CAS-001 · Question #120
A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website. After performing…
The correct answer is C. Service to service authentication for all workflows. The correct answer is C. In a Service-Oriented Architecture (SOA), services communicate with each other dynamically. Without authentication between services, a compromised or rogue service could inject malicious data or impersonate a legitimate service, facilitating the data…
Question
A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website. After performing the business process analysis, the administrator decides the services need to operate in a dynamic fashion. The company has also been the victim of data injection attacks in the past and needs to build in mitigation features. Based on these requirements and past vulnerabilities, which of the following needs to be incorporated into the SOA?
Options
- APoint to point VPNs for all corporate intranet users.
- BCryptographic hashes of all data transferred between services.
- CService to service authentication for all workflows.
- DTwo-factor authentication and signed code
How the community answered
(21 responses)- A24% (5)
- B10% (2)
- C62% (13)
- D5% (1)
Explanation
The correct answer is C. In a Service-Oriented Architecture (SOA), services communicate with each other dynamically. Without authentication between services, a compromised or rogue service could inject malicious data or impersonate a legitimate service, facilitating the data injection attacks the company has previously suffered. Service-to-service authentication (e.g., mutual TLS, API keys, OAuth tokens) ensures that only authorized services can interact within the workflow, providing both integrity and access control at the service boundary. Option A (point-to-point VPNs) is too rigid for dynamic SOA and doesn't address injection attacks. Option B (cryptographic hashes) verifies integrity but doesn't authenticate the caller. Option D (two-factor auth and signed code) applies to user authentication and deployment, not inter-service communication. Service-to-service authentication directly mitigates the identified attack vector.
Topics
Community Discussion
No community discussion yet for this question.