問題1
A malicious active intermediary intercepts a message sent between two services. What concerns are raised by such an attack?
A malicious active intermediary intercepts a message sent between two services. What concerns are raised by such an attack?
正確答案: C
問題2
The use of parameterized expressions can help avoid which type of attack?
The use of parameterized expressions can help avoid which type of attack?
正確答案: D
問題3
A denial of service attack can be the byproduct of an insufficient authorization attack.
A denial of service attack can be the byproduct of an insufficient authorization attack.
正確答案: B
問題4
___________ is an industry standard that describes mechanisms for issuing, validating, renewing and cancelling security tokens.
___________ is an industry standard that describes mechanisms for issuing, validating, renewing and cancelling security tokens.
正確答案: A
問題5
Within a service composition, two Web services are using certificates in order to ensure message integrity and sender's authenticity. The certificates are included with every message exchange. Recently, the performance of these message exchanges has degraded. How can the performance be improved without compromising message integrity and message authenticity?
Within a service composition, two Web services are using certificates in order to ensure message integrity and sender's authenticity. The certificates are included with every message exchange. Recently, the performance of these message exchanges has degraded. How can the performance be improved without compromising message integrity and message authenticity?
正確答案: C
問題6
How can the use of pre-compiled XPath expressions help avoid attacks?
How can the use of pre-compiled XPath expressions help avoid attacks?
正確答案: D
問題7
Service A retrieves data from third-party services that reside outside the organizational boundary. The quality of the data provided by these third-party services is not guaranteed.
Service A contains exception shielding logic that checks all outgoing messages. It is discovered that service consumers are still sometimes receiving malicious content from Service A.
Because digital signatures are being used, it is confirmed that Service A is, in fact, the sender of these messages and that the messages are not being altered by any intermediaries. Why do messages from Service A continue to contain malicious content?
Service A retrieves data from third-party services that reside outside the organizational boundary. The quality of the data provided by these third-party services is not guaranteed.
Service A contains exception shielding logic that checks all outgoing messages. It is discovered that service consumers are still sometimes receiving malicious content from Service A.
Because digital signatures are being used, it is confirmed that Service A is, in fact, the sender of these messages and that the messages are not being altered by any intermediaries. Why do messages from Service A continue to contain malicious content?
正確答案: A
問題8
Service A expresses its requirement for message-layer security to service consumers via a security policy. Since the launch of Service A, its popularity has grown and it is decided that a fee should be charged for its use. Consequently, the design of Service A is changed so that it is capable of keeping a log of all request messages received from service consumers. The fact that Service A is logging all incoming messages is something that can also be expressed via a policy.
Service A expresses its requirement for message-layer security to service consumers via a security policy. Since the launch of Service A, its popularity has grown and it is decided that a fee should be charged for its use. Consequently, the design of Service A is changed so that it is capable of keeping a log of all request messages received from service consumers. The fact that Service A is logging all incoming messages is something that can also be expressed via a policy.
正確答案: B
問題9
Service A is a Web service that accesses the Student table in a shared database in order to store XML-based student records. When invoked, the GetStudent operation of Service A uses a StudentID value to retrieve the record of a single student by executing an XPath query. An attacker sends a malicious message that manipulates the XPath query to return all the student records. Which of the following attacks was carried out?
Service A is a Web service that accesses the Student table in a shared database in order to store XML-based student records. When invoked, the GetStudent operation of Service A uses a StudentID value to retrieve the record of a single student by executing an XPath query. An attacker sends a malicious message that manipulates the XPath query to return all the student records. Which of the following attacks was carried out?
正確答案: C