Online Access Free S90.19 Practice Test

An attacker is able to gain access to a service and invokes the service. Upon executing the service logic, the attacker is able to gain access to underlying service resources, including a private database. The attacker proceeds to delete data from the database. The attacker has successfully executed which type of attack?

• A.insufficient authorization attack
• B.exception generation attack
• C.denial of service attack
• D.None of the above.

Which of the following types of attack always affect the availability of a service?

• A.None of the above
• B.XPath injection attack
• C.SQL injection attack
• D.Exception generation attack

___________ is an industry standard that describes mechanisms for issuing, validating, renewing and cancelling security tokens.

• A.WS-Security
• B.WS-SecureConversation
• C.WS-Trust
• D.WS-SecurityPolicy

When designing XML schemas to avoid data-centric threats, which of the following are valid considerations?

• A.The maxOccurs attribute needs to be specified using a restrictive value.
• B.All of the above.
• C.The <xsd:restriction> element can be used to create more restrictive user-defined simple types.
• D.The <xsd:any> element needs to be avoided.

A utility service is responsible for encapsulating a legacy database and providing centralized access to the database for any of its service consumers. However, it is discovered that several service consumers are accessing the database directly. This is considered a security concern because much of the data in the database is classified as sensitive. How can this concern be addressed?

• A.The Trusted Subsystem pattern can be applied to establish an architecture whereby service consumers are required to access the utility service in order to gain access to the data in the database
• B.Service agents can be added to route messages to an authentication broker. That way, only authorized service consumers would get access to the database.
• C.The Message Screening pattern can be applied so that messages sent to the utility service are inspected at runtime.
• D.None of the above.