CAS-002 · Question #212
A general insurance company wants to set up a new online business. The requirements are that the solution needs to be: Extendable for new products to be developed and added Externally facing for…
The correct answer is A. Implement WS-Security for services authentication and XACML for service authorization. F. Use application level encryption to encrypt sensitive fields, SSL encryption on sensitive. The architecture uses an ESB and web services gateway, which require service-level security. Answer A (WS-Security for authentication + XACML for authorization) directly addresses the service layer by providing standards-based authentication for web services and fine-grained…
Question
A general insurance company wants to set up a new online business. The requirements are that the solution needs to be:
Extendable for new products to be developed and added Externally facing for customers and business partners to login Usable and manageable Be able to integrate seamlessly with third parties for non core functions such as document printing Secure to protect customer's personal information and credit card information during transport and at rest The conceptual solution architecture has specified that the application will consist of a traditional three tiered architecture for the front end components, an ESB to provide services, data transformation capability and legacy system integration and a web services gateway. Which of the following security components will BEST meet the above requirements and fit into the solution architecture? (Select TWO).
Options
- AImplement WS-Security for services authentication and XACML for service authorization.
- BUse end-to-end application level encryption to encrypt all fields and store them encrypted
- CImplement a certificate based solution on a smart card in combination with a PIN to provide
- DImplement WS-Security as a federated single sign-on solution for authentication
- EImplement SSL encryption for all sensitive data flows and encryption of passwords of the
- FUse application level encryption to encrypt sensitive fields, SSL encryption on sensitive
How the community answered
(20 responses)- A45% (9)
- B5% (1)
- C15% (3)
- D5% (1)
- E30% (6)
Explanation
The architecture uses an ESB and web services gateway, which require service-level security. Answer A (WS-Security for authentication + XACML for authorization) directly addresses the service layer by providing standards-based authentication for web services and fine-grained policy-based authorization-both essential for the ESB tier and third-party integrations. Answer F (application-level encryption for sensitive fields + SSL for data flows + encrypted passwords) addresses confidentiality in transit and at rest without over-engineering. Together, A and F cover authentication, authorization, transport security, and data-at-rest encryption. Option B (encrypting ALL fields) is excessive and impractical. Option C (smart card + PIN) is too complex for external customers and would violate the 'usable and manageable' requirement. Option D covers only SSO without addressing authorization or data protection. Option E is a subset of F, missing the application-level field encryption needed for data at rest.
Topics
Community Discussion
No community discussion yet for this question.