S90-09A · Question #25
Service Consumer A sends a message to Service A. Before the message arrives with Service A, it is intercepted by Service Agent A (1). which checks the message for compliance to Policy A that is…
The correct answer is D. None of the above. Option D is correct because the new requirements introduce a data dependency that cannot be resolved by the Policy Centralization pattern alone. Service Agent C now needs a data value from the Service B database to check Policy C compliance - but Service Agent C intercepts the…
Question
Service Consumer A sends a message to Service A. Before the message arrives with Service A, it is intercepted by Service Agent A (1). which checks the message for compliance to Policy A that is required by Service A. If the message fails compliance, Service Agent A will not allow it to proceed and will instead write the message contents to a log. If the message does comply to the policy, it continues to be transmitted toward Service A, but before it arrives it is intercepted by Service Agent B (2), which validates the security credentials in the message header. If the security credential validation fails, the message is rejected and a runtime exception is raised. If the security credentials are validated, the message is sent to Service A. Upon receiving the message, Service A retrieves a data value from a database and populates the message header with this data value (3) prior to forwarding the message to Service B. Before the message arrives at Service B. it is intercepted by Service Agent C (4) which checks the message for compliance with two policies: Policy B and Policy C. Policy B is identical to Policy A that was checked by Service Agent A. To check for compliance to Policy C. Service Agent C uses the data value added by Service A. If the message complies with both of the policies, it is forwarded to Service B (5), which stores the message contents in its own database. You are told that Policy B and Policy C have changed. Also, in order to carry out the compliance check of Policy C, Service Agent C will now require a new data value from the Service B database. How can this service composition architecture be changed to fulfill these new requirements?
Exhibit
Options
- AThe Policy Centralization pattern can be applied so that only one service agent is used to enforce
- BThe Policy Centralization pattern can be applied so that only one service agent is used to enforce
- CThe Policy Centralization pattern can be applied so that only one service agent is used to enforce
- DNone of the above.
How the community answered
(28 responses)- A7% (2)
- B11% (3)
- C25% (7)
- D57% (16)
Explanation
Option D is correct because the new requirements introduce a data dependency that cannot be resolved by the Policy Centralization pattern alone. Service Agent C now needs a data value from the Service B database to check Policy C compliance - but Service Agent C intercepts the message before it reaches Service B, meaning Service B has not yet processed or stored anything. Simply centralizing policy enforcement into one agent does nothing to resolve this upstream/downstream timing conflict.
Options A, B, and C are all wrong for the same reason: they all propose applying the Policy Centralization pattern as the solution. While centralization could address the redundancy between Policy A and Policy B (since they are identical), it cannot solve the core architectural problem - that the compliance check now depends on data that is only available after the message reaches Service B. The pattern changes who enforces policy, not when or with what data.
A more comprehensive architectural change would be needed, such as restructuring the message flow so Service B provides the required data value earlier (similar to how Service A already enriches the message header), or redesigning Service Agent C to query Service B's database directly as an external service call.
Memory tip: When a policy check requires data from a downstream service that hasn't yet processed the message, centralization is a dead end - you have a sequencing problem, not just a consolidation problem. Ask yourself: "Does the data exist yet at the point where the check happens?"
Topics
Community Discussion
No community discussion yet for this question.