SOA Fundamental SOA Security - S90.18 Exam Questions [2026]

QUESTION NO: 1
The communication between Service A and Service B needs to be kept private. A security
specialist is planning to implement secret key cryptography in order to encrypt the
messages. Which of the following approaches addresses this requirement?

A. None of the above. B. The Data Origin Authentication pattern needs to be applied across both service
architectures. C. Create a shared key that will be used by both the services for message encryption and
decryption. D. Both the services need to be built with support for the XML-Signature industry standard.

Correct Answer: C

QUESTION NO: 2
The SAML and WS-Security industry standards can be applied to the same service
composition architecture.

A. True B. False

Correct Answer: A

QUESTION NO: 3
Using transport-layer security, an active intermediary that takes possession of a message
can compromise:

A. None of the above. B. message integrity C. message confidentiality D. message confidentiality and message integrity

Correct Answer: D

QUESTION NO: 4
The X.509 token can be used to express a ______________ security token that provides
an X.509 digital certificate.

A. None of the above. B. UDDI-based C. binary D. text-based

Correct Answer: C

QUESTION NO: 5
Security policies that extend the technical service contract must be standardized within a
given service inventory. This statement is in accordance with which service-orientation
principle?

A. Service Composability B. Service Reusability C. None of the above D. Service Abstraction

Correct Answer: C

QUESTION NO: 6
Which of the following tasks directly relates to the application of the Service Loose
Coupling principle?

A. Creating multiple security policies that are specific to one service. B. Creating one security policy that is specific to one service. C. Creating one security policy that is shared by multiple services. D. All of the above.

Correct Answer: D

QUESTION NO: 7
Username and X.509 token profiles can be combined so that a single message can contain
a username token that is digitally signed.

A. True B. False

Correct Answer: A

QUESTION NO: 8
The requirement to defer security related state data at runtime relates directly to the
application of which service-orientation principle?

A. None of the above. B. Service Autonomy C. Service Abstraction D. Service Loose Coupling

Correct Answer: A

QUESTION NO: 9
The application of the Service Autonomy principle is always negatively affected when
applying the Data Confidentiality pattern together with the Data Origin Authentication
pattern.

A. True B. False

Correct Answer: B

QUESTION NO: 10
The application of the Brokered Authentication pattern is best suited for a scenario whereby
a service consumer does not need to re-authenticate itself with multiple services.

A. True B. False

Correct Answer: B