SOA S90.18 問題集

質問 1：
Responses issued by Certificate Revocation Lists (CRLs) and Online Certificate Status
Protocol (OCSP) services need to be ___________ and ___________ so that it can be
determined whether these responses were sent by a trusted certificate authority or a
malicious program pretending to be a certificate authority.
A. encrypted, verified
B. signed, decrypted
C. encrypted, decrypted
D. signed, verified
正解：D

質問 2：
A project team is planning to create a secure service composition that consists of services
from two different domain service inventories. The security mechanisms for each service
inventory are based on different vendor technologies that adhere to the same industry
standards and the same design standards. What is wrong with this service composition
architecture?
A. Security mechanisms have a fixed limitation that prevents their usage across service
inventory boundaries.
B. Because different vendor security technologies were used, services from different
domain service inventories will be using incompatible security credentials.
C. Vendor technologies do not adhere to industry standards. Only industry technologies
adhere to industry standards.
D. None of the above
正解：D

質問 3：
Service A hashes a message, resulting in message digest X.
Service A encrypts the
message digest X with its private key, resulting ir ciphertext X1. Service A sends the
message and X1 to Service B.
Service B hashes the message, resulting in message digest
Y. Service B decrypts X1 with Service A's public key, recovering message digest X.
Service B compares Y with X and finds them to be equal. This proves that:
A. only Service A sent this particular message
B. the message was not altered
C. public key cryptography was used
D. All of the above
正解：D

質問 4：
You are required to design an authorization mechanism for a REST service. The service
provides functionality by providing access to different resources, some of which are local to
the service while others are located on remote servers. You are required to restrict access
to the service based on which resource is requested and which HTTP method has been
specified by the service consumer. By doing so, which combination of action control rules
needs to be used?
A. identity and environment
B. action and identity
C. environment and resource
D. resource and action
正解：D

質問 5：
The owner of a service inventory reports that the public key related to a certain private key
has been lost. There is a concern that this was the result of a security breach. A security
specialist recommends contacting the certificate authority in order to add the corresponding
certificate to the certificate authority's Certificate Revocation List (CRL). However, the
certificate authority responds by indicating that this is not necessary. Which of the following
answers explains this response?
A. Public keys cannot get lost because they are already publically available.
B. The certificate authority requires that the existing public key needs to be changed within
the existing certificate.
C. The certificate authority needs to issue a new public key instead.
D. None of the above
正解：A

質問 6：
The messages exchanged between two services are kept confidential by using symmetric
encryption. The security specialist is quite strict about making sure that no attacker is able
to intercept and decipher messages sent between these two services. As a result, periodic
audits are conducted in order to ensure that shared keys are always kept confidential. A
single shared key has been in use for quite some time now. The security specialist was
confident that all keys were well guarded, but just recently their security was compromised.
How is this possible given that the shared key was never lost?
A. Because the same shared key was used for a long time, attackers were able to obtain
the key by comparing messages sent between the two services.
B. Symmetric encryption is not intended for long-term use. It needs to be replaced with
asymmetric encryption after some time.
C. The attackers somehow figured out which encryption algorithm was used. As a result,
they were able to decipher the messages.
D. The shared key was decoded by the attackers using algorithms from related private
keys used during prior message exchanges.
正解：A

質問 7：
The manager of an IT department decides to split up an existing enterprise service
inventory into two domain service inventories. The public key used previously in the
enterprise service inventory can continue to be used in one of the domain service
inventories.
A. False
B. True
正解：B