申込直後から学習を始めたい方のために、Fast2testのS90.20問題集は即時ダウンロードに対応しています。SOA Security Labの30問を購入後すぐに確認できるため、試験日が近い時期でも無駄なく準備できます。

S90.20試験対策に選べる3つの学習形式

• PDF版：印刷して持ち運べる形式で、専門家が作成した内容をすぐにダウンロードして確認できます。学習場所を選ばず、365日間の無料更新と無料PDFサンプルに対応しています。
• Desktop Test Engine：インストールして使用するソフトウェアで、実際の試験環境を再現した2つの練習モードを利用できます。オフライン学習に対応し、Windowsで動作します。
• Online Test Engine：ブラウザーからすぐにアクセスでき、学習履歴と成績を確認できます。Windows、Mac、Android、iOSで利用できます。

Fast2testの安心な購入・利用サポート

• McAfeeのセキュリティサービスにより、お客様の情報を安全に取り扱います。
• ご購入後365日間は無料で更新版をご利用いただけます。更新期間の終了後も、50%割引で継続更新が可能です。
• ご入金確認後はすぐにダウンロードでき、通常1分以内にメールでもお届けします。2時間経っても届かない場合は、カスタマーサポートへご連絡ください。
• インストール可能なパソコン台数に制限はありません。

SOA Security Labの試験情報

SOA S90.20 試験概要:

S90.20試験の出題範囲

SOA S90.20 試験シラバストピック:

SOA Security Labに関する受験前Q&A

SOA Security Lab 認定 S90.20 試験問題：

問題 #1

Service Consumer A sends a request message with a Username token to Service A (1).
Service B authenticates the request by verifying the security credentials from the Username token with a shared identity store (2). To process Service Consumer A's request message, Service A must use Services B, C, and D.
Each of these three services also requires the Username token (3. 6, 9) in order to authenticate Service Consumer A by using the same shared identity store (4, 7, 10). Upon each successful authentication, each of the three services (B, C, and D) issues a response message back to Service A (5, 8, 11).
Upon receiving and processing the data in all three response messages, Service A sends its own response message to Service Consumer A (12).

You are asked to redesign this service composition architecture so that it can still carry out the described message exchanges while requiring that Service Consumer A only be authenticated once using the identity store.
Which of the following statements describes an accurate solution?

A. The Direct Authentication pattern is applied together with an authentication process that uses digital certificates and digital signatures instead of Username tokens. The digital certificate of Service Consumer A is attached to all subsequent request messages issued by Services A, B, C and D and these request messages are further signed by a private key.
B. A single sign-on mechanism is implemented. The Brokered Authentication pattern is applied, resulting in Service A becoming the authentication broker. The authentication broker authenticates the security credentials received from Service Consumer A against the identity store. After successful authentication, the authentication broker issues a signed SAML token for Service Consumer A.
The SAML token is subsequently provided to Services B.C. and D by Service A, on behalf of Service Consumer A.
C. A single sign-on mechanism is implemented. The Brokered Authentication pattern is applied together with the Data Origin Authentication pattern. A separate authentication broker utility service is added in between Service Consumer A and Service A.
This requires that Service A send its Username token only once to Service B.
Service B then acts as a secondary authentication broker and authenticates Service Consumer A and Service A using the identity store. If the authentication is successful, Service B generates a shared secret key to be used as a session key during communication with Services C and D.
Because the session key is only known by these services, it can be used authenticates the services to each other.
D. A single sign-on mechanism is implemented. The Brokered Authentication pattern is applied together with the Data Origin Authentication pattern. Service A is redesigned to use holder-of-key based subject confirmation SAML assertions. This way, Service A only needs to send its Username token once to Service B.
Service B then acts as the authentication broker by issuing a SAML token to Service A and then further sends the SAML token to Services C and D on behalf of Service Consumer A and Service A.
Service B signs the SAML assertion in order to ensure its authenticity and integrity during message exchanges with Services C and D.

問題 #2

Service A provides a data retrieval capability that can be used by a range of service consumers, including Service Consumer A, In order to retrieve the necessary data. Service Consumer A first sends a request message to Service A (1). Service A then exchanges request and response messages with Service B (2, 3). Service C (4, 5), and Service D (6.
7). After receiving all three response messages from Services B.
C. and D, Service A assembles the collected data into a response message that it returns to Service Consumer A (8).

The Service A data retrieval capability has been suffering from poor performance, which has reduced its usefulness to Service Consumer A.
Upon studying the service composition architecture, it is determined that the performance problem can be partially attributed to redundant validation by service contracts for compliance to security policies. Services B and C have service contracts that contain the same two security policies. And, Service D has a service contract that contains a security policy that is also part of Service A's service contract.
What changes can be made to the service contracts in order to improve the performance of the service composition while preserving the security policy compliance requirements?

A. Apply the Policy Centralization pattern in order to establish a single security policy for the entire service composition. The redundant policies residing in the service contracts of Services A.
B, C and D need to be removed and grouped together into one master policy definition enforced by Service A.
This way, redundant policy validation is eliminated, thereby improving runtime performance.
B. Apply the Standardized Service Contract principle in order to remove redundancy within service contracts by ensuring that all four service contracts comply with the same policy standards. This further requires the application of the Service Abstraction principle to guarantee that policy definitions are sufficiently streamlined for performance reasons.
C. Apply the Policy Centralization pattern in order to establish two centralized policy definitions and ensure that policy enforcement logic is correspondingly centralized. The first policy definition includes the redundant security policies from Services A and D and the second policy definition contains the redundant security policies from Services B and C.
D. All policies are analyzed for similarities, which are then extracted and, by applying the Policy Centralization pattern, combined into a single policy definition. This "meta-policy" is then positioned to perform validation of the response message generated by Service A, prior to receipt by Service Consumer A.
If validation fails, an alternative error message is sent to Service Consumer A instead.

問題 #3

Service Consumer A sends a request message to Service A (1), after which Service A sends a request message to Service B (2). Service B forwards the message to have its contents calculated by Service C (3). After receiving the results of the calculations via a response message from Service C (4), Service B then requests additional data by sending a request message to Service D (5). Service D retrieves the necessary data from Database A (6), formats it into an XML document, and sends the response message containing the XML-formatted data to Service B (7).
Service B appends this XML document with the calculation results received from Service C, and then records the entire contents of the XML document into Database B (8). Finally, Service B sends a response message to Service A (9) and Service A sends a response message to Service Consumer A (10).

Services A, B and D are agnostic services that belong to Organization A and are also being reused in other service compositions. Service C is a publicly accessible calculation service that resides outside of the organizational boundary. Database A is a shared database used by other systems within Organization A and Database B is dedicated to exclusive access by Service B.
Service B has recently been experiencing a large increase in the volume of incoming request messages. It has been determined that most of these request messages were auto-generated and not legitimate. As a result, there is a strong suspicion that the request messages originated from an attacker attempting to carry out denial-of-service attacks on Service B.
Additionally, several of the response messages that have been sent to Service A from Service B contained URI references to external XML schemas that would need to be downloaded in order to parse the message data. It has been confirmed that these external URI references originated with data sent to Service B by Service C.
The XML parser currently being used by Service A is configured to download any required XML schemas by default. This configuration cannot be changed.
What steps can be taken to improve the service composition architecture in order to avoid future denial-of-service attacks against Service B and to further protect Service A from data access-oriented attacks?

A. Apply the Service Perimeter Guard pattern to establish a perimeter service between Service B and Service C.
Apply the Brokered Authentication pattern by turning the perimeter service into an authentication broker that is capable of ensuring that only legitimate response messages are being sent to Service C from Service B Further apply the Data Origin Authentication pattern to enable the perimeter service to verify that messages that claim to have been sent by Service C actually originated from Service C.
Apply the Message Screening pattern to add logic to the perimeter service to also verify that URIs in request messages are validated against a list of permitted URIs from where XML schema downloads have been pre-approved.
B. Apply the Service Perimeter Guard pattern and the Message Screening pattern together to establish a service perimeter guard that can filter response messages from Service C before they reach Services A and B.
The filtering rules are based on the IP address of Service C.
If a request message originates from an IP address not listed as one of the IP addresses associated with Service C.
then the response message is rejected.
C. Apply the Data Origin Authentication pattern so that Service B can verify that request messages that claim to have been sent by Service A actually did originate from Service A.
Apply the Message Screening pattern to add logic to Service A so that it can verify that external URIs in response messages from Service B refer to trusted sources.
D. Apply the Direct Authentication pattern so that Service C is required to provide security credentials, such as Username tokens, with any response messages it sends to Service B.
Furthermore, add logic to Service A so that it can validate security credentials passed to it via response messages from Service B.
by using an identity store that is shared by Services A and B.

解説：