Arcitura Education S90.18 Exam Questions
Fundamental SOA Security (Page 9 )

The manager of an IT department decides to split up an existing enterprise service inventory into two domain service inventories. The public key used previously in the enterprise service inventory can continue to be used in one of the domain service inventories.

A task service needs to access three entity services as part of a service composition. The task service needs to authenticate itself every time it accesses one of the three entity services. Because the task service must authenticate itself three times to complete its task, the current service composition design is considered inefficient. How can it be improved while continuing to fulfill the authentication requirements?

Service A and Service B belong to Organization A and Service C belongs to Organization B. Service A sends confidential messages to Service B, which forwards these messages to Service C. The message sent to Service C is intercepted by a load balancing service agent that determines which instance of Service C to route the message to. This entire message path needs to be encrypted in order to ensure message confidentiality from when the message is first sent by Service A until it is received by an instance of Service C. Organization A doesn't trust any intermediaries that may exist in between Service B and Service C and also doesn't want to share any keys with Organization B. Furthermore, there is a requirement to minimize any adverse effects on performance.
Which of the following approaches fulfills these requirements?

The owner of a service inventory reports that the public key related to a certain private key has been lost. There is a concern that this was the result of a security breach. A security specialist recommends contacting the certificate authority in order to add the corresponding certificate to the certificate authority's Certificate Revocation List (CRL). However, the certificate authority responds by indicating that this is not necessary.
Which of the following answers explains this response?

A service contract includes a security policy that exposes specific details of the service's underlying implementation. This is an example of the application of which service-orientation principle?