Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Arcitura Education S90.20 Exam - Topic 1 Question 31 Discussion

Service Consumer A sends a request to Service A (1). Service A replies with an acknowledgement message (2) and then processes the request and sends a request message to Service B (3). This message contains confidential financial data. Service B sends three different request messages together with its security credentials to Services C, D, and E (4, 5, 6). Upon successful authentication, Services C, D, and E store the data from the message in separate databases (7, 8, 9) Services B, C, D, and E belong to Service Inventory A, which further belongs to Organization B .Service Consumer A and Service A belong to Organization A .The service contracts of Services A and B both comply with the same XML schema. However, each organization employs different security technologies for their service architectures. To protect the confidential financial data sent by Service A to Service B, each organization decides to independently apply the Data Confidentiality and the Data Origin Authentication patterns to establish message-layer security for external message exchanges. However, when an encrypted and digitally signed test message is sent by Service A to Service B, Service B was unable to decrypt the message. Which of the following statements describes a solution that solves this problem?
A) Although both of the organizations applied the Data Confidentiality and the Data Origin Authentication patterns, the security-technologies used for the Service A and Service B architectures may be incompatible. Because there are several technologies and versions of technologies that can be used to apply these patterns, the organizations need to standardize implementation level details of the relevant security technologies.
B) The problem with the test message occurred because Service A used incorrect keys to protect the message sent to Service B .Service A used its own public key to sign the message and then used Service B's public key to encrypt the message content. To correct the problem, Service A must use WS-Secure-Conversation to agree on a secret session key to be used to encrypt messages exchanged between Services A and B .Because this session key is only known by Services A and B, encrypting the messages with this key also provides authentication of the origin of the data.
C) Although both of the organizations successfully applied the Data Confidentiality and the Data Origin Authentication patterns, the order in which the patterns were applied is incorrect. The application of the Data Origin Authentication pattern must always follow the application of the Data Confidentiality pattern to ensure that the message confidentiality from a third party authenticates the origin of the message.
D) The problem with the test message occurred because Service A needed the private key of Service B to digitally sign the-message. An attacker pretending to be Service B likely sent a fake private/public keys pair to Service A .Using these fake keys to encrypt and digitally sign the message made the message incompatible for Service B .Because the fake private key was also used to sign the hash, it explains the source of the problem.

Arcitura Education S90.20 Exam - Topic 1 Question 31 Discussion

Actual exam question for Arcitura Education's S90.20 exam
Question #: 31
Topic #: 1
[All S90.20 Questions]

Service Consumer A sends a request to Service A (1). Service A replies with an acknowledgement message (2) and then processes the request and sends a request message to Service B (3). This message contains confidential financial data. Service B sends three different request messages together with its security credentials to Services C, D, and E (4, 5, 6). Upon successful authentication, Services C, D, and E store the data from the message in separate databases (7, 8, 9) Services B, C, D, and E belong to Service Inventory A, which further belongs to Organization B .Service Consumer A and Service A belong to Organization A .The service contracts of Services A and B both comply with the same XML schema. However, each organization employs different security technologies for their service architectures. To protect the confidential financial data sent by Service A to Service B, each organization decides to independently apply the Data Confidentiality and the Data Origin Authentication patterns to establish message-layer security for external message exchanges. However, when an encrypted and digitally signed test message is sent by Service A to Service B, Service B was unable to decrypt the message. Which of the following statements describes a solution that solves this problem?

Show Suggested Answer Hide Answer
Suggested Answer: A

by Leslie at Jul 29, 2022, 04:43 AM

Limited Time Offer

25%

Off

Get Premium S90.20 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Alyssa
7 months ago
Nah, I don’t think that’s the main problem here.
upvoted 0 times
...
Johnathon
7 months ago
I think it’s more about the order of applying the patterns.
upvoted 0 times
...
Launa
7 months ago
Wait, how did they end up with fake keys? That’s wild!
upvoted 0 times
...
Oliva
8 months ago
I agree, they need to standardize their security tech.
upvoted 0 times
...
Hobert
8 months ago
Sounds like a key mismatch issue.
upvoted 0 times
...
Hubert
8 months ago
Option D sounds a bit off to me. I don't think Service A needs Service B's private key to sign the message. That just seems wrong based on what we learned about public key infrastructure.
upvoted 0 times
...
Chanel
8 months ago
I vaguely recall that the order of applying security patterns can be important, but I thought it was more about the context rather than a strict sequence. So, I'm not convinced about option C.
upvoted 0 times
...
Thora
8 months ago
I think option B makes sense because it mentions using the correct keys, which we practiced in class. But I’m a bit confused about the WS-Secure-Conversation part.
upvoted 0 times
...
Douglass
8 months ago
I remember discussing how different security technologies can lead to compatibility issues, so option A seems plausible, but I'm not entirely sure if that's the main reason for the decryption failure.
upvoted 0 times
...
Salena
8 months ago
I'm a little confused by this question. I know there are different ways to check view properties, but I'm not sure which specific column would indicate whether a view is secure or not. I'll have to review my notes and try to narrow it down.
upvoted 0 times
...
Wilda
8 months ago
Definitely going with B - quantitative statistical methods. That's the approach I'm most comfortable with and I know it's a common technique for forecasting in business.
upvoted 0 times
...
Shelia
8 months ago
Tricky question. Watch out for those typos in option C - 'stale' instead of 'state', but I think the intent is clear.
upvoted 0 times
...
Bette
8 months ago
For me, it's definitely D. When you benchmark, you want to understand how top-performing facilities achieve their results. No point comparing to average organizations.
upvoted 0 times
...

Save Cancel