Oracle IT Architecture Release 3 Essentials: 1Z0-574

Correct Answer: B

Explanation: Symmetrickey cryptography uses the same key to encrypt and decrypt data. Therefore the sender and receiver must each have a copy of the key. It is important that no other entity gains access to the key otherwise they would be able to decrypt the data as well. Common key algorithms include the Data Encryption Standard (DES), Triple DES (3DES), and Advanced Encryption Standard (AES).

References:

Correct Answer: ACD

Explanation:

A: The scope of ITSO is all of Oracle's product families. However, the Oracle technology real estate is extremely large and evolves as new products are introduced. Thus, the ITSO material will continue to grow as more ORA documents are created, additional ETSs are covered, and additional ESDs are created. C, D:Technology perspectives extend the core material by adding the unique capabilities, components, standards, and approaches that a specific technology strategy offers. SOA, BPM, EPM/BI, and EDA are examples of perspectives for ORA. Each technology strategy presents unique requirements to architecture that includes specific capabilities, principles, components, technologies, standards, etc. Rather than create another reference architecture for each strategy, ORA was designed to be extensible to incorporate new computing strategies as they emerge in the industry.

In order to present the reference architecture in the most effective manner, each new technology strategy adds a perspective to ORA. This enables the reference architecture to evolve holistically. New computing strategies extend the core material, providing further insight and detail as needed. A perspective extends the ORA core collateral by providing views, principles, patterns, and guidelines that are significant to that technology domain yet cohesive with the overall ORA. The perspective includes:

*

A foundation document describing the terms, concepts, standards, principles, etc. that are important to the ETS.

*

An infrastructure document that defines a reference architecture built using the technologies pertinent to the ETS.

An industry reference architecture is a set of high level architectural representations which characterize the current state architecture of an enterprise and a desired state, or architectural vision, based on the ORA.

References:

Correct Answer: C

Explanation:

In order to avoid man-in-the-middle attacks a security framework must have capabilities such as:

*

Logging in users without the need to type passwords or PINs (not D)

*

Dynamically challenging the user for different information, e.g., asking a random question for which only the user will know the answer

*

Encrypting and signing transmissions from the client to the back end server (not A)

*

Detecting replays using embedded transaction ids or timestamps (not E)

*

Presenting proof to the user that the site they are visiting is authentic

Propagating a single proof object, or assertion, can be susceptible to man-in-the-middle attacks and replay attacks. If a rogue entity observes an assertion, it could reuse that assertion for illegitimate requests. Possible solutions include:

*

(notB) Invalidate the assertion after every request. In the case of chained SOA Services, service providers must verify each assertion they receives with the authority. The authority can invalidate assertions in its internal cache. Any future verifications with the same assertion would fail. SOA Service providers would need to obtain a new assertion in order to make subsequent service requests. This solves both types of problems mentioned above.

*

(notE) Reduce and enforce the assertion's time to live attribute. This would narrow the window of opportunity to reuse an assertion. The assertion would have to be captured and reused in a short period of time (programmatically vs. manually). While this limits the potential for man-in-the-middle attacks, it's not as effective for replay attacks

*

Require the signature of a trusted service consumer (client application) in addition to the signed assertion. The caller's signature should cover the assertion to bind it to the message. If all service consumers are required to sign their request messages, then service providers can be shielded from rogue clients, thereby preventing man-in-the-middle attacks.

This solution would need to be enhanced to solve replay attacks. One option is to include a unique request id, timestamp, or sequence number in the request. The target resource could maintain a cache of ids and refuse duplicate requests. A common request id service could be created to issue unique request ids and validate all requests that are received within the security domain

References: