S90.19 Advanced SOA Security Questions and Answers

buffer overrun attack

XPath injection attack

SQL injection attack

exception generation attack

The Trusted Subsystem pattern can be applied to establish an architecture whereby service consumers are required to access the utility service in order to gain access to the data in the database

Service agents can be added to route messages to an authentication broker. That way, only authorized service consumers would get access to the database.

The Message Screening pattern can be applied so that messages sent to the utility service are inspected at runtime.

None of the above.

common security requirements can be centralized into shared security policies

security policies are defined by using WSDL and XML Schema industry standards together

security policies can be decoupled from service logic

security policies can be part of service contracts and are therefore subject to the Service Loose Coupling principle

Increased performance degradation

Increased reliability degradation

Reduced message sizes

None of the above

Security tokens can be validated without resorting to pre-shared secrets.

Security tokens issued by a token issuer in the same security domain can be used with a different token issuer in a different security domain in order to get access to services in that domain.

Security token issuance and cancellation are done by the relying party.

Security tokens can only be issued by a legitimate token issuer.

The Trusted Subsystem pattern was not applied to the perimeter service.

The perimeter service needs to be located inside the firewall and the firewall needs to be configured so that only known service consumers have access to the service inventory.

The Service Perimeter Guard pattern cannot be applied to a service outside of a service inventory.

None of the above

The individual authentication brokers need to be replaced with one single authentication broker so that one single token can be used by services across all domain service inventories.

An additional authentication broker needs to be added in between each domain service inventory in order to enable communication between services using disparate security tokens.

There is no need to introduce a new security mechanism. The individual domain service inventories need to be combined into a single enterprise service inventory. That way, the Service Perimeter Guard pattern can be applied so that services won't need to authenticate each other.

There is no need to introduce a new security mechanism. The existing SAML tokens can be used by services across the domain service inventories as long as the existing authentication brokers are configured to issue service inventory-specific assertions for SAML tokens from specific domain service inventories.

The Data Confidentially pattern needs to be applied so that all request and response messages exchanged by Service A are encrypted.

The Data Origin Authentication pattern needs to be applied in order to incorporate digital signatures in request and response messages exchanged by Service A.

The Service Perimeter Guard pattern needs to be applied in order to centralize access to the database.

None of the above.

The policy can be centralized and isolated into a separate policy document that is linked to the service contract.

The policy can be expressed using a digital certificate that is added to the service contract.

The policy can be expressed using an ignorable policy assertion that is added to the service contract.

None of the above.