The same security policy has been redundantly implemented as part of the service contracts for Web services A, B and C.
In order to reduce the effort of maintaining multiple redundant service policies, it has been decided to centralize policy enforcement across these three services. Which of the following industry standards will need to be used for Web services A, B and C in order for their service contracts to share the same security policy document?

• A. WS-Security
• B. WS-SecureConversation
• C. WS-PolicyAttachment
• D. WS-Trust

A service composition is made up of services from a particular domain service inventory.
All of the services belonging to the domain service inventory are deployed on the same server. Service A is part of the same domain inventory but is not part of this service composition. Service A becomes a victim of an XML parser attack resulting in its unavailability. However, because the services in the service composition rely on the same XML parser used by Service A.
the service composition can also be affected by this attack.

• A. True
• B. False

Service A needs to be designed so that it supports message integrity and so that only part of the messages exchanged by the service are encrypted. You are asked to create the security policy for this service. What type of policy assertions should you use?

• A. Protection assertions
• B. Token assertions
• C. Security binding assertions
• D. Service A's security requirements cannot be expressed in a policy

The Exception Shielding pattern can be applied together with the Trusted Subsystem pattern.

• A. True
• B. False

Which of the following statements is true?

• A. When the xsd:any element is used within an XML schema it can introduce a security risk because it allows attackers to extend the schema.
• B. When the maxOccurs attribute in an XML schema element is not specified it creates a security risk because attackers can specify this element multiple times.
• C. All of above.
• D. When numeric ranges within an XML schema are not specified it creates a security risk because attackers can introduce very large numeric values within the message data.