Free S90.19 Exam Braindumps
Advanced SOA Security Questions 31–35 (page: 8)

Service A contains reporting logic that issues SOL queries against a database to generate reports. The actual SQL query syntax is determined at runtime. It has been reported that some of these queries ended up retrieving highly confidential data by accessing tables that service consumers were not authorized for. How can this be avoided?

The same security policy has been redundantly implemented as part of the service contracts for Web services A, B and C. In order to reduce the effort of maintaining multiple redundant service policies, it has been decided to centralize policy enforcement across these three services.
Which of the following industry standards will need to be used for Web services A, B and C in order for their service contracts to share the same security policy document?

Service A requires message confidentiality using message-layer security. You are asked to create a security policy for Service A that communicates its confidentiality requirements. However, you have not yet determined the type of encryption mechanism that will be used to enable message confidentiality.
What types of binding assertions can you use to convey what service consumers should expect in the WS-Security header of SOAP messages exchanged by the service?

The application of the Service Perimeter Guard pattern establishes a perimeter service that hides internal services from unauthorized external service consumers. However, the perimeter service grants authorized external services direct access to internal services.

Within a service composition, two Web services are using certificates in order to ensure message integrity and sender's authenticity. The certificates are included with every message exchange. Recently, the performance of these message exchanges has degraded. How can the performance be improved without compromising message integrity and message authenticity?