최신 S90.19 무료덤프 - SOA Advanced SOA Security
A certain service becomes a victim of an insufficient authorization attack. This service acts as a trusted subsystem for an entire service inventory. Which of the following are under threat as a result of this attack?
정답: D
An XML bomb attack and an XML external entity attack are both considered types of XML parser attacks.
정답: A
An alternative to using a ___________ is to use a __________.
정답: B
Service A's logic has been implemented using unmanaged code. An attacker sends a message to Service A that contains specially crafted data capable of manipulating the quoting within a particular XPath expression. This results in the release of confidential information. Service A is a victim of which kind of attack?
정답: A
The Trusted Subsystem pattern is applied to a service that provides access to a database.
Select the answer that best explains why this service is still at risk of being subjected to an insufficient authorization attack.
Select the answer that best explains why this service is still at risk of being subjected to an insufficient authorization attack.
정답: C
Service A expresses its requirement for message-layer security to service consumers via a security policy. Since the launch of Service A, its popularity has grown and it is decided that a fee should be charged for its use. Consequently, the design of Service A is changed so that it is capable of keeping a log of all request messages received from service consumers. The fact that Service A is logging all incoming messages is something that can also be expressed via a policy.
정답: A
Service A has recently been the victim of XPath injection attacks. Messages sent between Service A and Service C have traditionally been protected via transport-layer security. A redesign of the service composition architecture introduces Service B, which is positioned as an intermediary service between Service A and Service C.
The Message Screening pattern was applied to the design of Service B.
As part of the new service composition architecture, transport-layer security is replaced with message-layer security for all services, but Service A and Service C continue to share the same encryption key. After the new service composition goes live, Service A continues to be subjected to XPath injection attacks. What is the reason for this?
The Message Screening pattern was applied to the design of Service B.
As part of the new service composition architecture, transport-layer security is replaced with message-layer security for all services, but Service A and Service C continue to share the same encryption key. After the new service composition goes live, Service A continues to be subjected to XPath injection attacks. What is the reason for this?
정답: A
The Message Screening pattern can be applied to a service acting as a trusted subsystem for an underlying database. That way, the database would be protected from SOL injection attacks.
정답: A