SOA Certification S90.20

Short on study time for the SOA Security Lab exam? Getcertkey condenses your preparation into 30 focused practice questions for the S90.20 exam, so even a packed schedule leaves room for steady, measurable progress.

SOA S90.20 Exam Overview:

Certification Vendor:	Arcitura Education
Exam Name:	SOA Security Lab
Exam Number:	S90.20
Passing Score:	Not officially published
Exam Duration:	60 minutes
Exam Price:	Official pricing varies by region/testing provider
Certificate Validity Period:	Typically perpetual (no re-certification requirement unless updated)
Related Certifications:	Certified SOA Security Specialist
Available Languages:	English
Exam Format:	Scenario-based items, Multiple choice
Real Exam Qty:	30
Sample Questions:
Exam Way:	Delivered via authorized testing centres or online proctored testing (e.g., through Pearson VUE) globally
Pre Condition:	No formal prerequisites; recommended background in SOA concepts and intermediate security knowledge
Official Syllabus URL:	https://www.arcitura.com/

SOA S90.20 Exam Syllabus Topics:

Common Questions About the SOA S90.20 Exam

What is the SOA Security Lab exam all about?

The S90.20 exam is the official Arcitura Education exam behind the SOA Certification certification, validating the skills measured by the SOA Security Lab credential. It sits at the Specialist level of the Arcitura Education certification program. It also connects to Certified SOA Security Specialist, so the knowledge you build here carries over to those tracks as well.

How many questions are on the S90.20 exam, and how much time do I get?

The S90.20 exam contains 30 questions to be completed within 60 minutes. Before exam day, divide the available time by the question count to work out a comfortable per-question pace, and mark any item that eats into it so you can return later instead of getting stuck. Timed sessions in the Getcertkey test engines make that pacing automatic — run at least two full-length mock exams under the clock so time pressure never becomes the reason you drop points.

What score do I need to pass the S90.20 exam, and what does it cost?

The passing score for the S90.20 exam is Not officially published, and the official registration fee is Official pricing varies by region/testing provider. Retakes are not discounted — every new attempt means paying the full fee again — so it pays to measure yourself before you book. Work through the 30 practice questions on Getcertkey, sit a timed practice test, and schedule your exam only when your scores are consistently comfortable. That simple habit is the cheapest exam strategy there is.

Are there any prerequisites for the S90.20 exam?

No formal prerequisites; recommended background in SOA concepts and intermediate security knowledge Requirements can change when Arcitura Education revises its certification program, so confirm the current eligibility rules on the official exam page before you register.

Can I try the S90.20 practice questions before I buy?

Yes. Getcertkey provides a free S90.20 PDF demo so you can review the question style and answer quality before purchasing. Every purchase also includes 365 days of free updates — if SOA revises the exam during that period, the updated material reaches you at no cost. Once the free-update year ends, you can extend your update service at a 50% discount.

What if I fail the S90.20 exam, and how is my order delivered?

Every SOA Security Lab purchase on Getcertkey is covered by a 100% money-back guarantee with clear conditions: if you take the corresponding exam within 60 days of your purchase and do not pass, you can claim a full refund by submitting a scanned copy of your exam enrollment slip and your official score report as a PDF within two days of the exam date; claims are processed within seven days of submission. The guarantee does not apply to exams taken within three days of purchase, to material that was downloaded but never used in an exam attempt, or to free products and expired orders, and the candidate name must match the payer name. If you would rather not take a refund, you can instead exchange your purchase for two free exam preparation products of equal value and keep the update service on your original product.

Delivery is instant: your download is sent to your email within one minute of payment, with no limit on how many computers you may install the material on. If nothing arrives within two hours, check your spam folder and contact customer service for help.

What topics are covered in the S90.20 exam?

The SOA Security Lab exam blueprint is organized into 5 domains. The first three are:

• Fundamental Security for Services, Microservices & SOA
• Microservice Technology Concepts
• Fundamental SOA, Services & Microservices

For the complete domain-by-domain breakdown, scroll up to the full exam topics outline above and use it to plan how you distribute your study time.

SOA Security Lab Sample Questions:

Question 1

Service Consumer A sends a request message to Service A (1), after which Service A sends a request message with security credentials to Service B (2). Service B authenticates the request and, if the authentication is successful, writes data from the request message into Database B (3). Service B then sends a request message to Service C (4), which is not required to issue a response message. Service B then sends a response message back to Service A (5). After processing Service B's response, Service A sends another request message with security credentials to Service B (6). After successfully authenticating this second request message from Service A, Service B sends a request message to Service D (7). Service D is also not required to issue a response message. Finally, Service B sends a response message to Service A (8), after which Service A records the response message contents in Database A (9) before sending its own response message to Service Consumer A (10).

To use Service A, Service Consumer A is charged a per usage fee. The owner of Service Consumer A has filed a complaint with the owner of Service A, stating that the bills that have been issued are for more usage of Service A than Service Consumer A actually used.
Additionally, it has been discovered that malicious intermediaries are intercepting and modifying messages being sent from Service B to Services C and D.
Because Services C and D do not issue response messages, the resulting errors and problems were not reported back to Service B.
Which of the following statements describes a solution that correctly addresses these problems?

A. Messages sent to Services C and D must be protected using transport-layer encryption in order to ensure data confidentiality. Service consumers of Service A must be authenticated using X.509 certificates because they can be reused for several request messages.
B. Apply the Service Perimeter Guard and the Message Screening patterns together to establish a perimeter service between Service Consumer A and Service A.
The perimeter service screens and authenticates incoming request messages from Service Consumer A.
After successful authentication, the perimeter service generates a signed SAML assertion that is used by the subsequent services to authenticate and authorize the request message and is also carried forward as the security credential included in messages sent to Services C and D.
C. The Data Confidentiality and Data Origin Authentication patterns need to be applied in order to establish message-layer confidentiality and integrity for messages sent to Services C and D.
The Direct Authentication pattern can be applied to require that service consumer be authenticated in order to use Service A.
D. Apply the Brokered Authentication to establish an authentication broker between Service Consumer A and Service A that can carry out the Kerberos authentication protocol. Before invoking Service A, Service Consumer A must request a ticket granting ticket and then it must request service granting tickets to all services in the service composition, including Services C and D.
Messages sent by Service B to Services C and D must further be encrypted with the public key of Service Consumer A.

Question 2

Service Consumer A sends a request to Service A (1). Service A replies with an acknowledgement message (2) and then processes the request and sends a request message to Service B (3). This message contains confidential financial data. Service B sends three different request messages together with its security credentials to Services C.
D.
and E (4, 5, 6). Upon successful authentication, Services C.
D. and E store the data from the message in separate databases (7.8, 9). Services B.
C.D, and E belong to Service Inventory A, which further belongs to Organization B.
Service Consumer A and Service A belong to Organization A.

Organization B decides to create a new service inventory (Service Inventory B) for services that handle confidential data. Access to these services is restricted by allocating Service Inventory B its own private network. Access to this private network is further restricted by a dedicated firewall. Services C, D and E are moved into Service Inventory B, and as a result. Service B can no longer directly access these services.
How can this architecture be changed to allow Service B to access Services C, D and E in a manner that does not jeopardize the security of Service Inventory B while also having a minimal impact on the service composition's performance?

A. The Service Perimeter Guard pattern is applied together with the Brokered Authentication pattern. A new perimeter service is created to intercept all request messages sent to services inside the private network (inside Service Inventory B), before they reach the firewall. The perimeter service also acts as the authentication broker that authenticates request messages sent to Services C, D, and E by evaluating the accompanying security credentials and issuing a security token to be used by Service B when accessing Services C, D, and E.
B. The Brokered Authentication pattern is applied by extending the firewall functionality with a single sign-on mechanism. Because the firewall already restricts accesses to Service Inventory B, adding authentication logic to the firewall optimizes the performance of the overall security architecture. Service B needs to be authenticated by the authentication broker only once in order to get a security token that can be used to access Services C, D, and E.
This eliminates the need for Service B to authenticate several times during the same service composition.
C. The Data Confidentiality pattern is applied together with the Direct Authentication pattern. A new utility service is created to validate request messages sent to Service Inventory B.
Service B must encrypt the message content using the utility service's public key and attach its own digital certificate to the request message. This message is first evaluated by the firewall to filter out requests from disallowed sources and can then be forwarded to the utility service, which then verifies the identity of the message originator (using a digital certificate) and decrypts the request message contents. If the originator is authorized to access Services C, D, and E, the appropriate request messages are sent to these services.
D. The Service Perimeter Guard pattern is applied together with the Message Screening pattern. A new perimeter service is created specifically for Service Inventory B.
This service filters all messages before they reach the firewall and further evaluates the IP address of the messages to verify the identity of the message originators. If the originator is successfully authenticated, then the perimeter guard checks the request message for potentially malicious content. If the request message does not contain malicious content, it is sent through the firewall to proceed to Services C, D, and E for further processing.

Question 3

Service A is a publically accessible service that provides free multimedia retrieval capabilities to a range of service consumers. To carry out this functionality, Service A is first invoked by Service Consumer A (1). Based on the nature of the request message received from Service Consumer A, Service A either invokes Service B or Service C.
When Service B is invoked by Service A (2A) it retrieves data from publicly available sources (not shown) and responds with the requested data (3A). When Service C is invoked by Service A (2B) it retrieves data from proprietary sources within the IT enterprise (not shown) and responds with the requested data (3B). After receiving a response from Service B or Service C, Service A sends the retrieved data to Service Consumer A (4).
Service B does not require service consumers to be authenticated, but Service C does require authentication of service consumers. The service contract for Service A therefore uses WS-Policy alternative policies in order to express the two different authentication requirements to Service Consumer A.
When Service Consumer A sends a request message (1), Service A determines whether the request requires the involvement of Service C and then checks to ensure that the necessary security credentials were received as part of the message. If the credentials provided by Service Consumer A are verified. Service A creates a signed SAML assertion and sends it with the request message to Service C (2B) This authentication information is protected by public key encryption However, responses to Service Consumer A's request message (3B, 4) are not encrypted for performance reasons.

The owner of Service C is planning two changes to the service architecture: 1. A fee will be charged to Service Consumer A (or any service consumer) using Service C.
2. The response messages issued by Service C need to be secured in order to prevent unauthorized access. An analysis of Service C's usage statistics reveals that a group of service consumers specifically request the retrieval of multimedia data on a frequent basis.
To promote the usage of Service C to these types of service consumers, the owner of Service C plans to offer a special discount by allowing unlimited multimedia retrievals for a fixed monthly price. Service consumers that do not subscribe to this promotion will need to pay for each request individually. It is anticipated that the new promotion will significantly increase the usage of Service C.
The owner of Service C therefore wants to ensure that the security added to the response messages has a minimal impact on Service C's runtime performance.
What steps can be taken to fulfill these requirements?

A. Design Service C to generate a message digest of the response message and encrypt it with the service consumer's public key. Because the message digest is typically small, the performance of public key encryption is acceptable. This approach also ensures that only the service consumer can decrypt the response message using the corresponding private key.
B. Use symmetric session keys so that for each response message, Service C generates a session key and encrypts the response message using this session key. The session key is then encrypted (using the service consumer's public key) and attached to the encrypted response. A single session key can then be used by Service C for communication with all service consumers that subscribe to the promotion.
C. Because the services in this service composition already rely on public key encryption to provide authentication, Service C can provide message confidentiality by encrypting the response message with Service Consumer A's public key. This will ensure that only the intended recipient, in possession of the corresponding private key, can decrypt the response message. To further reduce the performance impact of encryption, Service C can generate a new public-private key pair to be used by service consumers subscribed to the promotion. By securely distributing the private key to each of these service consumers, Service C only needs to encrypt the response messages once with the public key.
D. Design the service composition architecture so that the encryption of the response messages is performed by Service B and Service C.
To reduce the performance impact, a policy can be added to Service A's service contract in order to require the encryption of all response messages, regardless of the type of service consumer making the request.
Further, a new utility service can be added to the service composition. This service can be responsible for obtaining the public key of the service consumer and forwarding the key along with the request message to the appropriate service (Service B or Service C). The service receiving the message can then encrypt the response message with the received public key. Service A can then forward the encrypted response to the service consumer.
This approach ensures that only authorized service consumers will be able to access response messages.

Solutions: