The Exception Shielding pattern was applied to the design of Service A.
During testing, it is revealed that Service A is disclosing sensitive error information in one of its response messages. How is this possible?

• A. The Trusted Subsystem pattern has already been applied to Service A, thereby conflicting with the application of the Exception Shielding pattern.
• B. It is the Message Screening pattern, not the Exception Shielding pattern, that prevents a service from transmitting sensitive error information in response messages.
• C. The Exception Shielding pattern states that, in case of an error, the service should not send back any message at all, because this would implicitly tell the service consumer that something has gone wrong, thereby exposing vulnerabilities.
• D. None of the above.

Service A acts as a trusted subsystem for a shared database. The database contains sensitive information and performs strict validation on all incoming data modification requests. In case of any invalid input values, the database throws detailed error messages that are required for debugging purposes and are automatically relayed back to service consumers by Service A.
Recently, while going through the access logs of the database, it has been reported that attempts have been made to connect to the database from outside the organization. What can be done to prevent such attacks while preserving the existing database debugging requirements?

• A. The Service Perimeter Guard pattern needs to be applied in order to centralize access to the database.
• B. The Data Confidentially pattern needs to be applied so that all request and response messages exchanged by Service A are encrypted.
• C. The Data Origin Authentication pattern needs to be applied in order to incorporate digital signatures in request and response messages exchanged by Service A.
• D. None of the above.

The use of XML schemas for data validation helps avoid several types of data-centric threats.

• A. True
• B. False

The service contract for Service A uses an XML schema that does not specify the maximum length for the CustomerAddress XML element. A service consumer sends a message that contains a very long string of characters inside the CustomerAddress XML element. This can be an indication of what types of attacks?

• A. Buffer overrun attack
• B. XPath injection attack
• C. XML parser attack
• D. Insufficient authorization attack