Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Arcitura Education S90.19 Exam - Topic 6 Question 43 Discussion

Service A has recently been the victim of XPath injection attacks. Messages sent between Service A and Service C have traditionally been protected via transport-layer security. A redesign of the service composition architecture introduces Service B, which is positioned as an intermediary service between Service A and Service C . The Message Screening pattern was applied to the design of Service B . As part of the new service composition architecture, transport-layer security is replaced with message-layer security for all services, but Service A and Service C continue to share the same encryption key. After the new service composition goes live, Service A continues to be subjected to XPath injection attacks. What is the reason for this?
B) Because message-layer security is being used, it is not possible for the message screening logic in Service B to inspect messages without having the encryption key that is shared by Service A and Service C
A) The message screening logic can only work for Service C . Therefore, Service A is not protected.
C) XPath injection attacks are not prevented by message screening logic or message-layer security.
D) None of the above.

Arcitura Education S90.19 Exam - Topic 6 Question 43 Discussion

Actual exam question for Arcitura Education's S90.19 exam
Question #: 43
Topic #: 6
[All S90.19 Questions]

Service A has recently been the victim of XPath injection attacks. Messages sent between Service A and Service C have traditionally been protected via transport-layer security. A redesign of the service composition architecture introduces Service B, which is positioned as an intermediary service between Service A and Service C . The Message Screening pattern was applied to the design of Service B . As part of the new service composition architecture, transport-layer security is replaced with message-layer security for all services, but Service A and Service C continue to share the same encryption key. After the new service composition goes live, Service A continues to be subjected to XPath injection attacks. What is the reason for this?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Quentin at May 03, 2022, 10:40 PM

Limited Time Offer

25%

Off

Get Premium S90.19 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Lonny
9 months ago
No way, I thought message-layer security would cover that!
upvoted 0 times
...
Shelba
9 months ago
I think it's more about the limitations of message screening.
upvoted 0 times
...
Elbert
9 months ago
Wait, so XPath attacks still get through? That's surprising.
upvoted 0 times
...
Vallie
9 months ago
Totally agree, that's a big flaw!
upvoted 0 times
...
Fletcher
9 months ago
Message-layer security can't inspect without the key.
upvoted 0 times
...
Keva
10 months ago
Hmm, the question is asking about the advantages and disadvantages of the two types of specifications. I'll need to make sure I clearly outline the key points for each one to fully address the question.
upvoted 0 times
...
Adaline
10 months ago
This one seems straightforward - the role that can create personal targets and thresholds for users is likely the pa_target_admin or pa_threshold_admin role.
upvoted 0 times
...
Dalene
10 months ago
I remember practicing a question that mentioned reference planes, but I can't recall if that's what they come with by default.
upvoted 0 times
...
Herman
10 months ago
I'm feeling pretty confident about this one. I think the aggregate method would be the most appropriate way to handle the FIT withholding, given the information provided.
upvoted 0 times
...

Save Cancel