SOA SOACP S90-19A Questions & Answers

• Question 1:

  The use of derived keys is based on symmetric encryption. This is similar to asymmetric encryption because different keys can be derived from a session key and used separately for encryption and decryption.

  A. True

  B. False

  Correct Answer: B

• Question 2:

  The application of the Trusted Subsystem pattern directly supports the goals of the Service Loose Coupling principle.

  A. True

  B. False

  Correct Answer: A

• Question 3:

  Service A is only authorized to access one service capability of Service B. Service B acts as a trusted subsystem for several underlying resources which it accesses using its own set of credentials. Service B can therefore not become a victim of an insufficient authorization attack initiated by Service A.

  A. True

  B. False

  Correct Answer: B

• Question 4:

  A service receives a message containing an XML document that expands to a very large size as it is processed by the parser. As a result, the service becomes unavailable to service consumers.

  The service was subjected to which type of attack?

  A. XML parser attack

  B. Exception generationattack

  C. XPath injection attack

  D. None of the above.

  Correct Answer: A

• Question 5:

  An attacker is able to gain access to a service and invokes the service. Upon executing the service logic, the attacker is able to gain access to underlying service resources, including a private database. The attacker proceeds to delete data from the database.

  The attacker has successfully executed which type of attack?

  A. exception generation attack

  B. insufficient authorization attack

  C. denial of service attack

  D. None of the above.

  Correct Answer: B

• Question 6:

  The application of the Trusted Subsystem pattern can help centralize access to services.

  A. True

  B. False

  Correct Answer: A

• Question 7:

  A service protected from an XML bomb attack will automatically also be protected from a schema poisoning attack.

  A. True

  B. False

  Correct Answer: B

• Question 8:

  Designing security policies with is an extension of the SOA characteristic that supports interoperability and avoids .

  A. industry standards, business-driven, vendor lock-out

  B. industry standards, vendor-neutral, vendor lock-in

  C. design standards, composition-centric, vendor lock-in

  D. design standards, enterprise-centric, vendor lock-in

  Correct Answer: B

• Question 9:

  A malicious passive intermediary intercepts messages sent between two services. Which of the following is the primary security concern raised by this situation?

  A. The integrity of the message can be affected.

  B. The confidentiality of the message can be affected.

  C. The reliability of the message can be affected.

  D. The availability of the message can be affected.

  Correct Answer: B

• Question 10:

  When applying the Exception Shielding pattern, which of the following are valid options for implementing exception shielding logic?

  A. as part of the core service logic

  B. within a service agent

  C. within a utility service

  D. All of the above.

  Correct Answer: D