Arcitura Education S90.19 Exam Questions Instant Access

Question 1

Service A is a Web service with an implementation that uses managed code. To perform a graphics-related operation, this managed code needs to access a graphics function that exist as unmanaged code. A malicious service consumer sends a message to Service A containing a very large numeric value. This value is forwarded by Service A' s logic to the graphics function. As a result, the service crashes and becomes unavailable. The service consumer successfully executed which attack?

ABuffer overrun attack

BException generation attack

CXML parser attack

DNone of the above

Answer : A

Question 2

As an SOA security specialist you are being asked to educate an IT team about how to best design security policies for a given set of services. Which of the following recommendations are valid?

Acommon security requirements can be centralized into shared security policies

Bsecurity policies are defined by using WSDL and XML Schema industry standards together

Csecurity policies can be decoupled from service logic

Dsecurity policies can be part of service contracts and are therefore subject to the Service Loose Coupling principle

Answer : A, C, D

Question 3

The use of a perimeter service can centralize authentication and authorization logic and it can also prevent direct access to other services positioned behind a firewall.

ATrue

BFalse

Answer : A

Question 4

A malicious passive intermediary intercepts messages sent between two services. Which of the following is the primary security concern raised by this situation?

AThe integrity of the message can be affected.

BThe confidentiality of the message can be affected.

CThe reliability of the message can be affected.

DThe availability of the message can be affected.

Answer : B

Question 5

When considering the ESB as providing intermediary logic, which of the following types of subject confirmation methods relate to its access control issues?

AHolder-of-key

BSender-vouches

CIssuer-vouches

DNone of the above.

Answer : B

Question 6

The use of XML schemas for data validation helps avoid several types of data-centric threats.

ATrue

BFalse

Answer : A

Question 7

Which of the following types of attack always affect the availability of a service?

AException generation attack

BSQL injection attack

CXPath injection attack

DNone of the above

Answer : D

Arcitura Education Advanced SOA Security S90.19 Exam Questions