S90.20 試験問題を無料オンラインアクセス

Services A, B, and C reside in Service Inventory A and Services D, E, and F reside in Service Inventory B.
Service B is an authentication broker that issues WS-Trust based SAML tokens to Services A and C upon receiving security credentials from Services A and
C. Service E is an authentication broker that issues WS-Trust based SAML tokens to Services D and F upon receiving security credentials from Services D and E.
Service B uses the Service Inventory A identify store to validate the security credentials of Services A and C.
Service E uses the Service Inventory B identity store to validate the security credentials of Services D and F.

It is decided to use Service E as the sole authentication broker for all services in Service Inventories A and B.
Service B is kept as a secondary authentication broker for load balancing purposes. Specifically, it is to be used for situations where authentication requests are expected to be extra time consuming in order to limit the performance burden on Service E.
Even though Service B has all the necessary functionality to fulfill this new responsibility, only Service E can issue SAML tokens to other services.
How can these architectures be modified to support these new requirements?

• A.Because the federation requirements ask for SAML tokens generated by Service E, Service B cannot function as an authentication broker. To address the load balancing requirement, a new utility service needs to be introduced to provide functionality that is redundant with Service E.
  This essentially establishes a secondary authentication broker to which Service E can defer time-consuming authentication tasks at runtime.
• B.To provide load balancing, a service agent needs to be implemented to intercept all incoming requests to Service E.
  The service agent uses a random distribution of the authentication requests between Service B and Service E.
  Because the request messages are distributed in a random manner, the load between the two authentication brokers is balanced.
• C.Because both Service B and Service E issue SAML tokens, these tokens are interchangeable. In order for both services to receive the same amount of authentication requests, a shared key needs to be provided to them for signing the SAML tokens. By signing the SAML tokens with the same key, the SAML tokens generated by Service B cannot be distinguished from the SAML tokens generated by Service E.
• D.When time consuming authentication requests are identified, Service E can forward them to Service B.
  Upon performing the authentication, Service B sends its own signed SAML token to Service E.
  Because Service E trusts Service B.
  it can use the Service B- specific SAML token to issue an official SAML token that is then sent to the original service consumer (that requested authentication) and further used by other services.

Service Consumer A sends a request message to Service A (1), after which Service A sends a request message with security credentials to Service B (2). Service B authenticates the request and, if the authentication is successful, writes data from the request message into Database B (3). Service B then sends a request message to Service C (4), which is not required to issue a response message. Service B then sends a response message back to Service A (5). After processing Service B's response, Service A sends another request message with security credentials to Service B (6). After successfully authenticating this second request message from Service A, Service B sends a request message to Service D (7). Service D is also not required to issue a response message. Finally, Service B sends a response message to Service A (8), after which Service A records the response message contents in Database A (9) before sending its own response message to Service Consumer A (10).

Services A and B use digital certificates to support message integrity and authentication.
With every message exchange between the two services (2, 5, 6, 8), the digital certificates are used. It has been determined that both Databases A and B are vulnerable to malicious attackers that may try to directly access sensitive data records. Furthermore, performance logs have revealed that the current exchange of digital certificates between Services A and B is unacceptably slow.
How can the integrity and authenticity of messages exchanged between Services A and B be maintained, but with improved runtime performance - and - how can Databases A and B be protected with minimal additional impact on performance?

• A.Apply the Brokered Authentication pattern to establish an authentication broker that uses WS-SecureConversation security context tokens (SCTs) to generate and transmit a symmetric session key. The session key is used to encrypt and digitally sign messages exchanged between Services A and B.
  For each database the Trusted Subsystem pattern is applied to require authenticated access to the database and to prevent attackers from accessing the database directly
• B.Apply the Brokered Authentication pattern to establish an authentication broker that uses WS-Trust based SAML tokens for message exchanges between Services A and B.
  This eliminates the need for Service A to be repeatedly authenticated by Service B.
  Use the public key of Service A to encrypt Database A and use the public key of Service B to encrypt Database B.
• C.Apply the Brokered Authentication pattern to establish an authentication broker that uses WS-Trust based SAML tokens for message exchanges between Services A and B.
  This eliminates the need for Service A to be repeatedly authenticated by Service B.
  Database A is encrypted using the Service A password as a secret encryption key and Database B is encrypted using the Service B password as a secret encryption key.
• D.Apply the Direct Authentication pattern to establish mutual authentication between Services A and B using a shared identity store. Service A attaches a Username token to the first request message sent to Service B and Service B authenticates the request message using the shared identity store. Similarly, when Service B submits a response message to Service A.
  it attaches its own Username token that Service A then authenticates by also using the same shared identity store. Database A is encrypted using the Service A password as a secret encryption key and Database B is encrypted using the Service B password as a secret encryption key.

Service Consumer A sends a request to Service A (1). Service A replies with an acknowledgement message (2) and then processes the request and sends a request message to Service B (3). This message contains confidential financial data. Service B sends three different request messages together with its security credentials to Services C, D, and E (4, 5, 6). Upon successful authentication, Services C, D, and E store the data from the message in separate databases (7, 8, 9) Services B, C, D, and E belong to Service Inventory A, which further belongs to Organization B.
Service Consumer A and Service A belong to Organization A.

The service contracts of Services A and B both comply with the same XML schema.
However, each organization employs different security technologies for their service architectures. To protect the confidential financial data sent by Service A to Service B, each organization decides to independently apply the Data Confidentiality and the Data Origin Authentication patterns to establish message-layer security for external message exchanges. However, when an encrypted and digitally signed test message is sent by Service A to Service B, Service B was unable to decrypt the message.
Which of the following statements describes a solution that solves this problem?

• A.Although both of the organizations successfully applied the Data Confidentiality and the Data Origin Authentication patterns, the order in which the patterns were applied is incorrect. The application of the Data Origin Authentication pattern must always follow the application of the Data Confidentiality pattern to ensure that the message confidentiality from a third party authenticates the origin of the message.
• B.The problem with the test message occurred because Service A needed the private key of Service B to digitally sign the message. An attacker pretending to be Service B likely sent a fake private/public keys pair to Service A.
  Using these fake keys to encrypt and digitally sign the message made the message incompatible for Service B.
  Because the fake private key was also used to sign the hash, it explains the source of the problem.
• C.The problem with the test message occurred because Service A used incorrect keys to protect the message sent to Service B.
  Service A used its own public key to sign the message and then used Service B's public key to encrypt the message content. To correct the problem, Service A must use WS-SecureConversation to agree on a secret session key to be used to encrypt messages exchanged between Services A and B.
  Because this session key is only known by Services A and B, encrypting the messages with this key also provides authentication of the origin of the data.
• D.Although both of the organizations applied the Data Confidentiality and the Data Origin Authentication patterns, the security technologies used for the Service A and Service B architectures may be incompatible. Because there are several technologies and versions of technologies that can be used to apply these patterns, the organizations need to standardize implementation level details of the relevant security technologies.

• A.The Service A logic needs to be modified to work with the two new databases. Service A needs to be able to access the Public Database and the Private Database when it receives a request message from a service consumer with private access permissions, and it must only access the Public Database when it receives a request message from a service consumer with public access permissions. Furthermore, any response messages issued by Service A containing private data need to be encrypted.
• B.Each record in Database A is classified as either private or public. After Service A is invoked by a service consumer (1), it authenticates the request message using an identity store and retrieves the corresponding authorization (2, 3). Once authorized, the service consumer's request is submitted to Database A (4), which then returns the requested data (5) If the service consumer has private access permissions, all of the returned data is included in Service A's response message (6). If the service consumer has public access permissions, then Service A first filters the data in order to remove all unauthorized private data records, before sending to the response message to the service consumer (6).
  
  An investigation recently detected that private data has been leaked to unauthorized service consumers. An audit of the Service A architecture revealed that Service A's filtering logic is flawed, resulting in situations where private data was accidentally shared with service consumers that only have public access permissions. Further, it was discovered that attackers have been monitoring response messages sent by Service A in order to capture private data. It is subsequently decided to split Database A into two databases: one containing only private data (the Private Database) and the other containing only public data (the Public Database).
  What additional changes are necessary to address these security problems?
• C.After the service consumer's request message is authenticated. Service A can generate a one-time symmetric encryption key that it sends to the service consumer. This key is encrypted by the public key of the service consumer. After the service consumer acknowledges the receipt of the one-time encryption key, Service A forwards the service consumer's data access request (and the corresponding credentials) to both databases.
  After receiving the responses from the databases, Service A compiles the results into a single response message. This message is encrypted with the one-time key and sent by Service A to the service consumer.
• D.A utility service needs to be created and positioned between Service A and the service consumer. The utility service can contain screening logic that can verify the service consumer's credentials and then forward the request message to the Private Database or to the Public Database, depending on the service consumer's access permissions.
  Because each request message is evaluated by the database, no filtering of the returned data is necessary. The data is sent back to the consumer in a response message encrypted using symmetric key encryption.
• E.The Service A architecture can be enhanced with certificate-based authentication of service consumers in order to avoid dependency on the identity store. By using digital certificates, Service A can authenticate a service consumer's request message and then forward the data access request to the appropriate database. After receiving the responses from the databases, Service A can use the service consumer's public key to encrypt the response message that is sent to the service consumer.