S90.19無料問題集「SOA Advanced SOA Security」

質問 1

A malicious active intermediary intercepts a message sent between two services. What concerns are raised by such an attack?

（A）The confidentiality of the message can be compromised

（B）All of the above.

（C）The integrity of the message can be compromised

（D）the message can be routed to a different destination

正解：B 解答を投票する

質問 2

A service uses specialized logic to compare the size of a request message to the maximum allowable size that is specified for request messages. Upon a mismatch, the service triggers an error that results in the issuance of a message with detailed error information.
What type of attack does this specialized logic not help protect the service from?

（A）exception generation attack

（B）XPath injection attack

（C）buffer overrun attack

（D）XML parser attack

正解：A 解答を投票する

質問 3

The Exception Shielding pattern can be applied together with the Trusted Subsystem pattern.

（A）False

（B）True

正解：B 解答を投票する

質問 4

A service receives a message containing an XML document that expands to a very large size as it is processed by the parser. As a result, the service becomes unavailable to service consumers. The service was subjected to which type of attack?

（A）XPath injection attack

（B）None of the above.

（C）XML parser attack

（D）Exception generation attack

正解：C 解答を投票する

質問 5

Which of the following types of attack always affect the availability of a service?

（A）SQL injection attack

（B）XPath injection attack

（C）None of the above

（D）Exception generation attack

正解：C 解答を投票する

質問 6

The application of the Data Origin Authentication pattern and the Data Confidentiality pattern do not help mitigate the risk of malicious intermediary attacks.

（A）False

（B）True

正解：A 解答を投票する

質問 7

The service contract for Service A uses an XML schema that does not specify the maximum length for the CustomerAddress XML element. A service consumer sends a message that contains a very long string of characters inside the CustomerAddress XML element. This can be an indication of what types of attacks?

（A）Insufficient authorization attack

（B）XPath injection attack

（C）Buffer overrun attack

（D）XML parser attack

正解：C、D 解答を投票する

質問 8

Architects responsible for a domain service inventory are being asked to make some of their services available to service consumers from outside the organization. However, they are reluctant to do so and consult you to help define a security architecture that will keep all of the existing services within the domain service inventory hidden within a private network.
Which of the following is a valid approach for fulfilling this requirement?

（A）Apply the Service Perimeter Guard pattern in order to position a perimeter service outside the private network that has been configured to access the internal services via a firewall. The perimeter service becomes the sole contact point for external service consumers.

（B）Apply the Trusted Subsystem pattern in order to position a service outside the private network that authenticates each incoming request and then uses its own set of credentials to get access to internal services. This service becomes the sole contact point for external service consumers.

（C）Apply the Brokered Authentication pattern to position an authentication broker outside the private network that has been configured to access the internal services via a firewall.
The authentication broker becomes the sole contact point for external service consumers.

（D）None of the above.

正解：A 解答を投票する

S90.19 無料問題集「SOA Advanced SOA Security」

弊社を連絡する

関連リンク

トップ試験