Online Access Free S90.19 Practice Test

An ESB is introduced into an IT enterprise, primarily to enable communication between a set of disparate Web services. As a first step, the ESB needs to be configured to carry out data model transformation in order to overcome differences in the XML schemas used by the Web services. However, the messages exchanged by the Web services need to be encrypted. What needs to be done in order for the ESB to enable communication between the Web services without compromising message confidentiality?

• A.The ESB needs to be configured so that it can decrypt and encrypt messages.
• B.In this scenario, the ESB cannot enable communication between the Web services without compromising message confidentiality.
• C.The messages need to be digitally signed instead of encrypted.
• D.The Web services need to be designed to support transport-layer security instead of message-layer security.

Service A is a Web service that accesses the Student table in a shared database in order to store XML-based student records. When invoked, the GetStudent operation of Service A uses a StudentID value to retrieve the record of a single student by executing an XPath query. An attacker sends a malicious message that manipulates the XPath query to return all the student records. Which of the following attacks was carried out?

• A.XPath injection attack
• B.None of the above
• C.SQL injection attack
• D.XML parser attack

The application of the Service Perimeter Guard pattern establishes a perimeter service that hides internal services from unauthorized external service consumers. However, the perimeter service grants authorized external services direct access to internal services.

• A.False
• B.True

Service A, residing outside the private network of an organization, provides logic that sanitizes message error information on behalf of other services that reside inside the private network, behind a firewall. Where is the vulnerability in this architecture?

• A.None of the above.
• B.The sanitization logic resides outside the private network. Therefore, if communication between Service A and the services within the private network is compromised, an attacker can get access to sensitive data from non-sanitized messages generated by services inside the private network.
• C.There is no single sign-on mechanism in place, which puts all services (within and outside the private network) at risk.
• D.There is no central management of error messages. Instead, policy enforcement points should be used so that all services are required to comply with a policy that states that any error message generated needs to be free of sensitive data.

The application of the Service Loose Coupling principle does not relate to the use of security policies as part of service contracts.

• A.False
• B.True