SOA S90.18 問題集

質問 1：
The Data Origin Authentication pattern is applied to services throughout a service
inventory. As a result, if malicious service intermediaries change data within messages
exchanged by these services, such changes will be detected.
A. False
B. True
正解：B

質問 2：
Service A is an agnostic service that currently uses message-layer security implemented
by symmetric encryption. However, because Service A has recently been successfully
attacked, it has been decided that asymmetric encryption needs to be used instead. The
nature of the messages exchanged by Service A requires that only some parts of the
message data need to be encrypted. Although it is agreed that asymmetric encryption is
required, architects are concerned that it will adversely affect the service's runtime
performance. Which of the following approaches will fulfill these security requirements with
the least amount of performance degradation?
A. Only the required parts of the message need to be encrypted instead of encrypting the
entire message.
B. Certificates need to be issued by a registered certificate authority.
C. The Direct Authentication pattern needs to be applied so that no intermediary is involved
between Service A and its service consumers.
D. An authentication broker needs to be introduced with a dedicated identity store.
正解：A

質問 3：
Digital signatures use encryption and hashing.
A. False
B. True
正解：B

質問 4：
The communication between Service A and Service B needs to be kept private. A security
specialist is planning to implement secret key cryptography in order to encrypt the
messages. Which of the following approaches addresses this requirement?
A. Create a shared key that will be used by both the services for message encryption and
decryption.
B. Both the services need to be built with support for the XML-Signature industry standard.
C. None of the above.
D. The Data Origin Authentication pattern needs to be applied across both service
architectures.
正解：A

質問 5：
Service A hashes a message, resulting in message digest X.
Service A encrypts message
digest X with its private key, resulting in cipher text X1.
Service A sends the message and
X1 to Service B.
Service B hashes the message, resulting in message digest Y.
Service B
decrypts X1 with Service A's public key, recovering message digest X1.
Service B
compares X and Y and finds them not to be equal. This proves that;
A. the message was altered
B. only Service A sent this particular message
C. public key cryptography was used
D. All of the above
正解：D

質問 6：
SAML can be used for the application of the Brokered Authentication pattern.
A. False
B. True
正解：B

質問 7：
Username and X.509 token profiles can be combined so that a single message can contain
a username token that is digitally signed.
A. False
B. True
正解：B