SOA S90.20

The S90.20 exam has a reputation for tripping up even experienced professionals. Dumpkiller breaks the SOA Security Lab syllabus down into 30 practice questions with clear explanations, so tricky topics stop feeling intimidating.

SOA S90.20 Exam Overview:

SOA S90.20 Exam Syllabus Topics:

SOA Security Lab: Common Questions From Candidates

What is the SOA Security Lab certification exam?

The SOA Security Lab exam (code: S90.20) is the official SOA exam that leads to the Certified SOA Security Specialist / Certified Service Security Specialist certification. It sits at the Specialist level of the SOA certification track. It is also connected with related credentials such as Certified SOA Professional, Certified Microservice Professional. Passing it proves to employers that your skills have been validated by SOA itself, which is why the S90.20 credential keeps showing up in job postings.

How many questions are in the S90.20 exam, and how long does it take?

The SOA Security Lab exam gives you 180–240 to work through 3–5 practical lab tasks. Pacing matters more than most candidates expect, so before exam day, run at least one full timed session in the Dumpkiller test engine to learn how long you can afford per question. If an item stalls you, flag it and move on — coming back later beats burning five minutes on a single question.

What score do I need to pass the S90.20 exam, and how much does it cost?

The passing score for the SOA Security Lab exam is 70% or 700/1000, and the official registration fee is $249 USD. Remember that a failed attempt means paying that fee in full again, so a timed self-assessment with Dumpkiller practice questions about a week before your exam date is a cheap way to confirm you are scoring comfortably above 70% or 700/1000.

Are there any prerequisites for the S90.20 exam?

According to SOA, the following applies: Recommended: S90.18 Fundamental SOA Security and S90.19 Advanced SOA Security; hands-on experience with SOA/microservices security. Certification policies do change from time to time, so confirm the latest requirements on the official exam page at https://www.arcitura.com/soacp-gen-1/exams/exam-s90-20-soa-security-lab/ before you register.

How do I register for the S90.20 exam?

You can book your SOA Security Lab exam through the official channels below:

• Arcitura Official Exam Registration
• Pearson VUE Arcitura Testing

Depending on availability in your region, the exam is delivered as Online proctored via Arcitura digital platform or on-site at authorized workshops.

What official training does SOA recommend for the S90.20 exam?

SOA lists the following training options for SOA Security Lab candidates:

• SOACP Module 19: Advanced SOA Security
• Security for Microservices & SOA Course

Official courses build a solid foundation, and pairing them with the 30 practice questions from Dumpkiller shows you how ready you really are before you spend money on the exam itself.

Can I try the S90.20 practice questions before buying?

Yes. Dumpkiller offers a free S90.20 PDF demo so you can review the question style, difficulty, and explanations before committing to anything. After purchase, your SOA Security Lab material includes 365 days of free updates, and if your product expires after that, you can extend the update service at a 50% discount from your member zone.

What happens if I do not pass the S90.20 exam, and how is my order delivered?

If you take the corresponding S90.20 exam within 60 days of your purchase and do not pass, you can apply for a full refund under our 100% Money Back Guarantee, subject to a few conditions: the failed exam must be the one matching your purchase; sitting the exam within 3 days of purchase does not qualify, since that leaves too little preparation time; downloading the material without actually taking the exam does not qualify; free materials and expired orders are excluded; and the candidate name must match the payer name. To apply, send a scanned copy of your enrollment slip together with your official Score Report (PDF) within 2 days after the exam, and claims are processed within 7 days. If you would rather not take a refund, you can exchange your purchase for two free products of equal value while keeping the update service on the product you originally bought. As for delivery, everything is an instant download: your products are sent to your email within one minute of payment — contact customer service if nothing arrives within 2 hours — and there is no limit on the number of computers you can install the software on.

What topics are covered in the S90.20 exam?

The official SOA Security Lab syllabus is organized into 4 main domains. The first three are SOA Security Architecture & Patterns (25%), Infrastructure & Advanced Security (20%), and Secure Service Interactions (30%). For the full domain-by-domain breakdown, see the complete Exam Topics outline above.

SOA Security Lab Sample Questions:

Question #1
Service A exchanges messages with Service B multiple times during the same runtime service activity. Communication between Services A and B has been secured using transport-layer security. With each service request message sent to Service B (1A. IB), Service A includes an X.509 certificate, signed by an external Certificate Authority (CA).
Service B validates the certificate by retrieving the public key of the CA (2A. 2B) and verifying the digital signature of the X.509 certificate. Service B then performs a certificate revocation check against a separate external CA repository (3A, 3B). No intermediary service agents reside between Service A and Service B.

Service B has recently suffered from poor runtime performance plus it has been the victim of an access-oriented attack. As a result, its security architecture must be changed to fulfill the following new requirements: 1. The performance of security-related processing carried out by Service B when communicating with Service A must be improved. 2. All request messages sent from Service A to Service B must be screened to ensure that they do not contain malicious content.
Which of the following statements describes a solution that fulfills these requirements?

A. Add a service agent to screen messages sent from Service A to Service B.
The service agent can reject any message containing malicious content so that only verified messages are passed through to Service B.
Instead of using X.509 certificates, use WS- SecureConversation sessions. Service A can request a Security Context Token (SCT) from a Security Token Service and use the derived keys from the session key to secure communication with Service B.
Service B retrieves the session key from the Security Token Service.
B. Apply the Trusted Subsystem pattern to by introducing a new utility service. Because Service B is required to limit the use of external resources. Service A must ensure that no other services can request processing from Service B in order to prevent malicious content from infiltrating messages. This is achieved by creating a dedicated replica of Service B to be used by the utility service only. Upon receiving the request message and the accompanying security credentials from Service A.
the utility service verifies the authentication information and the validity of the X.509 signature. If the authentication information is correct, then the utility service replicates the code of Service B, performs the necessary processing, and returns the response to Service A.
C. Eliminate the need to retrieve the public key from the Certificate Authority and to verify the certificate revocation information by extending the service contract of Service B to accept certificates only from pre-registered Certificate Authorities. This form of pre- registration ensures that Service B has the public key of the corresponding Certificate Authority.
D. Apply the Trusted Subsystem pattern by introducing a new utility service between Service A and Service B.
When Service A sends request messages, the utility service verifies the provided credentials and creates a customized security profile for Service A.
The security profile contains authentication and access control statements that are then inherited by all subsequent request messages issued by Service A.
As a result, performance is improved because Service A does not need to resubmit any additional credentials during subsequent message exchanged as part of the same runtime service activity. Furthermore, the utility service performs message screening logic to filter out malicious content.

Question #2
Service A has two specific service consumers, Service Consumer A and Service Consumer B (1). Both service consumers are required to provide security credentials in order for Service A to perform authentication using an identity store (2). If a service consumer's request message is successfully authenticated, Service A processes the request by exchanging messages with Service B (3) and then Service C (4). With each of these message exchanges, Service A collects data necessary to perform a query against historical data stored in a proprietary legacy system. Service A's request to the legacy system must be authenticated (5). The legacy system only provides access control using a single account. If the request from Service A is permitted, it will be able to access all of the data stored in the legacy system. If the request is not permitted, none of the data stored in the legacy system can be accessed. Upon successfully retrieving the requested data (6), Service A generates a response message that is sent back to either Service Consumer A or B.
The legacy system is also used independently by Service D without requiring any authentication. Furthermore, the legacy system has no auditing feature and therefore cannot record when data access from Service A or Service D occurs. If the legacy system encounters an error when processing a request, it generates descriptive error codes.

This service composition architecture needs to be upgraded in order to fulfill the following new security requirements: 1. Service Consumers A and B have different access permissions and therefore, data received from the legacy system must be filtered prior to issuing a response message to one of these two service consumers. 2. Service Consumer A's request messages must be digitally signed, whereas request messages from Service Consumer B do not need to be digitally signed.
Which of the following statements describes a solution that fulfills these requirements?

A. The Trusted Subsystem pattern is applied together with the Message Screening pattern by introducing a utility service that encapsulated the legacy system and contains message screening logic. First, the utility service evaluates the incoming request messages to ensure that it is digitally signed, when necessary. After successful verification the request message is authenticated, and Service A performs the necessary processing. The data returned from the legacy system is filtered by the utility service's message screening logic in order to ensure that only authorized data is returned to Service Consumers A and B.
B. The Trusted Subsystem pattern is applied by introducing a utility service that encapsulates the legacy system. After successful authentication, Service A creates a signed SAML assertion stating what access level the service consumer has. The utility service inspects the signed SAML assertion in order to authenticate Service A.
The utility service accesses the legacy system using the account information originally provided by Service Consumer A or B.
The utility service evaluates the level of authorization of the original service consumer and filters data received from the legacy system accordingly.
C. The Trusted Subsystem pattern is applied by introducing a utility service that encapsulates the legacy system. Two different policies are created for Service A's service contract, only one requiring a digitally signed request message. The utility service accesses the legacy system using the single account. Service A authenticates the service consumer using the identity store and, if successfully authenticated, Service A send a message containing the service consumer's credentials to the utility service. The identity store is also used by the utility service to authenticate request messages received from Service A.
The utility service evaluates the level of authorization of the original service consumer and filters data received from the legacy system accordingly.
D. The Trusted Subsystem pattern is applied by introducing a utility service that encapsulates the legacy system. To support access by service consumers issuing request messages with and without digital signatures, policy alternatives are added to Service A's service contract. Service A authenticates the service consumer's request against the identity store and verifies compliance to the policy. Service A then creates a signed SAML assertion containing an authentication statement and the authorization decision. The utility service inspects the signed SAML assertions to authenticate the service consumer and then access the legacy system using a single account. The data returned by the legacy system is filtered by the utility service, according to the information in the SAML assertions.

Question #3
Service Consumer A sends a request message to Service A (1), after which Service A sends a request message with security credentials to Service B (2). Service B authenticates the request and, if the authentication is successful, writes data from the request message into Database B (3). Service B then sends a request message to Service C (4), which is not required to issue a response message. Service B then sends a response message back to Service A (5). After processing Service B's response, Service A sends another request message with security credentials to Service B (6). After successfully authenticating this second request message from Service A, Service B sends a request message to Service D (7). Service D is also not required to issue a response message. Finally, Service B sends a response message to Service A (8), after which Service A records the response message contents in Database A (9) before sending its own response message to Service Consumer A (10).

To use Service A, Service Consumer A is charged a per usage fee. The owner of Service Consumer A has filed a complaint with the owner of Service A, stating that the bills that have been issued are for more usage of Service A than Service Consumer A actually used.
Additionally, it has been discovered that malicious intermediaries are intercepting and modifying messages being sent from Service B to Services C and D.
Because Services C and D do not issue response messages, the resulting errors and problems were not reported back to Service B.
Which of the following statements describes a solution that correctly addresses these problems?

A. Apply the Brokered Authentication to establish an authentication broker between Service Consumer A and Service A that can carry out the Kerberos authentication protocol. Before invoking Service A, Service Consumer A must request a ticket granting ticket and then it must request service granting tickets to all services in the service composition, including Services C and D.
Messages sent by Service B to Services C and D must further be encrypted with the public key of Service Consumer A.
B. Messages sent to Services C and D must be protected using transport-layer encryption in order to ensure data confidentiality. Service consumers of Service A must be authenticated using X.509 certificates because they can be reused for several request messages.
C. Apply the Service Perimeter Guard and the Message Screening patterns together to establish a perimeter service between Service Consumer A and Service A.
The perimeter service screens and authenticates incoming request messages from Service Consumer A.
After successful authentication, the perimeter service generates a signed SAML assertion that is used by the subsequent services to authenticate and authorize the request message and is also carried forward as the security credential included in messages sent to Services C and D.
D. The Data Confidentiality and Data Origin Authentication patterns need to be applied in order to establish message-layer confidentiality and integrity for messages sent to Services C and D.
The Direct Authentication pattern can be applied to require that service consumer be authenticated in order to use Service A.

Solutions: