nerdexam
EC-Council

312-50V11 · Question #365

Which of the following is a common Service Oriented Architecture (SOA) vulnerability?

The correct answer is D. XML denial of service issues. SOA relies heavily on XML-based messaging, making it uniquely susceptible to XML-based denial of service attacks that exploit parser vulnerabilities or recursive structures.

Hacking Web Applications

Question

Which of the following is a common Service Oriented Architecture (SOA) vulnerability?

Options

  • ACross-site scripting
  • BSQL injection
  • CVPath injection
  • DXML denial of service issues

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • D
    91% (20)

Why each option

SOA relies heavily on XML-based messaging, making it uniquely susceptible to XML-based denial of service attacks that exploit parser vulnerabilities or recursive structures.

ACross-site scripting

Cross-site scripting is a browser-side web application vulnerability targeting HTML rendering, not a vulnerability specific to SOA's XML messaging architecture.

BSQL injection

SQL injection targets database query construction in application code and is not a vulnerability unique to SOA's service messaging layer.

CVPath injection

VPath (XPath) injection can affect SOA but is not considered the most common or defining SOA vulnerability compared to XML-based DoS attacks.

DXML denial of service issuesCorrect

XML denial of service issues are a primary SOA vulnerability because SOA architectures depend on XML for SOAP messages, WSDL definitions, and service communication. Attackers can craft malicious XML payloads such as XML bombs (billion laughs attack) or deeply nested structures that exhaust CPU and memory resources on the parsing server. This is specific to SOA's reliance on XML processing, unlike general web vulnerabilities.

Concept tested: SOA XML-based denial of service vulnerabilities

Source: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

Topics

#SOA vulnerabilities#XML denial of service#web services#service-oriented architecture

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice