Interactive and interesting — the online version runs on all electronics. The SOA Security Lab dumps at Test4Cram: 30 practice questions for the S90.20 exam in three versions.
SOA S90.20 Exam Overview:
| Certification Vendor: | Arcitura Education (SOA School) |
|---|---|
| Exam Name: | SOA Security Lab S90.20 |
| Exam Number: | S90.20 |
| Available Languages: | English |
| Related Certifications: | SOA Security Specialist |
| Exam Duration: | 120 minutes |
| Exam Format: | Practical Lab Exam, Scenario-based Assessment |
| Sample Questions: |  |
| Exam Way: | Online proctored lab-based exam |
| Pre Condition: | Recommended: completion of SOA Security Specialist training or equivalent knowledge of SOA concepts and web service security. |
SOA S90.20 Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: Security Governance | - Auditability and monitoring in SOA security - Policy enforcement and compliance considerations |
| Topic 2: Message and Transport Security | - WS-Security standards and message protection - Encryption and digital signatures |
| Topic 3: Service Security Design | - Service exposure and gateway security controls - Secure service design patterns |
| Topic 4: SOA Security Fundamentals | - Security risks and threat models in SOA environments - Security principles in service-oriented architecture |
| Topic 5: Identity and Access Management | - Authentication and authorization mechanisms - Federated identity and trust management |
S90.20 Exam FAQ — Stand Out
Recommended: completion of SOA Security Specialist training or equivalent knowledge of SOA concepts and web service security. Eligibility rules change over time, so verify the current requirements on the official page before registering.
Yes — enter your email address and download the free SOA Security Lab exam cram pdf for reference; your information stays secret and safe, and we never send advertisement without permission. Purchases include a one-year service warranty: 365 days of updates, renew afterward at 50% off.
Yes:
After any course, stay efficient with the 30 practice questions for the SOA Security Lab — every answer expert-verified.
Soon after purchasing you can download the complete SOA Security Lab material — even on official holidays: the automatic email arrives within about a minute, and our 7*24 service replies within two hours if anything goes wrong. If you fail the corresponding S90.20 exam within 60 days of purchase, we refund in full: send a scanned enrollment slip plus the official Score Report PDF within 2 days of the exam, processed within 7 days. Excluded: exams within 3 days of purchase, candidate names that don't match the payer, and free or expired products. Or exchange for two equal-value products free.
The SOA Security Lab is SOA's certification exam for SOA Security Specialist, at the Professional level. When a good opportunity appears, the certified hold the vital advantages. Related credentials include SOA Security Specialist.
Through the vendor's official registration channels:
The SOA Security Lab is delivered Online proctored lab-based exam — pick the arrangement that suits you when booking.
The SOA Security Lab blueprint spans 5 domains — including SOA Security Fundamentals, Service Security Design, Identity and Access Management. A cram sheet with direction beats aimless reading; the complete outline above lists every subtopic.
SOA Security Lab Sample Questions:
Service Consumer A sends a request message to Service A (1), after which Service A sends a request message with security credentials to Service B (2). Service B authenticates the request and, if the authentication is successful, writes data from the request message into Database B (3). Service B then sends a request message to Service C (4), which is not required to issue a response message. Service B then sends a response message back to Service A (5). After processing Service B's response, Service A sends another request message with security credentials to Service B (6). After successfully authenticating this second request message from Service A, Service B sends a request message to Service D (7). Service D is also not required to issue a response message. Finally, Service B sends a response message to Service A (8), after which Service A records the response message contents in Database A (9) before sending its own response message to Service Consumer A (10).
To use Service A, Service Consumer A is charged a per usage fee. The owner of Service Consumer A has filed a complaint with the owner of Service A, stating that the bills that have been issued are for more usage of Service A than Service Consumer A actually used.
Additionally, it has been discovered that malicious intermediaries are intercepting and modifying messages being sent from Service B to Services C and D.
Because Services C and D do not issue response messages, the resulting errors and problems were not reported back to Service B.
Which of the following statements describes a solution that correctly addresses these problems?
- A. Apply the Brokered Authentication to establish an authentication broker between Service Consumer A and Service A that can carry out the Kerberos authentication protocol. Before invoking Service A, Service Consumer A must request a ticket granting ticket and then it must request service granting tickets to all services in the service composition, including Services C and D.
Messages sent by Service B to Services C and D must further be encrypted with the public key of Service Consumer A. - B. Apply the Service Perimeter Guard and the Message Screening patterns together to establish a perimeter service between Service Consumer A and Service A.
The perimeter service screens and authenticates incoming request messages from Service Consumer A.
After successful authentication, the perimeter service generates a signed SAML assertion that is used by the subsequent services to authenticate and authorize the request message and is also carried forward as the security credential included in messages sent to Services C and D. - C. The Data Confidentiality and Data Origin Authentication patterns need to be applied in order to establish message-layer confidentiality and integrity for messages sent to Services C and D.
The Direct Authentication pattern can be applied to require that service consumer be authenticated in order to use Service A. - D. Messages sent to Services C and D must be protected using transport-layer encryption in order to ensure data confidentiality. Service consumers of Service A must be authenticated using X.509 certificates because they can be reused for several request messages.
Correct Answer: C 🗳️
Service A provides a data retrieval capability that can be used by a range of service consumers, including Service Consumer A.
In order to retrieve the necessary data, Service Consumer A first sends a request message to Service A (1). Service A then exchanges request and response messages with Service B (2, 3), Service C (4, 5), and Service D (6.
7). After receiving all three response messages from Services B.
C. and D, Service A assembles the collected data into a response message that it returns to Service Consumer A (8).
The owner of Service A charges service consumers for each usage of the data retrieval capability. Recently, the owner of Service Consumer A has complained that the data returned by Service A is incorrect, incomplete, and from invalid sources. As evidence, the Service Consumer A owner has presented the owner of Service A with sample messages containing the incorrect and incomplete contents. As a result, the Service Consumer A owner has refused to pay the usage fees. Subsequent to an internal investigation, the owner of Service A determines that the data returned by Service A is consistently correct and complete. There are suspicions that the Service Consumer A owner is altering the original messages and issuing these complaints fraudulently in order to avoid paying the usage fees.
How can the owner of Service A prove that Service A is returning correct and complete data and that this data originated from the correct sources?
- A. The service contract of Service A can be extended with an ignorable WS-Policy assertion that states that all request and response messages are logged by Service A and that false complaints will be prosecuted.
- B. Apply the Brokered Authentication pattern to send the security credentials of Service Consumer A to Services B, C, and D.
Service A can carry out the brokered authentication logic and therefore act as the intermediary security broker. Upon receiving Service Consumer A's request message, Service A can further verify the credentials against an external certificate authority, if the request is authenticated. Service A can create a signed SAML assertion containing Service Consumer A's credentials and the authorization information. Service A then forwards the original request message and the signed SAML assertion to Services B, C, and D. - C. Apply the Data Origin Authentication pattern to verily that request and response messages exchanged by Service Consumer A and Service A and exchanged by Service A and Services B, C, and D originated from the claimed sources and have not been altered prior to transmission. Also, enhance the Service A architecture so that all messages sent to its service consumers are logged.
- D. Apply the Data Origin Authentication and the Data Confidentiality patterns to ensure that request and response messages exchanged between Service A and Services B.
C, and D are digitally signed and encrypted. This guarantees message integrity and confidentiality.
Correct Answer: C 🗳️
Services A, B and C belong to Service Inventory A.
Services D, E and F belong to Service Inventory B.
Service C acts as an authentication broker for Service Inventory A.
Service F acts as an authentication broker for Service Inventory B.
Both of the authentication brokers use Kerberos-based authentication technologies. Upon receiving a request message from a service consumer, Services C and F authenticate the request using a local identity store and then use a separate Ticket Granting Service (not shown) to issue the Kerberos ticket to the service consumer.
A recent security audit of the two service inventories revealed that both authentication brokers have been victims of attacks. In Service Inventory A, the attacker has been intercepting and modifying the credential information sent by Service C (the ticket requester) to the Ticket Granting Service. As a result, the requests have been invalidated and incorrectly rejected by the Ticket Granting Service. In Service Inventory B, the attacker has been obtaining service consumer credentials and has used them to request and receive valid tickets from the Ticket Granting Service. The attacker has then used these tickets to enable malicious service consumers to gain access to other services within the service inventory.
How can the two service inventory security architectures be improved in order to counter these attacks?
- A. The Service Perimeter Guard pattern can be applied to Service Inventory A in order to establish a perimeter service responsible for validating and filtering all incoming request messages on behalf of Service C.
The Data Origin Authentication pattern can be applied to messages exchanged by services in Service Inventory B.
This will ensure the integrity of messages by verifying their origins to the message recipients. - B. WS-Trust can be used to establish secure communication between the authentication broker and the service consumers. After receiving the request message and the corresponding credentials from service consumers, the authentication broker can validate their identity, and if successful, a signed SAML assertion containing all authentication information will be issued. The SAML assertion will then be used to authenticate the service consumers during subsequent communications. Because the messages are signed and encrypted, malicious service consumers cannot access the data. This approach can be applied to counter the threats in both Service Inventories A and B.
- C. The Data Confidentiality pattern can be applied to messages exchanged by the services in Service Inventory A.
The Data Origin Authentication pattern can be applied to messages exchanged by services in Service Inventory B. - D. WS-SecureConversation can be used to secure the communication between the authentication broker and service consumers in Service Inventory A.
This ensures that Services A and B will contact Service C to request a security context token that will be used to generates a session key for the encryption of the ticket submitted to Service C.
The Data Origin Authentication pattern can be applied to messages exchanged by services in Service Inventory B.
This will ensure the integrity of messages try verifying their origins to the message recipients.
Correct Answer: C 🗳️
