Oracle 1Z0-574 Online Practice Questions and Exam Preparation

Oracle 1Z0-574 Online Questions & Answers

• Question 51:

  What shortcomings of the Version Control Systems drive the need for a Metadata Repository?

  A. Version Control Systems are not easily searchable.
  B. Version Control Systems lack robust metadata that allows developers to determine relevance.
  C. Version Control Systems don't provide the level of consumer tracking and reporting necessary to support software reuse.
  D. Version Control Systems do not allow the asset versions to be rolled back to a previousstate
  B. Version Control Systems lack robust metadata that allows developers to determine relevance.

  ---

  The underlying core principle of ORA Engineering is asset sharing and enterprise development through an integrated asset management approach. Most organizations use a Software Configuration Management (SCM) or Version Control System (VCS) for managing the code and configuration assets. These tools are great for managing the versioning of assets produced but they don't maintain the metadata of the assets. Without metadata assets are not organized in context and it is hard to discover them. ORA recommends an asset-centric engineering process, where an Asset Manager is used to address the challenges posed by the traditional approaches. The Asset Manager is typically an enterprise-scoped Metadata Repository working in concert with SCMs and other types of asset repositories.

• Question 52:

  Which of the following is not a valid type of SAML assertion?

  A. authentication assertion
  B. authorization decision assertion
  C. audit assertion
  D. attribute assertion
  C. audit assertion

  ---

  SAML defines the syntax and semantics for creating XML-encoded assertions to describe authentication, attribute, and authorization (entitlement) information, and for the protocol messages to carry this information between systems. A brief description of the three SAML assertions is provided below.

  *

  Authentication Assertion (not A) - Generated by the authority when a subject successfully authenticates. It includes identity of the issuer and the principal, time of authentication, and how long it is valid. Many authentication methods are supported, including: passwords, Kerberos, hardware tokens, certificate-based client authentication (SSL/TLS), X.509 public key, PGP, XML digital signature, etc.

  *

  Authorization Decision Assertion (not B) - Issued by a policy decision point (PDP) containing the result of an access control decision. Authentication and attribute assertions may be provided in order to make authorization decisions. The resulting authorization assertion is used to claim access to protected resources. It includes the decision (Permit or Deny), along with the resource URI being accessed, and the action that the principal is authorized to perform.

  *

  Attribute Assertion (not D)- Generally issued by the authority in response to a request containing an authentication assertion. It contains a collection of attribute name/value pairs, in addition to identity and other elements. Attribute assertions can be passed to the authority when authorization decisions need to be made.

• Question 53:

  What are the key differentiating characteristics of Oracle Reference Architecture User Interaction?

  A. ORA UI is application-focused, enabling effective Integration of content and application functionality
  B. ORA UI is user centric, providing a feature-rich, intuitive human Interface.
  C. ORA UI provides a single unified interface regardless of the complexity of underlying applications.
  D. ORA UI standardizes on a single technology, simplifying development.
  E. ORA UI replaces portal platforms for collaboration.
  B. ORA UI is user centric, providing a feature-rich, intuitive human Interface.

  ---

  The primary goal of user interaction is to provide a user-centric, feature-rich, intuitive interface to end users tailored to the specific needs of each end user; thereby bringing maximum productivity to the work environment. Realizing this goal requires a flexible, extensible architecture since different types of end users will have very different needs.

• Question 54:

  Which of the following statements are true about defense-in-depth strategy?

  A. It saves money by allowing organizations to remove costly perimeter security Infrastructure.
  B. It is a strategy designed to win the battle by attrition. It consists of multiple security measures at various levels as opposed to a single barrier.
  C. It includes security measures for the network, the operating system, the application, and data.
  D. Due to network overhead issues, it should not be used in a distributed computing environment such as SOA or cloud computing.
  E. It is a good strategy to protect an organization from insider threats.
  B. It is a strategy designed to win the battle by attrition. It consists of multiple security measures at various levels as opposed to a single barrier.
  C. It includes security measures for the network, the operating system, the application, and data.
  E. It is a good strategy to protect an organization from insider threats.

  ---

  Defense in depth is a security strategy in which multiple, independent, and mutually reinforcing security controls are leveraged to secure an IT environment.

  The basic premise is that a combination of mechanisms, procedures and policies at different layers within a system are harder to bypass than a single or small number security mechanisms. An attacker may penetrate the outer layers but will be stopped before reaching the target, which is usually the data or content stored in the 'innermost' layers of the environment. Defense in depth is also adopted from military defense strategy, where the enemy is defeated by attrition as it battles its way against several layers of defense.

  Defense in depth should be applied so that a combination of firewalls, intrusion detection and prevention, user management, authentication, authorization, and encryption mechanisms are employed across tiers and network zones.

  The strategy also includes protection of data persisted in the form of backups and transportable/mobile devices. Defense in depth should take into account OS and VM hardening as well as configuration control as means of preventing attackers from thwarting the system by entering via the OS or by tampering with application files.

• Question 55:

  What is meant by cache hit rate or ratio?

  A. the percentage of times the cache was hit successfully over the total number of tries
  B. the percentage of times the cache was refreshed from the back-end database
  C. the number of servers the cache is replicated to
  D. the ratio of cache objects in a server to the total number of cache objectsin the server cluster
  A. the percentage of times the cache was hit successfully over the total number of tries

  ---

  Cache hit rate or ratio: The percentage of times the cache was hit successfully over the total number of tries is called the hit ratio.

• Question 56:

  Which of the following combinations represent a true multi-factor authentication mechanism?

  A. password and PIN
  B. password and token
  C. PIN and token
  D. token and fingerprint
  E. fingerprint and retina scan
  F. password and retina scan
  B. password and token
  C. PIN and token
  D. token and fingerprint
  F. password and retina scan

  ---

  Multi-factor authentication is the requirement of more than one form of proof of identity, from more than one type (factor) of proof. The three main types of factors are:

  *

  Human Factors (something you are), which includes biometrics such as retina scans, fingerprints, etc.

  *

  Personal Factors (something you know), such as passwords, PINs, etc.

  *

  Technical Factors (something you have), for instance smart card, token, etc.

  A multi-factor authentication scheme must include at least one form of proof from at least two of the above factor types. For instance, it could include the use of a smart card and PIN, but not a password and PIN.

  Note: Multi-factor authentication greatly reduces the risk of establishing fraudulent identity over a scheme that uses only one factor. It takes away the ability to fraudulently authenticate by obtaining any single piece of technology or password secret. One way to achieve multi-factor authentication without requiring additional proofs from the user is to track which devices the user logs in from. The device can suffice as something the user has, for instance a laptop computer. If the user logs in from a different device, or the device is used for a different user, then additional authentication challenges may be warranted.

• Question 57:

  Interface elements are an important part of modular programming for UI. Which of the following statements is true with regard to Interface elements?

  A. Interface elements are always provided as proprietary packages of widgets from device vendors and third parties.
  B. There is a wide variety of interface elements that can be developed once and used repeatedly in various user-interface designs.
  C. Interface elements are highly standardized and, once developed for one device, they are sufficiently portable to be reused on other devices without modification.
  D. Interface elements implement application-specific functionality and are therefore rarely reusable across multiple applications.
  B. There is a wide variety of interface elements that can be developed once and used repeatedly in various user-interface designs.
  C. Interface elements are highly standardized and, once developed for one device, they are sufficiently portable to be reused on other devices without modification.

  ---

  Interface element that a computer user interacts with, and is also known as a control or Widget. Examples:

  Windows, Pointer, Text Box, Button, Hyperlink, Drop-down list, List box, Combo box, Check Box, Radio button, Cycle button, Datagrid

• Question 58:

  Which of the following are benefits of three-tier distributed computing?

  A. It allows separation and independent scaling of the data tier and middle/business tier
  B. Management of security, transaction, and connection are handled in the middle tier.
  C. It allows the client to query the database directly.
  D. It improves the performance of the application tenfold.
  A. It allows separation and independent scaling of the data tier and middle/business tier
  B. Management of security, transaction, and connection are handled in the middle tier.

  ---

  Three-tier architecture allows the data tier and middle tier to scale independently (A). It also allows multiple clients to share the business logic running in the middle tier. This makes distribution of the application a lot easier. Since security, transactions management, and connection management are handled in the middle tier, it gives better control of the resources (B). Three-tier architecture is more scalable than the simple client-server model and requires less powerful client side machines. Due to these characteristics this architecture is suitable for small to medium enterprise deployments.

  Note: Distributed programming typically falls into one of several basic architectures or categories such as Client-server, three-tier architecture, and N-tier architecture. In the three tier architecture, business logic is handled in the middle tier, presentation rendering is handled on the client and data management is handled in the backend. This architecture allows multiple clients to access centrally deployed business logic components. This allows centralized distribution and management of resources.

• Question 59:

  Which of the following best describes the role of the Managed Target Tier within the Logical view of the Management and Monitoring architecture?

  A. contains configuration details, historical metric data and alert Information, availability Information, and product and patch inventory Information
  B. provides access to management content and operations and enables end users to access the appropriate business solution
  C. provides Management Repository and Management Engine capabilities
  D. contains the named Infrastructure components that are required to be managed and monitored
  D. contains the named Infrastructure components that are required to be managed and monitored

  ---

  The Managed Target Tier contains the named infrastructure components that are required to be managed and monitored. It is common to utilize a combination of agent based and gateway (a.k.a. proxy) patterns to monitor and manage hosted and non-hosted targets.

• Question 60:

  Which four components of the following list should be found in the client tier of the Logical view of the Oracle Reference Architecture User Interaction?

  A. Personalization
  B. Communication services
  C. State management
  D. Customization
  E. Collaboration
  F. Syndication
  G. Controller
  H. Rendering
  B. Communication services
  C. State management
  G. Controller
  H. Rendering

  ---

  The Client Tier is hosted on the display device. As mentioned above, this may be a browser or an thick client specific to the display device.

  Regardless of the choice for the Client Tier, there are standard capabilities provided by this tier in the architecture:

  Controller: The Controller accepts input from the user and performs actions based on that input. State Management: The State Management component is responsible for maintaining the current state of the user interface.

  Rendering: The Rendering component is responsible for delivering a view of the interface suitable for the end user.

  Communication Services: The Communication Services provide the means to access Service Tier capabilities.

  Note: Security Container, Data Management and Composition can also be included here.