Online Access Free S90.19 Practice Test

Which of the following types of attack always affect the availability of a service?

• A.None of the above
• B.XPath injection attack
• C.Exception generation attack
• D.SQL injection attack

The Exception Shielding pattern was applied to the design of Service A.
During testing, it is revealed that Service A is disclosing sensitive error information in one of its response messages. How is this possible?

• A.It is the Message Screening pattern, not the Exception Shielding pattern, that prevents a service from transmitting sensitive error information in response messages.
• B.The Trusted Subsystem pattern has already been applied to Service A, thereby conflicting with the application of the Exception Shielding pattern.
• C.The Exception Shielding pattern states that, in case of an error, the service should not send back any message at all, because this would implicitly tell the service consumer that something has gone wrong, thereby exposing vulnerabilities.
• D.None of the above.

A malicious active intermediary intercepts a message sent between two services. What concerns are raised by such an attack?

• A.The integrity of the message can be compromised
• B.The confidentiality of the message can be compromised
• C.All of the above.
• D.the message can be routed to a different destination

An attacker is able to gain access to a service and invokes the service. Upon executing the service logic, the attacker is able to gain access to underlying service resources, including a private database. The attacker proceeds to delete data from the database. The attacker has successfully executed which type of attack?

• A.exception generation attack
• B.insufficient authorization attack
• C.denial of service attack
• D.None of the above.

Service A is a Web service that accesses the Student table in a shared database in order to store XML-based student records. When invoked, the GetStudent operation of Service A uses a StudentID value to retrieve the record of a single student by executing an XPath query. An attacker sends a malicious message that manipulates the XPath query to return all the student records. Which of the following attacks was carried out?

• A.None of the above
• B.XML parser attack
• C.XPath injection attack
• D.SQL injection attack