Service A contains reporting logic that collects statistical data from different sources in order to
produce a report document. One of the sources is a Web service that exists outside of the
organizational boundary. Some of Service A's service consumers are encountering slow response
times and periods of unavailability when invoking Service A . While investigating the cause, it has
been discovered that some of the messages received from the external Web service contain
excessive data and links to files (that are not XML schemas or policies). What can be done to address
this issue?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A, D
Q: 2
The same security policy has been redundantly implemented as part of the service contracts for Web
services A, B and C. In order to reduce the effort of maintaining multiple redundant service policies,
it has been decided to centralize policy enforcement across these three services. Which of the
following industry standards will need to be used for Web services A, B and C in order for their
service contracts to share the same security policy document?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Q: 3
An alternative to using a ___________ is to use a __________.
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
C
Q: 4
The difference between the Exception Shielding and Message Screening patterns is in how the core
service logic processes incoming messages received by malicious service consumers?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Q: 5
___________ is an industry standard that describes mechanisms for issuing, validating, renewing
and cancelling security tokens.
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Q: 6
How can the use of pre-compiled XPath expressions help avoid attacks?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Q: 7
A service is designed to respond to an error condition by issuing a message containing detailed error
information. This message includes connection information for a database that is shared by
numerous services within the service inventory. An attacker intentionally sends an invalid message to
the service in order to trigger an error and receive the connection information. The attacker then
proceeds to connect to the database and issues a series of malicious SQL queries that make the
database non-responsive. As a result, a number of services within the service inventory are disabled.
Which of the following types of attacks were successfully carried out?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B, C
Q: 8
Service A needs to be designed so that it supports message integrity and so that only part of the
messages exchanged by the service are encrypted. You are asked to create the security policy for this
service. What type of policy assertions should you use?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
B
Q: 9
The use of session keys and symmetric cryptography results in:
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Q: 10
The Service Perimeter Guard pattern is applied to position a perimeter service outside of the firewall.
The firewall only permits the perimeter service to access services within a specific service inventory.
Which of the following statements describes a valid problem with this security architecture?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Q: 11
Service A is part of a large service composition. Following an attack, Service A becomes non-
responsive. Which of the following attacks could be responsible for Service A's non-responsiveness?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A, C
Q: 12
A malicious active intermediary intercepts a message sent between two services. What concerns are
raised by such an attack?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
D
Q: 13
Within a certain service activity, two services are using certificates in order to guarantee the integrity
of messages. With every message exchange, certificates are sent and received. These certificates are
checked against an external Certificate Authority (CA) in order to verify whether or not they have
been revoked. The current security architecture is suffering from increased latency resulting from the
extra communication required with the CA. How can this problem be addressed without
compromising message integrity?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A
Q: 14
Security policies defined using WS-SecurityPolicy can be used to convey which of the following
requirements to a service consumer?
Options
Discussion
No comments yet. Be the first to comment.
Be respectful. No spam.
Correct Answer:
A, C, D
Q: 15
Architects responsible for a domain service inventory are being asked to make some of their services
available to service consumers from outside the organization. However, they are reluctant to do so
and consult you to help define a security architecture that will keep all of the existing services within
the domain service inventory hidden within a private network. Which of the following is a valid
approach for fulfilling this requirement?
