SOA Fundamental SOA Security - S90.18 模擬練習
Symmetric and asymmetric encryption keys are always created in pairs.
正解: B
The communication between two services operating within the same organization needs to
be protected using message-layer security. These services are only used within the
organizational boundary. The question is raised as to whether to use self-signed
certificates or certificates signed by a certificate authority. A security specialist states that
only certificates signed by an external certificate authority can be used to fulfill this security
requirement. Is this correct?
be protected using message-layer security. These services are only used within the
organizational boundary. The question is raised as to whether to use self-signed
certificates or certificates signed by a certificate authority. A security specialist states that
only certificates signed by an external certificate authority can be used to fulfill this security
requirement. Is this correct?
正解: A
Username and X.509 token profiles can be combined so that a single message can contain
a username token that is digitally signed.
a username token that is digitally signed.
正解: A
Security mechanisms that are based on vendor-specific security technology will always
decrease the autonomy of services that are required to use these security mechanisms.
decrease the autonomy of services that are required to use these security mechanisms.
正解: B
To provide message confidentiality and message integrity, which of the following patterns
need to be applied?
need to be applied?
正解: A
The messages exchanged between two services are kept confidential by using symmetric
encryption. The security specialist is quite strict about making sure that no attacker is able
to intercept and decipher messages sent between these two services. As a result, periodic
audits are conducted in order to ensure that shared keys are always kept confidential. A
single shared key has been in use for quite some time now. The security specialist was
confident that all keys were well guarded, but just recently their security was compromised.
How is this possible given that the shared key was never lost?
encryption. The security specialist is quite strict about making sure that no attacker is able
to intercept and decipher messages sent between these two services. As a result, periodic
audits are conducted in order to ensure that shared keys are always kept confidential. A
single shared key has been in use for quite some time now. The security specialist was
confident that all keys were well guarded, but just recently their security was compromised.
How is this possible given that the shared key was never lost?
正解: B
Which of the following security mechanisms can provide centralized security measures for
all services within a service inventory?
all services within a service inventory?
正解: A,B,C
A set of SAML tokens has been used as a result of the application of the Brokered
Authentication pattern within a particular service inventory. Because SAML assertions
normally contain a signature, the security specialist is confident that the integrity of
messages will be maintained. What's wrong with this assumption?
Authentication pattern within a particular service inventory. Because SAML assertions
normally contain a signature, the security specialist is confident that the integrity of
messages will be maintained. What's wrong with this assumption?
正解: A
The use of XML-Encryption supports the application of the Service Abstraction principle
because the actual message remains hidden from the attacker.
because the actual message remains hidden from the attacker.
正解: B
The services within a domain service inventory provide access to confidential data
retrieved from a shared database. These services need to be accessible from outside the
domain service inventory. Which of the following design options will preserve the
confidentiality of the data when the services are accessed from outside the service
inventory?
retrieved from a shared database. These services need to be accessible from outside the
domain service inventory. Which of the following design options will preserve the
confidentiality of the data when the services are accessed from outside the service
inventory?
正解: D