nerdexam
CompTIA

CAS-002 · Question #160

A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website. After performing…

The correct answer is C. Service to service authentication for all workflows. In a service-oriented architecture with a history of data injection attacks, service-to-service authentication ensures only trusted services can participate in workflows, directly mitigating injection threats.

Technical Integration of Enterprise Components

Question

A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website. After performing the business process analysis, the administrator decides the services need to operate in a dynamic fashion. The company has also been the victim of data injection attacks in the past and needs to build in mitigation features. Based on these requirements and past vulnerabilities, which of the following needs to be incorporated into the SOA?

Options

  • APoint to point VPNs for all corporate intranet users.
  • BCryptographic hashes of all data transferred between services.
  • CService to service authentication for all workflows.
  • DTwo-factor authentication and signed code

How the community answered

(56 responses)
  • A
    5% (3)
  • B
    9% (5)
  • C
    61% (34)
  • D
    25% (14)

Why each option

In a service-oriented architecture with a history of data injection attacks, service-to-service authentication ensures only trusted services can participate in workflows, directly mitigating injection threats.

APoint to point VPNs for all corporate intranet users.

Point-to-point VPNs protect network-layer communication for intranet users but do not authenticate individual services or prevent a compromised internal service from injecting malicious data.

BCryptographic hashes of all data transferred between services.

Cryptographic hashes verify data integrity after the fact but do not authenticate the originating service or block a malicious service from injecting data before it is transmitted.

CService to service authentication for all workflows.Correct

Service-to-service authentication establishes that only verified, authorized services can communicate within the SOA, preventing unauthorized or malicious services from injecting data into the pipeline. Because the architecture must operate dynamically, this control acts as a per-transaction gatekeeping mechanism that directly addresses the described injection vulnerability without relying on static perimeter controls.

DTwo-factor authentication and signed code

Two-factor authentication and signed code address user access and software integrity but do not establish the service-level trust needed to prevent injection attacks between SOA components.

Concept tested: Service-to-service authentication in SOA security

Source: https://docs.oasis-open.org/ws-sx/ws-securitypolicy/v1.3/os/ws-securitypolicy-1.3-os.html

Topics

#SOA security#service-to-service authentication#injection attack mitigation#web services

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice