Security policies that extend the technical service contract must be standardized within a
given service inventory. This statement is in accordance with which service-orientation
principle?

• A. Service Composability
• B. Service Reusability
• C. Service Abstraction
• D. None of the above

Which of the following is not a hashing algorithm?

• A. SHA-1
• B. MD5
• C. X.509
• D. SHA-256

XML canonicalization is the process of standardizing the syntax of XML documents that are
to be digitally signed. This way, when the digital signature is verified, it reproduces the
same message digest for assessing message integrity.

• A. False
• B. True

A task service needs to access three entity services as part of a service composition. The
task service needs to authenticate itself every time it accesses one of the three entity
services. Because the task service must authenticate itself three times to complete its task,
the current service composition design is considered inefficient. How can it be improved
while continuing to fulfill the authentication requirements?

• A. Remove the authentication requirements within the service composition, thereby
  reducing the message size and making communication faster.
• B. Use a single sign-on mechanism.
• C. Increase the network bandwidth between the task service and the entity services.
• D. None of the above

Service A and Service B belong to Organization A and Service C belongs to Organization
B. Service A sends confidential messages to Service B, which forwards these messages to
Service C.
The message sent to Service C is intercepted by a load balancing service agent
that determines which instance of Service C to route the message to. This entire message
path needs to be encrypted in order to ensure message confidentiality from when the
message is first sent by Service A until it is received by an instance of Service C.
Organization A doesn't trust any intermediaries that may exist in between Service B and
Service C and also doesn't want to share any keys with Organization B.
Furthermore, there is a requirement to minimize any adverse effects on performance. Which of the following
approaches fulfills these requirements?

• A. None of the above.
• B. This way, message content is not available to any intermediaries between Services B
  and C.
• C. Use message-layer security by adding symmetric encryption between Services A, B and
• D. Use transport-layer security between Service B and Service C and use message-layer
  security via asymmetric encryption between Service A and Service B.
  This way. all the services are secured while at the same time minimizing the performance degradation
  between Service B and Service C.
• E. Because Service A and Service B exist within the same organizational boundary, use
  transport-layer security to provide message confidentiality. Use message-layer security via
  asymmetric encryption between Service B and Service C.