three layersin the Management and Monitoring architecture.
  C. Use an Oracle Enterprise Manager product to provide all the capabilities required by the three layers in the Management and Monitoring architecture.

  ---

  Oracle offers a comprehensive SOA solution through a suite of SOA products. Oracle Fusion Middleware products cover the needs of the SOA infrastructure end-to-end. The figure below shows the mapping of Oracle products to the SOA logical components.

  Management of services is extremely important in SOA environments, where services are integrated, reused, and constantly changed. Oracle Enterprise Manager (OEM) simplifies monitoring and managing SOA environments. It addresses each of the challenges by helping model, monitor, and manage the SOA environment.

  The products referred in the figure are:

  *

  OSB - Oracle Service Bus

  *

  OSR - Oracle Service Registry

  *

  OER - Oracle Enterprise Repository

  *

  OWSM - Oracle Web Service Management

  *

  OEM - Oracle Enterprise Manager (with SOA management pack)

  *

  IdM - Identity and Access Management

  There isn't necessarily a one to one mapping between logical architecture components and products. While some products target a specific logical need, most provide additional features, such as monitoring, management, and security.

  

  Note:

  The SOA infrastructure capabilities can be grouped into the following logical components as shown in Figure below.

  *

  Service Bus

  *

  SOA Security Framework

  *

  Service Registry

  *

  Metadata Repository

  *

  Monitoring Framework3-2 ORA SOA Infrastructure

  *

  Management Framework

• Question 136:

  Which of the following is least effective at deterring man-in-the-middle attacks?

  A. encrypting network traffic
  B. issuing single-use access tokens
  C. mutual authentication
  D. biometric authentication
  E. using time stamps or transaction IDs to detect and discard replay attempts
  C. mutual authentication

  ---

  In order to avoid man-in-the-middle attacks a security framework must have capabilities such as:

  *

  Logging in users without the need to type passwords or PINs (not D)

  *

  Dynamically challenging the user for different information, e.g., asking a random question for which only the user will know the answer

  *

  Encrypting and signing transmissions from the client to the back end server (not A)

  *

  Detecting replays using embedded transaction ids or timestamps (not E)

  *

  Presenting proof to the user that the site they are visiting is authentic

  Propagating a single proof object, or assertion, can be susceptible to man-in-the-middle attacks and replay attacks. If a rogue entity observes an assertion, it could reuse that assertion for illegitimate requests. Possible solutions include:

  *

  (notB) Invalidate the assertion after every request. In the case of chained SOA Services, service providers must verify each assertion they receives with the authority. The authority can invalidate assertions in its internal cache. Any future verifications with the same assertion would fail. SOA Service providers would need to obtain a new assertion in order to make subsequent service requests. This solves both types of problems mentioned above.

  *

  (notE) Reduce and enforce the assertion's time to live attribute. This would narrow the window of opportunity to reuse an assertion. The assertion would have to be captured and reused in a short period of time (programmatically vs. manually). While this limits the potential for man-in-the-middle attacks, it's not as effective for replay attacks

  *

  Require the signature of a trusted service consumer (client application) in addition to the signed assertion. The caller's signature should cover the assertion to bind it to the message. If all service consumers are required to sign their request messages, then service providers can be shielded from rogue clients, thereby preventing man-in-the-middle attacks.

  This solution would need to be enhanced to solve replay attacks. One option is to include a unique request id, timestamp, or sequence number in the request. The target resource could maintain a cache of ids and refuse duplicate requests. A common request id service could be created to issue unique request ids and validate all requests that are received within the security domain

• Question 137:

  Which of the following is not a key function of an identity management system?

  A. user provisioning
  B. password maintenance and self-service
  C. approval workflow
  D. LDAP integration
  E. authentication
  B. password maintenance and self-service
  E. authentication

• Question 138:

  Which of the following are asset packaging best practices?

  A. Every reusable asset must contain at least one manifest file that self-describes the contents of the package.
  B. Any components that can be precompiled must be precompiled in the package.
  C. Non-runtime artifacts such as build and test artifacts must be included in the package.
  D. Packaging of components must be modular and all common components must be packaged as independent libraries that can beincluded in multiple packages.
  A. Every reusable asset must contain at least one manifest file that self-describes the contents of the package.
  B. Any components that can be precompiled must be precompiled in the package.
  D. Packaging of components must be modular and all common components must be packaged as independent libraries that can beincluded in multiple packages.

  ---

  Assets must be packaged using standards-based approaches with the goal of improving flexibility, reuse, and runtime performance.

  Applying packaging standards and best practices is a critical step in ensuring that the assets are deployed for the best quality and performance. It also accelerates the time-to-deployment.

  Implications:

  *

  Every reusable asset must contain at least one manifest file that self-describes the contents of the package.

  *

  Any components that can be precompiled must be precompiled in the package.

  *

  Non-runtime artifacts must not be included in the deployment package. (e.g. build and test artifacts) (not C)

  *

  Packaging of components must be modular and all common components must be packaged as independent libraries that can be included in multiple packages.

  Note: Further implications

  *

  Libraries provided by the platform should not be included in the package. (e.g. Application Server system libraries)

  *

  Libraries and components in a package must not be

  duplicated. The classloader hierarchy must be used to

  design the packages to avoid duplication.

  *

  Common libraries must be placed outside the package to be loaded by a higher level classloader (e.g.

  System

  classloader).

  *

  Packages must follow predefined industry or company

  standard naming conventions and structures.

  *

  Static content must not be included in the deployable package. They must be served separately in exploded

  format.

• Question 139:

  Which of the following are types of policy considerations designed to affect the way privileges are assigned to users?

  A. Principle of Alternating Privilege
  B. Separation of Duties
  C. DefenseinDepth
  D. Vacation, Job Rotation, and Transfer E. Principle of Least Privilege
  B. Separation of Duties
  D. Vacation, Job Rotation, and Transfer E. Principle of Least Privilege

  ---

  B: Separation of duties is a classic security principle that restricts the amount of power held by any one individual in order to prevent conflict of interest, the appearance of conflict of interest, fraud, and errors. Separation of duties is one of the fundamental principles of many regulatory mandates such as Sarbanes- Oxley (SOX) and the Gramm-Leach-Bliley Act (GLBA), and as a result IT organizations are placing greater emphasis on separation of duties across all IT functions, especially database administration.

  D: Vacation, Job Rotation, and Transfer are policy considerations.. Once way to detect and deter misuse of systems is to have a new person perform the duties of an existing worker. The new person might notice irregularities or questionable circumstances and be able to report it. The new worker might be there temporarily, i.e. filling in for someone on vacation, or might be a replacement as a result of periodic job rotations and transfers. In addition, workers that expect periodic rotations are less likely to misuse systems as they know others following behind them will eventually discover it and report them. E:Each user should have only those privileges appropriate to the tasks she needs to do, an idea termed the principle of least privilege. Least privilege mitigates risk by limiting privileges, so that it remains easy to do what is needed while concurrently reducing the ability to do inappropriate things, either inadvertently or maliciously. Note: The principle of least privilege. Users are given the least amount of privileges necessary in order to carry out their job functions. This applies to interactions between systems as well as user interactions. This reduces the opportunity for unauthorized access to sensitive information.

• Question 140:

  Which of the following options best describes the concept of data-driven testing?

  A. Data-driven testing is a strategy used to perform load testing.
  B. Data-driven testing is used to perform functional tests by iterating through data sets in a databank.
  C. Data-driven testing uses a single predefined data set to perform repeated testing.
  D. Data-driven testing uses database triggers to initiate and run test cases.
  B. Data-driven testing is used to perform functional tests by iterating through data sets in a databank.

  ---

  One of the best ways to perform functional testing is through data-driven testing, in which a databank is created to cover the various functional use cases and is used to drive the testing. This requires the ability to iterate through a list of data sets in the databank, substitute them for the input values, and run the tests.