CAS-001 · Question #86
The database team has suggested deploying a SOA based system across the enterprise. The Chief Information Officer (CIO) has decided to consult the security manager about the risk implications for…
The correct answer is B. Users and services are distributed, often times over the Internet E. SOA abstracts legacy systems as web services, which are often exposed to outside threats. B is correct because SOA (Service-Oriented Architecture) is inherently distributed, with services and consumers spread across networks and often accessible over the Internet. This broad accessibility increases the attack surface significantly compared to a tightly contained…
Question
The database team has suggested deploying a SOA based system across the enterprise. The Chief Information Officer (CIO) has decided to consult the security manager about the risk implications for adopting this architecture. Which of the following are concerns that the security manager should present to the CIO concerning the SOA system? (Select TWO).
Options
- AUsers and services are centralized and only available within the enterprise.
- BUsers and services are distributed, often times over the Internet
- CSOA centrally manages legacy systems, and opens the internal network to vulnerabilities.
- DSOA abstracts legacy systems as a virtual device and is susceptible to VMEscape.
- ESOA abstracts legacy systems as web services, which are often exposed to outside threats.
How the community answered
(28 responses)- A14% (4)
- B75% (21)
- C7% (2)
- D4% (1)
Explanation
B is correct because SOA (Service-Oriented Architecture) is inherently distributed, with services and consumers spread across networks and often accessible over the Internet. This broad accessibility increases the attack surface significantly compared to a tightly contained internal system. E is correct because SOA commonly wraps legacy back-end systems as web services, exposing interfaces that were originally designed for trusted internal use to the broader network. Web services are subject to web-based attacks such as XML injection, SOAP manipulation, and unauthorized API access. Options A and C are incorrect because SOA is distributed-not centralized. Option D incorrectly conflates SOA with virtualization; VMEscape is a hypervisor vulnerability, not an SOA concern.
Topics
Community Discussion
No community discussion yet for this question.