S90.19 무료 덤프문제 온라인 액세스

An attacker is able to gain access to a service and invokes the service. Upon executing the service logic, the attacker is able to gain access to underlying service resources, including a private database. The attacker proceeds to delete data from the database. The attacker has successfully executed which type of attack?

• A.exception generation attack
• B.denial of service attack
• C.None of the above.
• D.insufficient authorization attack

The application of the Service Loose Coupling principle does not relate to the use of security policies as part of service contracts.

• A.False
• B.True

Service A requires message confidentiality using message-layer security. You are asked to create a security policy for Service A that communicates its confidentiality requirements.
However, you have not yet determined the type of encryption mechanism that will be used to enable message confidentiality. What types of binding assertions can you use to convey what service consumers should expect in the WS-Security header of SOAP messages exchanged by the service?

• A.Asymmetric binding assertion
• B.Protection binding assertion
• C.Symmetric binding assertion
• D.Transport binding assertion

A utility service is responsible for encapsulating a legacy database and providing centralized access to the database for any of its service consumers. However, it is discovered that several service consumers are accessing the database directly. This is considered a security concern because much of the data in the database is classified as sensitive. How can this concern be addressed?

• A.The Trusted Subsystem pattern can be applied to establish an architecture whereby service consumers are required to access the utility service in order to gain access to the data in the database
• B.None of the above.
• C.Service agents can be added to route messages to an authentication broker. That way, only authorized service consumers would get access to the database.
• D.The Message Screening pattern can be applied so that messages sent to the utility service are inspected at runtime.

A security architecture needs to be created in order to guarantee that messages that are sent to Service A must comply to a security policy that is published as part of Service A's service contract. The application of which of the following patterns will fulfill this requirement?

• A.Message Screening
• B.Exception Shielding
• C.None of the above
• D.Brokered Authentication