Some candidates like to print, others prefer software, and many study on a phone. That is why Fast2test offers the S90.18 practice questions as a printable PDF, a desktop test engine that simulates the real exam environment, and an online test engine that runs in any browser — pick whichever fits the way you prepare for the SOA Fundamental SOA Security.

SOA S90.18 Exam Overview:

SOA S90.18 Exam Syllabus Topics:

SOA S90.18 Exam — Your Questions, Answered

SOA Fundamental SOA Security Sample Questions:

Question 1

The manager of an IT department decides to split up an existing enterprise service
inventory into two domain service inventories. The public key used previously in the
enterprise service inventory can continue to be used in one of the domain service
inventories.

A. False
B. True

Question 2

Service A and Service B belong to Organization A and Service C belongs to Organization
B. Service A sends confidential messages to Service B, which forwards these messages to
Service C.
The message sent to Service C is intercepted by a load balancing service agent
that determines which instance of Service C to route the message to. This entire message
path needs to be encrypted in order to ensure message confidentiality from when the
message is first sent by Service A until it is received by an instance of Service C.
Organization A doesn't trust any intermediaries that may exist in between Service B and
Service C and also doesn't want to share any keys with Organization B.
Furthermore, there is a requirement to minimize any adverse effects on performance. Which of the following
approaches fulfills these requirements?

A. Use transport-layer security between Service B and Service C and use message-layer
security via asymmetric encryption between Service A and Service B.
This way. all the services are secured while at the same time minimizing the performance degradation
between Service B and Service C.
B. This way, message content is not available to any intermediaries between Services B
and C.
C. None of the above.
D. Use message-layer security by adding symmetric encryption between Services A, B and
E. Because Service A and Service B exist within the same organizational boundary, use
transport-layer security to provide message confidentiality. Use message-layer security via
asymmetric encryption between Service B and Service C.

Question 3

The application of the Service Composability principle can be supported by the application
of the Brokered Authentication pattern.

A. False
B. True

Question 4

Service A is owned by Organization A.
Service A sends a message containing confidential
data to Service B, which is owned by Organization B.
Service B sends the message to
Service C, which is also owned by Organization B.
Organization A trusts Organization B,
which means there is no requirement to protect messages from intermediaries and after a
message is received by Service B (and as long as the message remains within the
boundary of Organization B), there is no requirement to keep the message data
confidential. Which of the following approaches will fulfill these security requirements with
the least amount of performance degradation?

A. An authentication broker is introduced between Service A and Service B.
B. The communication channel between Service A and Service B is encrypted using a
transport-layer security technology.
C. SAML security tokens are used so that Service B can authenticate Service A.
D. Messages exchanged between Service A and Service B are encrypted using XML-
Encryption.

Question 5

The Brokered Authentication pattern needs to be used in conjunction with the Data
Confidentiality and Data Origin Authentication patterns in order to ensure that claims held
in security tokens remain secure and that the security tokens are actually issued by a valid
authentication broker. What is wrong with this statement?

A. There is nothing wrong with this statement.
B. The Brokered Authentication pattern, the Data Origin Authentication pattern and the
Data Confidentiality pattern cannot be used together.
C. The statement is correct if the Brokered Authentication pattern is substituted for the
Direct Authentication pattern.
D. Only the Brokered Authentication pattern and the Data Confidentiality pattern need to be
applied together in order to ensure that claims held in security tokens remain secure.

Solutions: