SOA S90.20 : SOA Security Lab

Ob druckbares PDF, Desktop Test Engine oder Online Test Engine – bei Zertpruefung wählen Sie für die S90.20 Prüfung genau das Format, das zu Ihrem Lernalltag passt. Alle drei Varianten enthalten dieselben 30 Übungsfragen zur SOA Security Lab und lassen sich flexibel kombinieren.

SOA S90.20 Prüfungsthemen:

Ihre Fragen zur SOA S90.20 Zertifizierungsprüfung – beantwortet

Was genau ist die SOA S90.20 Prüfung?

Die SOA Security Lab (S90.20) ist eine offizielle Zertifizierungsprüfung von SOA. Mit dem Bestehen erwerben Sie die Zertifizierung SOA Certification, die dem Level Spezialist zugeordnet ist. Im fachlichen Umfeld dieser Prüfung stehen außerdem die Zertifizierungen Certified SOA Security Specialist. Für eine systematische Vorbereitung nutzen Sie die 30 Übungsfragen von Zertpruefung.

Wie viele Fragen enthält die S90.20 Prüfung und wie viel Zeit bleibt mir dafür?

Laut Herstellerangaben umfasst die S90.20 Prüfung 30 Fragen, die Sie innerhalb von 60 Minuten bearbeiten. Rechnen Sie vorab aus, wie viel Zeit Ihnen damit im Durchschnitt pro Aufgabe bleibt, und trainieren Sie dieses Tempo gezielt. Ein zeitlich begrenzter Probedurchlauf in der Test Engine von Zertpruefung zeigt Ihnen früh, bei welchen Themen Sie noch zu lange grübeln – so gehen Sie mit einem realistischen Zeitgefühl in die Prüfung.

Welches Ergebnis brauche ich zum Bestehen der S90.20 Prüfung und was kostet die Anmeldung?

Für das Bestehen der S90.20 Prüfung ist laut SOA ein Ergebnis von Nicht offiziell veröffentlicht erforderlich; die offizielle Prüfungsgebühr liegt bei Offizielle Preise variieren je nach Region und Prüfungsanbieter. Beachten Sie: Scheitern Sie, wird bei der Wiederholung die Gebühr erneut in voller Höhe fällig. Testen Sie Ihren Wissensstand deshalb vor der Anmeldung mit den 30 Übungsfragen von Zertpruefung, bis Sie die geforderte Marke im Übungsbetrieb sicher erreichen.

Welche Voraussetzungen muss ich für die S90.20 Prüfung erfüllen?

Vor der Anmeldung zur S90.20 Prüfung gilt Folgendes zu beachten: Keine formellen Teilnahmevoraussetzungen; Grundkenntnisse zu SOA-Konzepten sowie fortgeschrittene Grundlagen im Bereich Sicherheit werden empfohlen. Da sich die Teilnahmebedingungen ändern können, bestätigen Sie die aktuellen Anforderungen am besten direkt beim Hersteller: offizielle Prüfungsübersicht von SOA.

Kann ich die S90.20 Übungsfragen vor dem Kauf ausprobieren?

Ja. Laden Sie vorab die kostenlose PDF-Demo zur S90.20 Prüfung herunter und verschaffen Sie sich einen ehrlichen Eindruck von Stil und Niveau der Fragen. Nach dem Kauf bleiben Sie zusätzlich abgesichert: 365 Tage lang erhalten Sie jede Aktualisierung der SOA Security Lab Materialien kostenlos, und danach verlängern Sie den Update-Service mit 50 % Rabatt.

Was passiert, wenn ich die S90.20 Prüfung nicht bestehe – und wie wird mein Produkt geliefert?

Bestehen Sie die S90.20 Prüfung innerhalb von 60 Tagen nach dem Kauf nicht, erhalten Sie den vollen Kaufpreis zurück. Voraussetzungen: Sie senden uns innerhalb von zwei Tagen nach dem Prüfungstermin eine eingescannte Anmeldebestätigung (Enrollment Slip) sowie Ihren offiziellen Score Report als PDF; der Kandidatenname muss mit dem Namen des Käufers übereinstimmen. Nicht anwendbar ist die Regelung, wenn Sie die Prüfung innerhalb der ersten drei Tage nach dem Kauf ablegen, die Materialien nur heruntergeladen, aber keine Prüfung absolviert haben, oder wenn es sich um kostenlose Unterlagen beziehungsweise abgelaufene Bestellungen handelt. Ihr Antrag wird innerhalb von sieben Tagen bearbeitet. Alternativ zur Rückerstattung tauschen Sie das Produkt kostenlos gegen zwei gleichwertige Prüfungsmaterialien und behalten den Update-Service für Ihr ursprüngliches Produkt. Die Lieferung selbst erfolgt sofort: Nach der Bezahlung steht der Download bereit, und die E-Mail erreicht Sie in der Regel innerhalb einer Minute – sollte sie nach zwei Stunden nicht eingegangen sein, wenden Sie sich bitte an unseren Kundenservice. Eine Begrenzung der Anzahl der Installationen gibt es nicht.

Welche Themen werden in der S90.20 Prüfung abgefragt?

Die S90.20 Prüfung gliedert sich laut offiziellem Lehrplan in 5 Themengebiete. Zu den wichtigsten zählen:

• Grundlegende Sicherheitsaspekte für Dienste, Microservices und SOA
• Erweiterte Sicherheitsaspekte für Dienste, Microservices und SOA
• Sicherheitslabor für Dienste, Microservices und SOA

Die vollständige Übersicht aller Prüfungsinhalte finden Sie weiter oben im Abschnitt mit den Exam Topics. Arbeiten Sie jedes Gebiet anschließend gezielt mit den Übungsfragen von Zertpruefung durch.

SOA Security Lab S90.20 Prüfungsfragen mit Lösungen

Frage #1
Service Consumer A sends a request message to Service A (1), after which Service A sends a request message to Service B (2). Service B forwards the message to have its contents calculated by Service C (3). After receiving the results of the calculations via a response message from Service C (4), Service B then requests additional data by sending a request message to Service D (5). Service D retrieves the necessary data from Database A (6), formats it into an XML document, and sends the response message containing the XML-formatted data to Service B (7). Service B appends this XML document with the calculation results received from Service C, and then records the entire contents of the XML document into Database B (8). Finally, Service B sends a response message to Service A (9) and Service A sends a response message to Service Consumer A (10).
Services A, B and D are agnostic services that belong to Organization A and are also being reused in other service compositions. Service C is a publicly accessible calculation service that resides outside of the organizational boundary. Database A is a shared database used by other systems within Organization A and Database B is dedicated to exclusive access by Service B.

Recently, Service D received request messages containing improperly formatted database retrieval requests. All of these request messages contained data that originated from Service C.
There is a strong suspicion that an attacker from outside of the organization has been attempting to carry out SOL injection attacks. Furthermore, it has been decided that each service that writes data to a database must keep a separate log file that records a timestamp of each database record change. Because of a data privacy disclosure requirement used by Organization A, the service contracts of these services need to indicate that this logging activity may occur.
How can the service composition architecture be improved to avoid SQL injection attacks originating from Service C - and - how can the data privacy disclosure requirement be fulfilled?

A. Apply the Message Screening pattern in order to establish a service agent with message screening logic. Position the service agent between Service C and Service B.
The service agent's message screening logic can reject or filter out potentially harmful content in messages sent from Service C, before being processed by Service B.
Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity.
B. Apply the Data Origin Authentication pattern to authenticate data received from Service C.
Service C digitally signs any data sent in response messages to Service B.
Service B can then verify that the data has not been modified during transit and that it originated from Service C.
Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity.
C. Apply the Service Perimeter Guard pattern together with the Message Screening pattern in order to establish a perimeter service with message screening logic. Position the perimeter service between Service C and Service B.
The message screening logic rejects or filters out potentially harmful content in messages sent from Service C, prior to being forwarded to Service B.
Secondly, update the service contracts for Services B and D with an optional WS-Policy assertion that provides service consumers with the option of complying to the logging requirements.
D. Apply the Data Origin Authentication pattern to authenticate data received from Service C.
Service C digitally signs any data sent in response messages to Service B.
Service B can then verify that the data has not been modified during transit and that it originated from Service C.
Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity. The service contracts for Services B and D are updated with an optional WS-Policy assertion that provides service consumers with the option of complying to the logging requirements.

Frage #2
Service A provides a customized report generating capability. Due to infrastructure limitations, the number of service consumers permitted to access Service A concurrently is strictly controlled. Service A validates request messages based on the supplied credentials (1). If the authentication of the request message is successful, Service A sends a message to Service B (2) to retrieve the required data from Database A (3). Service A stores the response from Service B (4) in memory and then issues a request message to Service C (5). Service C retrieves a different set of data from Database A (6) and sends the result back to Service A (7). Service A consolidates the data received from Services B and C and sends the generated report in the response message to its service consumer (8).

This service composition was recently shut down after it was discovered that Database A had been successfully attacked twice in a row. The first type of attack consisted of a series of coordinated request messages sent by the same malicious service consumer, with the intention of triggering a range of exception conditions within the database in order to generate various error messages. The second type of attack consisted of a service consumer sending request messages with malicious input with the intention of gaining control over the database server. This attack resulted in the deletion of database records and tables. An investigation revealed that both attacks were carried out by malicious service consumers that were authorized.
How can the service composition security architecture be improved to prevent these types of attacks?

A. Apply the Exception Shielding pattern together with the Message Screening pattern.
This establishes new logic within Service A that screens incoming request messages for data-driven attacks (such as SQL injection and XPath injection attacks), and also evaluates whether exception details returned by Database A contains potentially confidential or unsafe information. Any inappropriate exception information is replaced with sanitized content.
B. Apply the Trusted Subsystem pattern to protect Database A from data-driven attacks and to evaluate whether database responses contain inappropriate data. The trusted subsystem maintains a snapshot of Database A and executes the original service consumer's request message against the snapshot. The processing logic that accesses the snapshot has limited privileges in order to prevent malicious attacks from overtaking the database. If no security violation is detected during the processing of the snapshot, then the original service consumer's request is forwarded to Database A.
If an error message is generated during the processing of the snapshot, then it is returned to the original service consumer and the request is not forwarded to Database A.
Because the error message was generated on the snapshot, it cannot contain unsafe information about Database A.
C. Apply the Data Confidentiality pattern together with the Data Origin Authentication pattern. This establishes message-level security so that all messages are encrypted and digitally signed. Secondly, the Service A logic must be enhanced so that it can keep track of the trustworthiness of its service consumers If a request message originated from a trustworthy service consumer, then the request message is processed as normal. If the request message originates from a non-trustworthy service consumer, then the request message is rejected and an error message is returned to the service consumer.
D. Apply the Service Perimeter Guard pattern together with the Trusted Subsystem pattern.
This establishes a perimeter service between Database A and any service that requires access to it (including Services B and C). The perimeter service evaluates incoming data requests and filters out those that can introduce a security risk. Only request messages issued by authorized services and service consumers are forwarded to Database A.
Responses originating from Database A are further evaluated by the trusted subsystem to remove any unauthorized data. The two patterns together ensure that only authorized data is returned to the service consumer and that no request messages present a security threat to Database A.

Frage #3
Service Consumer A sends a request message to Service A (1) after which Service A retrieves financial data from Database A (2). Service A then sends a request message with the retrieved data to Service B (3). Service B exchanges messages with Service C (4) and Service D (5), which perform a series of calculations on the data and return the results to Service A.
Service A uses these results to update Database A (7) and finally sends a response message to Service Consumer A (8). Component B has direct, independent access to Database A and is fully trusted by Database A.
Both Component B and Database A reside within Organization A.
Service Consumer A and Services A, B, C, and D are external to the organizational boundary of Organization A.

Component B is considered a mission critical program that requires guaranteed access to and fast response from Database A.
Service A was recently the victim of a denial of service attack, which resulted in Database A becoming unavailable for extended periods of time (which further compromised Component B). Additionally, Services B, C, and D have repeatedly been victims of malicious intermediary attacks, which have further destabilized the performance of Service A.
How can this architecture be improved to prevent these attacks?

A. The Direct Authentication pattern is applied so that when Service Consumer A submits security credentials, Service A will be able to evaluate the credentials in order to authenticate the request message. If the request message is permitted, Service A invokes the other services and accesses Database A.
Database A is replicated so that only the replicated version of the database can be accessed by Service A and other external service consumers.
B. Service Consumer A generates a private/public key pair and sends this public key and identity information to Service A.
Service A generates its own private/public key pair and sends it back to Service Consumer A.
Service Consumer A uses the public key of Service A to encrypt a randomly generated session key and then sign the encrypted session key with the private key. The encrypted, signed session key is sent to Service A.
Now, this session key can be used for secure message-layer communication between Service Consumer A and Service A.
The Service Perimeter Guard pattern is applied to establish a perimeter service that encapsulates Database A in order to authenticate all external access requests.
C. Services B, C, and D randomly generate Session Key K, and use this key to encrypt request and response messages with symmetric encryption. Session Key K is further encrypted itself asymmetrically. When each service acts as a service consumer by invoking another service, it decrypts the encrypted Session Key K and the invoked service uses the key to decrypt the encrypted response. Database A is replicated so that only the replicated version of the database can be accessed by Service A and other external service consumers.
D. A utility service is created to encapsulate Database A and to assume responsibility for authenticating all access to the database by Service A and any other service consumers.
Due to the mission critical requirements of Component B, the utility service further contains logic that strictly limits the amount of concurrent requests made to Database A from outside the organizational boundary. The Data Confidentiality and Data Origin Authentication patterns are applied to all message exchanged within the external service composition in order to establish message-layer security.

Fragen und Antworten: