SOA S90.20 : SOA Security Lab

Wer die echte Prüfungsatmosphäre bereits kennt, geht spürbar ruhiger in die S90.20 Prüfung. Der Test Engine von Zertpruefung simuliert den Ablauf der SOA Security Lab Prüfung und lässt Sie die 30 Übungsfragen unter realistischen Bedingungen trainieren.

SOA S90.20 Prüfungsthemen:

Alles Wissenswerte zur S90.20 Prüfung im Überblick

Welche Zertifizierung erwerbe ich mit der S90.20 Prüfung?

Die S90.20 Prüfung ist die offizielle Zertifizierungsprüfung von SOA für die SOA Security Lab Zertifizierung. Wer sie besteht, erwirbt die Zertifizierung „SOA Certification“. Sie ist der Stufe Spezialist zugeordnet. Zudem steht sie im Zusammenhang mit weiteren Zertifizierungen: Certified SOA Security Specialist. Mit den 30 Übungsfragen von Zertpruefung bereiten Sie sich gezielt auf alle Inhalte dieser Prüfung vor.

Wie viele Fragen umfasst die S90.20 Prüfung und wie viel Zeit habe ich?

Die S90.20 Prüfung umfasst 30 Fragen, für die Sie 60 Minuten zur Verfügung haben. Pro Frage bleibt Ihnen damit nur ein begrenztes Zeitfenster – schwierige Aufgaben sollten Sie daher zunächst markieren und später erneut bearbeiten, statt zu lange an einer einzelnen Frage zu hängen. Trainieren Sie dieses Zeitmanagement vorab mit einem zeitlich begrenzten Übungstest der 30 Übungsfragen von Zertpruefung, damit Sie am Prüfungstag nicht unter Druck geraten.

Welche Punktzahl brauche ich zum Bestehen der S90.20 Prüfung und was kostet die Anmeldung?

Zum Bestehen der S90.20 Prüfung benötigen Sie laut SOA Nicht offiziell veröffentlicht. Die offizielle Prüfungsgebühr beträgt Offizielle Preise variieren je nach Region und Prüfungsanbieter – bei einer Wiederholungsprüfung fällt diese Summe erneut in voller Höhe an, weshalb sich eine gründliche Vorbereitung doppelt lohnt. Testen Sie Ihren Wissensstand deshalb vor der Anmeldung mit den 30 Übungsfragen von Zertpruefung, um realistisch einzuschätzen, ob Sie die geforderte Leistung bereits abrufen können.

Welche Voraussetzungen muss ich für die S90.20 Prüfung erfüllen?

Für die SOA Security Lab Prüfung gilt: Keine formellen Teilnahmevoraussetzungen; Grundkenntnisse zu SOA-Konzepten sowie fortgeschrittene Grundlagen im Bereich Sicherheit werden empfohlen Da SOA die Anforderungen gelegentlich anpasst, bestätigen Sie die aktuellen Details bitte vor Ihrer Anmeldung auf der offiziellen Prüfungsseite von SOA.

Kann ich die S90.20 Unterlagen vor dem Kauf kostenlos testen?

Ja. Auf Zertpruefung steht Ihnen eine kostenlose PDF-Demo der SOA Security Lab Übungsfragen zur Verfügung, sodass Sie Qualität und Stil der Fragen vor dem Kauf in Ruhe prüfen können. Nach dem Kauf erhalten Sie 365 Tage lang kostenlose Updates; möchten Sie den Update-Service danach fortsetzen, gewähren wir Ihnen 50 % Rabatt auf die Verlängerung.

Was passiert, wenn ich die S90.20 Prüfung nicht bestehe – und wie erhalte ich mein Produkt?

Sollten Sie die zugehörige Prüfung innerhalb von 60 Tagen nach dem Kauf nicht bestehen, können Sie eine vollständige Rückerstattung beantragen. Reichen Sie dazu innerhalb von zwei Tagen nach dem Prüfungstermin eine Kopie Ihrer Anmeldebestätigung (Enrollment Slip) sowie das offizielle Ergebnisprotokoll (Score Report) als PDF ein – Ihr Antrag wird anschließend innerhalb von 7 Tagen bearbeitet. Beachten Sie, dass die Erstattung nur für die entsprechende Prüfung gilt: Ein Nichtbestehen innerhalb der ersten drei Tage nach dem Kauf, reine Downloads ohne Prüfungsteilnahme, kostenlose Materialien und abgelaufene Bestellungen sind ausgeschlossen, und der Name des Prüfungsteilnehmers muss mit dem Käufernamen übereinstimmen. Alternativ zur Rückerstattung können Sie Ihr Produkt kostenlos gegen zwei gleichwertige Prüfungsunterlagen eintauschen und behalten dabei den Update-Service für Ihr ursprüngliches Produkt. Die Lieferung erfolgt sofort nach der Zahlung: Sie laden Ihre Unterlagen direkt herunter, zusätzlich erreicht Sie der Download-Link innerhalb einer Minute per E-Mail. Sollte nach zwei Stunden keine E-Mail eingegangen sein, wenden Sie sich bitte an unseren Kundenservice. Eine Begrenzung der Anzahl der Installationen gibt es nicht.

Welche Themen werden in der S90.20 Prüfung abgefragt?

Die S90.20 Prüfung gliedert sich in 5 Themenschwerpunkte. Zu den zentralen Bereichen gehören:

• Technische Grundlagen von Microservices
• Grundlegende Sicherheitsaspekte für Dienste, Microservices und SOA
• Grundlagen von SOA, Diensten und Microservices

Die vollständige Übersicht aller Themen und Gewichtungen finden Sie weiter oben auf dieser Seite im Abschnitt zur Prüfungsgliederung.

SOA Security Lab S90.20 Prüfungsfragen mit Lösungen

Frage #1
Service Consumer A submits a request message with security credentials to Service A (1).
The identity store that Service A needs to use in order to authenticate the security credentials can only be accessed via a legacy system that resides in a different service inventory. Therefore, to authenticate Service Consumer A, Service A must first forward the security credentials to the legacy system (2). The legacy system then returns the requested identity to Service A (3). Service A authenticates Service Consumer A against the identity received from the legacy system. If the authentication is successful, Service A retrieves the requested data from Database A (4), and returns the data in a response message sent back to Service Consumer A (5).
Service A belongs to Service Inventory A which further belongs to Security Domain A and the legacy system belongs to Service Inventory B which further belongs to Security Domain
B. (The legacy system is encapsulated by other services within Service Inventory B, which are not shown in the diagram.) These two security domains trust each other.
Communication between Service A and the legacy system is kept confidential using transport-layer security.

No intermediary service agents currently exist between the two service inventories.
However, it has been announced that due to the introduction of new systems, some intermediary service agents may be implemented in the near future. Additionally, the legacy system has been scheduled for retirement and will be replaced by a new identity management system that will provide a new identity store. Because the new identity store will need to serve many different systems, there are concerns that it could become a performance bottleneck. As a result, services (including Service A and other services in Security Domains A and B) will not be allowed to directly access the new identity store.
Which of the following statements describes a solution that can accommodate the requirements of the new identity store, the authentication requirements of Service A, and can further ensure that message exchanges between Security Domains A and B remain confidential after intermediary service agents are introduced?

A. Apply the Trusted Subsystem pattern by abstracting away the new identity management system using a utility service that authenticates the request from Service A and then uses its own credentials to retrieve the requested identity from the new identity management system. For the utility service to authenticate Service As request, it needs to be provisioned with a new identity database that contains identities for all authorized service consumers of the new utility service. In order to secure the communication between Service A and the new utility service, use message-layer security as it provides security over multiple hops considering the need to secure the message in case an intermediary is introduced in future.
B. Replicate the identity database used by the new identity management system. Because the Security Domains A and B trust each other, protection of the identity store is guaranteed. Use Service Agents to monitor changes to the identity database used by the new identity management system and to update the replica. This would satisfy the security needs of Service A, would eliminate the need to request services from Service Inventory B, and ensure that current identity information is available for Service A.
Because Service A would not need to access services across different trust domains, the current transport- layer security is sufficient.
C. Apply the Trusted Subsystem pattern to implement a utility service abstracting the new identity management system. Service A forwards Service Consumer As credentials to the utility service to verify Service Consumer As identity. The utility service authenticates the request originating from Service A.
After successful authentication, the utility service uses its own credentials to retrieve the requested identity, and then send the identity to Service A, Therefore, effectively reducing the processing need of the identity management system.
The current transport-layer security can still be used, in order to secure the communication between Service A and the new utility service, as it more efficient than the message-layer security.
D. Apply the Brokered Authentication pattern to establish an authentication broker. Instead of Service A directly authenticating Service Consumer A, Service Consumer A submits a request message with security credentials to the authentication broker, which authenticates Service Consumer A against the new identity store and then issues a SAML token to Service Consumer A that it can use for message exchanges with other services, if necessary. In order to secure cross-service inventory message exchanges, the Data Confidentiality pattern is applied to establish message-layer security.

Frage #2
Service A provides a customized report generating capability. Due to infrastructure limitations, the number of service consumers permitted to access Service A concurrently is strictly controlled. Service A validates request messages based on the supplied credentials (1). If the authentication of the request message is successful, Service A sends a message to Service B (2) to retrieve the required data from Database A (3). Service A stores the response from Service B (4) in memory and then issues a request message to Service C (5). Service C retrieves a different set of data from Database A (6) and sends the result back to Service A (7). Service A consolidates the data received from Services B and C and sends the generated report in the response message to its service consumer (8).

This service composition was recently shut down after it was discovered that Database A had been successfully attacked twice in a row. The first type of attack consisted of a series of coordinated request messages sent by the same malicious service consumer, with the intention of triggering a range of exception conditions within the database in order to generate various error messages. The second type of attack consisted of a service consumer sending request messages with malicious input with the intention of gaining control over the database server. This attack resulted in the deletion of database records and tables. An investigation revealed that both attacks were carried out by malicious service consumers that were authorized.
How can the service composition security architecture be improved to prevent these types of attacks?

A. Apply the Exception Shielding pattern together with the Message Screening pattern.
This establishes new logic within Service A that screens incoming request messages for data-driven attacks (such as SQL injection and XPath injection attacks), and also evaluates whether exception details returned by Database A contains potentially confidential or unsafe information. Any inappropriate exception information is replaced with sanitized content.
B. Apply the Trusted Subsystem pattern to protect Database A from data-driven attacks and to evaluate whether database responses contain inappropriate data. The trusted subsystem maintains a snapshot of Database A and executes the original service consumer's request message against the snapshot. The processing logic that accesses the snapshot has limited privileges in order to prevent malicious attacks from overtaking the database. If no security violation is detected during the processing of the snapshot, then the original service consumer's request is forwarded to Database A.
If an error message is generated during the processing of the snapshot, then it is returned to the original service consumer and the request is not forwarded to Database A.
Because the error message was generated on the snapshot, it cannot contain unsafe information about Database A.
C. Apply the Data Confidentiality pattern together with the Data Origin Authentication pattern. This establishes message-level security so that all messages are encrypted and digitally signed. Secondly, the Service A logic must be enhanced so that it can keep track of the trustworthiness of its service consumers If a request message originated from a trustworthy service consumer, then the request message is processed as normal. If the request message originates from a non-trustworthy service consumer, then the request message is rejected and an error message is returned to the service consumer.
D. Apply the Service Perimeter Guard pattern together with the Trusted Subsystem pattern.
This establishes a perimeter service between Database A and any service that requires access to it (including Services B and C). The perimeter service evaluates incoming data requests and filters out those that can introduce a security risk. Only request messages issued by authorized services and service consumers are forwarded to Database A.
Responses originating from Database A are further evaluated by the trusted subsystem to remove any unauthorized data. The two patterns together ensure that only authorized data is returned to the service consumer and that no request messages present a security threat to Database A.

Frage #3
Service Consumer A sends a request message with an authentication token to Service A, but before the message reaches Service A, it is intercepted by Service Agent A (1). Service Agent A validates the security credentials and also validates whether the message is compliant with Security Policy A.
If either validation fails, Service Agent A rejects the request message and writes an error log to Database A (2A). If both validations succeed, the request message is sent to Service A (2B).
Service A retrieves additional data from a legacy system (3) and then submits a request message to Service B Before arriving at Service B, the request message is intercepted by Service Agent B (4) which validates its compliance with Security Policy SIB then Service Agent C (5) which validates its compliance with Security Policy B.
If either of these validations fails, an error message is sent back to Service A.
that then forwards it to Service Agent A so that it the error can be logged in Database A (2A). If both validations succeed, the request message is sent to Service B (6). Service B subsequently stores the data from the message in Database B (7).
Service A and Service Agent A reside in Service Inventory A.
Service B and Service Agents B and C reside in Service Inventory B.
Security Policy SIB is used by all services that reside in Service Inventory B.
Service B can also be invoked by other service consumers from Service Inventory B.
Request messages sent by these service consumers must also be compliant with Security Policies SIB and B.

Access to the legacy system in Service Inventory A is currently only possible via Service A, which means messages must be validated for compliance with Security Policy A.
A new requirement has emerged to allow services from Service Inventory B to access the legacy system via a new perimeter service that will be dedicated to processing request messages from services residing in Service Inventory B.
Because the legacy system has no security features, all security processing will need to be carried out by the perimeter service.
However, there are parts of Security Policy A that are specific to Service A and do not apply to the legacy system or the perimeter service. Furthermore, response messages sent by the perimeter service to services from Service Inventory B will still need to be validated for compliance to Security Policy B and Security Policy SIB.
How can the Policy Centralization pattern be correctly applied without compromising the policy compliance requirements of services in both service inventories?

A. A single centralized security policy can be created by combining Security Policy A, Security Policy B.
and Security Policy SIB into a single security policy that is shared by services in both Service Inventory A and Service Inventory B.
This means that the new perimeter service can share the same new security policy with Service A.
This further simplifies message exchange processing because request messages sent by services in Service Inventory B to the new perimeter service need to comply to the same security policy as the response messages sent back by the perimeter service to the services in Service Inventory B.
B. Due to the amount of overlap among Security Policy A, Security Policy B, and Security Policy SIB, the Policy Centralization pattern cannot be correctly applied to enable the described message exchange between the perimeter service in Service Inventory A and services in Service Inventory B.
C. The parts of Security Policy A that are required for access to the new perimeter service need to be removed and placed into a new security policy that is shared by Service A and the perimeter service. Messages sent by services accessing the perimeter service from Service Inventory B will need to be compliant with the new security policy. Because the perimeter service is dedicated to message exchange with services from Service Inventory B, response messages sent by the perimeter service can be designed for compliance to Security Policy B and Security Policy SIB.
D. In order for Security Policy A to be centralized so that it can be shared by Service A and the new perimeter service, messages sent to the perimeter service from services in Service Inventory B will need to continue complying with Security Policy A, even if it requires that the messages contain content that does not relate to accessing the legacy system. In order to centralize Security Policy B it will need to be combined with Security Policy SIB, which means that the functionality within Service Agents B and C can be combined into a single service agent.

Fragen und Antworten: