The SOA Security Lab certification has a strong reputation for a reason — the S90.20 exam tests applied skills, not memorized definitions. Candidates around the world use Actual4Exams practice questions to close knowledge gaps before test day.

SOA S90.20 Exam Overview:

Certification Vendor:	Arcitura Education (SOA School)
Exam Name:	SOA Security Lab S90.20
Exam Number:	S90.20
Related Certifications:	SOA Security Specialist
Exam Duration:	120 minutes
Exam Format:	Scenario-based Assessment, Practical Lab Exam
Available Languages:	English
Sample Questions:
Exam Way:	Online proctored lab-based exam
Pre Condition:	Recommended: completion of SOA Security Specialist training or equivalent knowledge of SOA concepts and web service security.

SOA S90.20 Exam Syllabus Topics:

Common Questions About the SOA S90.20 Exam

SOA Security Lab Sample Questions:

Question 1

Service Consumer A sends a request to Service A (1). Service A replies with an acknowledgement message (2) and then processes the request and sends a request message to Service B (3). This message contains confidential financial data. Service B sends three different request messages together with its security credentials to Services C, D, and E (4, 5, 6). Upon successful authentication, Services C, D, and E store the data from the message in separate databases (7, 8, 9) Services B, C, D, and E belong to Service Inventory A, which further belongs to Organization B.
Service Consumer A and Service A belong to Organization A.

The service contracts of Services A and B both comply with the same XML schema.
However, each organization employs different security technologies for their service architectures. To protect the confidential financial data sent by Service A to Service B, each organization decides to independently apply the Data Confidentiality and the Data Origin Authentication patterns to establish message-layer security for external message exchanges. However, when an encrypted and digitally signed test message is sent by Service A to Service B, Service B was unable to decrypt the message.
Which of the following statements describes a solution that solves this problem?

A. Although both of the organizations successfully applied the Data Confidentiality and the Data Origin Authentication patterns, the order in which the patterns were applied is incorrect. The application of the Data Origin Authentication pattern must always follow the application of the Data Confidentiality pattern to ensure that the message confidentiality from a third party authenticates the origin of the message.
B. Although both of the organizations applied the Data Confidentiality and the Data Origin Authentication patterns, the security technologies used for the Service A and Service B architectures may be incompatible. Because there are several technologies and versions of technologies that can be used to apply these patterns, the organizations need to standardize implementation level details of the relevant security technologies.
C. The problem with the test message occurred because Service A used incorrect keys to protect the message sent to Service B.
Service A used its own public key to sign the message and then used Service B's public key to encrypt the message content. To correct the problem, Service A must use WS-SecureConversation to agree on a secret session key to be used to encrypt messages exchanged between Services A and B.
Because this session key is only known by Services A and B, encrypting the messages with this key also provides authentication of the origin of the data.
D. The problem with the test message occurred because Service A needed the private key of Service B to digitally sign the message. An attacker pretending to be Service B likely sent a fake private/public keys pair to Service A.
Using these fake keys to encrypt and digitally sign the message made the message incompatible for Service B.
Because the fake private key was also used to sign the hash, it explains the source of the problem.

Question 2

A. Apply the Service Perimeter Guard pattern to establish a perimeter service that can perform security functions on behalf of Service A.
Next, apply the Data Confidentiality pattern so that the security credential information provided by Service Consumer A with the request message is encrypted with the secret key shared between the perimeter service and Service Consumer A.
The perimeter service evaluates the credentials and if successfully authenticated, forwards the request message to Service A.
Transport-layer security is used to protect message exchanges between Service A and Service Consumer
B.
C. Apply the Service Perimeter Guard pattern together with the Trusted Subsystem pattern to establish a perimeter service that can perform security functions on behalf of Service A.
The utility service can verify the validity of the request messages from Service Consumer A by authenticating the request message against an identity store. If the request message is authenticated, the utility service then sends it to Service A for further processing. All communications between Service A and Service Consumer A can be encrypted using the public key of the intended recipient, and signed using the private key of the sender.
Industry standards that can be used for this solution are XML-Encryption, XML-Signature, and WS-Trust.
D. Apply the Trusted Subsystem pattern together with the Data Origin Authentication pattern in order to establish a utility service that performs the security processing on behalf of Service A.
Service Consumer A must digitally sign all request messages and encrypt the credential information using the public key of the utility service. The utility service can then verify the security credentials and the digital signature to establish the validity of the request message. If the request message is permitted, the utility service establishes a composite trust domain that encompasses Service Consumer A, Service A, Database A, and the legacy system. Because all communications remain within a single trust domain, malicious intermediaries will not be able to gain access to any exchanged data.
E. Apply the Data Origin Authentication pattern together with the Data Confidentiality pattern in order to establish message-layer security that guarantees the confidentiality and integrity of messages exchanged by Service Consumer A and Service A.
Further, a security policy can be created to require that security credentials submitted to Service A must be digitally signed and encrypted and also contain a timestamp to validate the actual time the request was issued. Industry standards that can be used for this solution are WS- Policy, WS-SecurityPolicy, XML-Encryption, and XML-Signature.

Question 3

Service Consumer A sends a request message to Service A (1), after which Service A sends a request message to Service B (2). Service B forwards the message to have its contents calculated by Service C (3). After receiving the results of the calculations via a response message from Service C (4), Service B then requests additional data by sending a request message to Service D (5). Service D retrieves the necessary data from Database A (6), formats it into an XML document, and sends the response message containing the XML-formatted data to Service B (7).
Service B appends this XML document with the calculation results received from Service C, and then records the entire contents of the XML document into Database B (8). Finally, Service B sends a response message to Service A (9) and Service A sends a response message to Service Consumer A (10).

Services A, B and D are agnostic services that belong to Organization A and are also being reused in other service compositions. Service C is a publicly accessible calculation service that resides outside of the organizational boundary. Database A is a shared database used by other systems within Organization A and Database B is dedicated to exclusive access by Service B.
Service B has recently been experiencing a large increase in the volume of incoming request messages. It has been determined that most of these request messages were auto-generated and not legitimate. As a result, there is a strong suspicion that the request messages originated from an attacker attempting to carry out denial-of-service attacks on Service B.
Additionally, several of the response messages that have been sent to Service A from Service B contained URI references to external XML schemas that would need to be downloaded in order to parse the message data. It has been confirmed that these external URI references originated with data sent to Service B by Service C.
The XML parser currently being used by Service A is configured to download any required XML schemas by default. This configuration cannot be changed.
What steps can be taken to improve the service composition architecture in order to avoid future denial-of-service attacks against Service B and to further protect Service A from data access-oriented attacks?

A. Apply the Data Origin Authentication pattern so that Service B can verify that request messages that claim to have been sent by Service A actually did originate from Service A.
Apply the Message Screening pattern to add logic to Service A so that it can verify that external URIs in response messages from Service B refer to trusted sources.
B. Apply the Service Perimeter Guard pattern to establish a perimeter service between Service B and Service C.
Apply the Brokered Authentication pattern by turning the perimeter service into an authentication broker that is capable of ensuring that only legitimate response messages are being sent to Service C from Service B Further apply the Data Origin Authentication pattern to enable the perimeter service to verify that messages that claim to have been sent by Service C actually originated from Service C.
Apply the Message Screening pattern to add logic to the perimeter service to also verify that URIs in request messages are validated against a list of permitted URIs from where XML schema downloads have been pre-approved.
C. Apply the Service Perimeter Guard pattern and the Message Screening pattern together to establish a service perimeter guard that can filter response messages from Service C before they reach Services A and B.
The filtering rules are based on the IP address of Service C.
If a request message originates from an IP address not listed as one of the IP addresses associated with Service C.
then the response message is rejected.
D. Apply the Direct Authentication pattern so that Service C is required to provide security credentials, such as Username tokens, with any response messages it sends to Service B.
Furthermore, add logic to Service A so that it can validate security credentials passed to it via response messages from Service B.
by using an identity store that is shared by Services A and B.

Solutions: