Arcitura Education S90.19 Exam Questions Instant Access

Question 1

A service is designed to respond to an error condition by issuing a message containing detailed error information. This message includes connection information for a database that is shared by numerous services within the service inventory. An attacker intentionally sends an invalid message to the service in order to trigger an error and receive the connection information. The attacker then proceeds to connect to the database and issues a series of malicious SQL queries that make the database non-responsive. As a result, a number of services within the service inventory are disabled. Which of the following types of attacks were successfully carried out?

ASQL injection attack

BException generation attack

CDenial of service attack

DBuffer overrun attack

Answer : B, C

Question 2

When considering the ESB as providing intermediary logic, which of the following types of subject confirmation methods relate to its access control issues?

AHolder-of-key

BSender-vouches

CIssuer-vouches

DNone of the above.

Answer : B

Question 3

Which of the following statements is true?

AWhen the maxOccurs attribute in an XML schema element is not specified it creates a security risk because attackers can specify this element multiple times.

BWhen numeric ranges within an XML schema are not specified it creates a security risk because attackers can introduce very large numeric values within the message data.

CWhen the xsd:any element is used within an XML schema it can introduce a security risk because it allows attackers to extend the schema.

DAll of above.

Answer : D

Question 4

Service A's logic has been implemented using unmanaged code. An attacker sends a message to Service A that contains specially crafted data capable of manipulating the quoting within a particular XPath expression. This results in the release of confidential information. Service A is a victim of which kind of attack?

ABuffer overrun attack

BInsufficient authorization attack

CXPath injection attack

DNone of the above.

Answer : C

Question 5

The use of parameterized expressions can help avoid which type of attack?

AXML parser attack

BBuffer overrun attack

CXPath injection attack

DException generation attack

Answer : C

Question 6

A denial of service attack can be the byproduct of an insufficient authorization attack.

ATrue

BFalse

Answer : A

Question 7

The Exception Shielding pattern can be applied together with the Trusted Subsystem pattern.

ATrue

BFalse

Answer : A

Arcitura Education Advanced SOA Security S90.19 Exam Questions