Updated Arcitura Education S90.20 Exam Questions (July 2026)

About S90.20 Exam

The S90.20 (SOA Security Lab) certification exam by Arcitura Education is a comprehensive assessment designed for IT professionals seeking to validate their expertise in Service-Oriented Architecture (SOA) security principles and practices. This advanced certification covers critical topics including security design patterns, threat analysis, encryption mechanisms, identity management, and secure service implementation. Candidates will demonstrate their ability to apply security best practices in real-world SOA environments, making this certification highly valuable for architects, developers, and security professionals working with enterprise-level services and cloud-based solutions.

Professionals pursuing the S90.20 certification should have foundational SOA knowledge and practical experience in security implementation. To effectively prepare for this rigorous exam, candidates benefit greatly from updated exam dumps and comprehensive practice tests that mirror the actual testing environment. These resources help identify knowledge gaps, reinforce key concepts, and build confidence before the official assessment. By utilizing quality study materials and practice questions, candidates can significantly improve their passing rate and gain practical insights into SOA security scenarios. The S90.20 certification demonstrates professional commitment to mastering enterprise security architecture and positions candidates for advanced roles in SOA-focused organizations.

Exam Topics & Objectives

Fundamental SOA, Services & Microservices

Microservice Technology Concepts

Fundamental Security for Services, Microservices & SOA

Advanced Security for Services, Microservices & SOA

Security Lab for Services, Microservices & SOA

4-Week Study Plan for S90.20

Week 1: Fundamental SOA & Services Architecture

Study SOA principles: service orientation, loose coupling, reusability, and discoverability
Learn service contract design and standardization practices
Understand service taxonomy and classification systems
Review REST vs SOAP architectural patterns
Practice identifying service boundaries in enterprise systems
Complete practice questions on SOA governance models
Study enterprise service bus (ESB) fundamentals and message patterns

Week 2: Microservices Architecture & Technology Concepts

Master microservices design patterns: API Gateway, Circuit Breaker, Service Registry
Study containerization technologies (Docker) and orchestration (Kubernetes basics)
Learn microservices communication: synchronous (REST, gRPC) and asynchronous (message queues)
Understand deployment strategies: blue-green, canary, rolling deployments
Review service mesh concepts and technologies (Istio, Linkerd overview)
Study distributed tracing and observability in microservices
Practice architectural decision-making for microservices vs monoliths

Week 3: Fundamental & Advanced Security for Services

Study authentication mechanisms: OAuth 2.0, OpenID Connect, JWT tokens
Learn authorization patterns: RBAC, ABAC, and policy enforcement
Understand API security: rate limiting, throttling, API keys, and mutual TLS
Review encryption standards: TLS/SSL, data encryption at rest and in transit
Study secure service-to-service communication and mTLS implementation
Learn vulnerability management in service ecosystems
Practice identifying security threats in distributed architectures
Study advanced topics: zero-trust security, service isolation, and network policies

Week 4: Security Lab Implementation & Exam Preparation

Complete hands-on security lab exercises: configure TLS certificates between services
Practice implementing OAuth 2.0 flows in microservices environments
Set up service authentication and authorization policies
Execute security testing: penetration testing scenarios for service interactions
Configure API gateway security controls and request validation
Review and troubleshoot security misconfigurations in lab environments
Take full-length practice exams simulating actual S90.20 conditions
Review weak areas and complete supplementary practice questions
Study exam format, time management, and question interpretation strategies

Sample S90.20 Questions

Practice with real exam-style questions. Reveal answers to verify your knowledge.

Q1 MultipleChoice

Services A, B, and C reside in Service Inventory A and Services D, E, and F reside in Service Inventory B .Service B is an authentication broker that issues WS-Trust based SAML tokens to Services A and C upon receiving security credentials from Services A and C .Service E is an authentication broker that issues WS-Trust based SAML tokens to Services D and F upon receiving security credentials from Services D and E .Service B uses the Service Inventory A identify store to validate the security credentials of Services A and C .Service E uses the Service Inventory B identity store to validate the security credentials of Services D and F .To date, the two service inventories have existed independently from each other. However, a requirement has emerged that the services in Service Inventory A need to be able to use the services in Service Inventory B, and vice versa. How can cross-service inventory message exchanges be enabled with minimal changes to the existing service inventory architectures and without introducing new security mechanisms?

ABecause SAML tokens cannot be used across multiple security domains, authentication brokers C and E need to be replaced with one single authentication broker so that one token issuer is used for all services across both of the service inventories.

BThe current security mechanism already fulfills the requirement because SAML tokens can be used across multiple security-domains. The only change required is for each authentication broker to be configured so that it issues service inventory-specific assertions for SAML tokens originating from other service inventories.

CThe individual domain service inventories need to be combined into one enterprise service inventory. The Service Perimeter Guard pattern can be applied to establish a contact point for request messages originating from outside the service inventory. Within the service inventory, services no longer need to be authenticated because they are all part of the same trust boundary.

DThe Trusted Subsystem pattern is applied to encapsulate Services B and E using a central utility service that balances request and response messages exchanged between Services B and E, depending on which service inventory the messages originate from. The utility service also contains transformation logic to ensure that the SAML tokens issued by Services B and E are compatible. This guarantees that an issued SAML token can be used across Service Inventories A and B without further need for runtime conversion.

Q2 MultipleChoice

Service Consumer A submits a request message with security credentials to Service A (1). The identity store that Service A needs to use in order to authenticate the security credentials can only be accessed via a legacy system that resides in a different service inventory. Therefore, to authenticate Service Consumer A, Service A must first forward the security credentials to the legacy system (2). The legacy system then returns the requested identity to Service A (3). Service A authenticates Service Consumer A against the identity received from the legacy system. If the authentication is successful, Service A retrieves the requested data from Database A (4), and returns the data in a response message sent back to Service Consumer A (5). Service A belongs to Service Inventory A which further belongs to Security Domain A and the legacy system belongs to Service Inventory B which further belongs to Security Domain B .(The legacy system is encapsulated by other services within Service Inventory B, which are not shown in the diagram.) These two security domains trust each other. Communication between Service A and the legacy system is kept confidential using transport-layer security. No intermediary service agents currently exist between the two service inventories. However, it has been announced that due to the introduction of new systems, some intermediary service agents may be implemented in the near future. Additionally, the legacy system has been scheduled for retirement and will be replaced by a new identity management system that will provide a new identity store. Because the new identity store will need to serve many different systems, there are concerns that it could become a performance bottleneck. As a result, services (including Service A and other services in Security Domains A and B) will not be allowed to directly access the new identity store. Which of the following statements describes a solution that can accommodate the requirements of the new identity store, the authentication requirements of Service A, and can further ensure that message exchanges between Security Domains A and B remain confidential after intermediary service agents are introduced?

AApply the Trusted Subsystem pattern to implement a utility service abstracting the new identity management system. Service A forwards Service Consumer As credentials to the utility service to verify Service Consumer As identity. The utility service authenticates the request originating from Service A .After successful authentication, the utility service uses its own credentials to retrieve the requested identity, and then send the identity to Service A, Therefore, effectively reducing the processing need of the identity management system. The current transport-layer security can still be used, in order to secure the communication between Service A and the new utility service, as it more efficient than the message-layer security.

BApply the Trusted Subsystem pattern by abstracting away the new identity management system using a utility service that authenticates the request from Service A and then uses its own credentials to retrieve the requested identity from the new identity management system. For the utility service to authenticate Service As request, it needs to be provisioned with a new identity database that contains identities for all authorized service consumers of the new utility service. In order to secure the communication between Service A and the new utility service, use message-layer security as it provides security over multiple hops considering the need to secure the message in case an intermediary is introduced in future.

CReplicate the identity database used by the new identity management system. Because the Security Domains A and B trust each other, protection of the identity store is guaranteed. Use Service Agents to monitor changes to the identity database used by the new identity management system and to update the replica. This would satisfy the security needs of Service A, would eliminate the need to request services from Service Inventory B, and ensure that current identity information is available for Service A .Because Service A would not need to access services across different trust domains, the current transport-layer security is sufficient.

DApply the Brokered Authentication pattern to establish an authentication broker. Instead of Service A directly authenticating-Service Consumer A, Service Consumer A submits a request message with security credentials to the authentication broker, which authenticates Service Consumer A against the new identity store and then issues a SAML token to Service Consumer A that it can use for message exchanges with other services, if necessary. In order to secure cross-service inventory message exchanges, the Data Confidentiality pattern is applied to establish message-layer security.

Q3 MultipleChoice

Service A provides a customized report generating capability. Due to infrastructure limitations, the number of service consumers permitted to access Service A concurrently is strictly controlled. Service A validates request messages based on the supplied credentials (1). If the authentication of the request message is successful, Service A sends a message to Service B (2) to retrieve the required data from Database A (3). Service A stores the response from Service B (4) in memory and then issues a request message to Service C (5). Service C retrieves a different set of data from Database A (6) and sends the result back to Service A (7). Service A consolidates the data received from Services B and C and sends the generated report in the response message to the service consumer (8). It has been discovered that attackers have been gaining access to confidential data exchanged between Service A and Service B, and between Service A and its service consumers. What changes can be made to this service composition architecture in order to counter this threat?

AApply the Service Perimeter Guard pattern in order to protect message exchanges between Service A and its service-consumers. Apply the Direct Authentication pattern in order to protect message exchanges between Service A and Service B .

BApply the Direct Authentication pattern in order to protect message exchanges between Service A and its service consumers and between Service A and Service B .This approach will establish a password-based authentication mechanism that relies on a local identity store and will therefore prevent access by attackers.

CApply the Data Origin Authentication pattern to protect the final report sent by Service A to its service consumer. Service A can generate a message digest of the final report, after which it can sign the digest with its own private key. It then can send both the final report and the signed-message digest to its service consumer. This service consumer can generate its own message digest, decrypt the signed digest using the public key of Service A (which proves that Service A sent the message), and then compare the two digests. If the digests match, it guarantees that the final report was not tampered with during transmission.

DNone of the above

Q4 MultipleChoice

Service Consumer A sends a request message with a Username token to Service A (1). Service B authenticates the request by verifying the security credentials from the Username token with a shared identity store (2), To process Service Consumer A's request message. Service A must use Services B, C, and D .Each of these three services also requires the Username token (3. 6, 9) in order to authenticate Service Consumer A by using the same shared identity store (4, 7, 10). Upon each successful authentication, each of the three services (B, C, and D) issues a response message back to Service A (5, 8, 11). Upon receiving and processing the data in all three response messages, Service A sends its own response message to Service Consumer A (12). There are plans implement a single sign-on security mechanism in this service composition architecture. The service contracts for Services A, C, and D can be modified with minimal impact in order to provide support for the additional messaging requirements of the single sign-on mechanism. However, Service B's service contract is tightly coupled to its implementation and, as a result, this type of change to its service contract is not possible as it would require too many modifications to the underlying service implementation. Given the fact that Service B's service contract cannot be changed to support single sign-on, how can a single sign-on mechanism still be implemented across all services?

AApply the Brokered Authentication pattern so that Service A acts as an authentication broker that issues a SAML token on behalf of Service Consumer A, and forwards this token to Services C and D .Create a new utility service is positioned between Service A and Service B .This utility service perform a conversion of the SAML token to a Username token, and then forwards the Username token to Service B so that Service B can still perform authentication of incoming requests using its own security mechanism.

BApply the Brokered Authentication pattern to establish Service A as an authentication broker that issues a SAML token for Service Consumer A and forwards Service Consumer A's token to other services. Apply the Trusted Subsystem pattern to create a utility service that acts as a trusted subsystem for Service B .This utility service is able to perform authentication using the SAML token from Service A and can then generate a Username token by embedding its own credentials when accessing Service B .This way, Service B can perform authentication of requestmessages as it does now, but it can still participate in the single sign-on message exchanges without requiring changes to its service contract.

CApply the Brokered Authentication pattern so that Service A acts as an authentication broker that issues a SAML token for Service Consumer A and forwards Service Consumer A's token to Services C and D .Create a second service contract for Service B that supports single sign-on. This way, Service B can still perform authentication of incoming requests using the old service contract while allowing for the processing of SAML tokens using the new service contract.

DReplace the Username tokens with X.509 digital certificates. This allows for the single sign-on mechanism to be implemented without requiring changes to any of the service contracts.

Q5 MultipleChoice

Service Consumer A sends a request message to Service A (1), after which Service A sends a request message to Service B (2). Service B forwards the message to have its contents calculated by Service C (3). After receiving the results of the calculations via a response message from Service C (4), Service B then requests additional data by sending a request message to Service D (5). Service D retrieves the necessary data from Database A (6), formats it into an XML document, and sends the response message containing the XML-formatted data to Service B (7). Service B appends this XML document with the calculation results received from Service C, and then records the entire contents of the XML document into Database B (8). Finally, Service B sends a response message to Service A (9) and Service A sends a response message to Service Consumer A (10). Services A, B and D are agnostic services that belong to Organization A and are also being reused in other service compositions. Service C is a publicly accessible calculation service that resides outside of the organizational boundary. Database A is a shared database used by other systems within Organization A and Database B is dedicated to exclusive access by Service B .Recently, Service D received request messages containing improperly formatted database retrieval requests. All of these request messages contained data that originated from Service C .There is a strong suspicion that an attacker from outside of the organization has been attempting to carry out SOL injection attacks. Furthermore, it has been decided that each service that writes data to a database must keep a separate log file that records a timestamp of each database record change. Because of a data privacy disclosure requirement used by Organization A, the service contracts of these services need to indicate that this logging activity may occur. How can the service composition architecture be improved to avoid SQL injection attacks originating from Service C - and - how can the data privacy disclosure requirement be fulfilled?

AApply the Service Perimeter Guard pattern together with the Message Screening pattern in order to establish a perimeter service with message screening logic. Position the perimeter service between Service C and Service B .The message screening logic rejects or filters out potentially harmful content in messages sent from Service C, prior to being forwarded to Service B .Secondly, update the service contracts for Services B and D with an optional WS-Policy assertion that provides service consumers with the option of complying to the logging requirements.

BApply the Data Origin Authentication pattern to authenticate data received from Service C .Service C digitally signs any datasent in response messages to Service B .Service B can then verify that the data has not been modified during transit and that it originated from Service C .Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity.

CApply the Data Origin Authentication pattern to authenticate data received from Service C .Service C digitally signs any datasent in response messages to Service B .Service B can then verify that the data has not been modified during transit and that it originated from Service C .Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity. The service contracts for Services B and D are updated with an optional WS-Policy assertion that provides service consumers with the option of complying to the logging requirements.

DApply the Message Screening pattern in order to establish a service agent with message screening logic. Position the service agent between Service C and Service B .The service agent's message screening logic can reject or filter out potentially harmful content in messages sent from Service C, before being processed by Service B .Secondly, update the service contracts for Services B and D with an ignorable WS-Policy assertion that communicates the possibility of the logging activity.

Get access to all 30 verified questions with detailed answers.

Unlock All S90.20 Questions

Frequently Asked Questions

The S90.20 is a SOA Security Lab certification exam offered by Arcitura Education that validates practical knowledge of SOA security concepts and implementation. It is a hands-on, lab-based examination designed to test real-world skills in securing service-oriented architecture environments.

Candidates should have foundational knowledge of SOA principles and security concepts, typically gained through completing the SOA Security course or equivalent experience. It is recommended to have the S90.19 credential or equivalent understanding before attempting the S90.20 lab exam.

The S90.20 is a lab-based practical exam that typically takes several hours to complete, testing hands-on security implementation skills in a controlled environment. Candidates must perform specific security-related tasks and configurations within a simulated SOA infrastructure.

The exam covers SOA security mechanisms, including service security, message protection, identity management, and threat mitigation strategies. It tests practical skills in implementing security patterns and addressing common vulnerabilities in service-oriented architectures.

The S90.20 uses a practical performance-based scoring system where candidates must successfully complete security lab tasks to demonstrate competency. The specific passing score requirements are determined by Arcitura Education and are based on successful completion of mandatory security implementations.

S90.20 Exam Questions & Answers

About S90.20 Exam

Exam Topics & Objectives

4-Week Study Plan for S90.20

Week 1: Fundamental SOA & Services Architecture

Week 2: Microservices Architecture & Technology Concepts

Week 3: Fundamental & Advanced Security for Services

Week 4: Security Lab Implementation & Exam Preparation

Sample S90.20 Questions

Frequently Asked Questions

Pass S90.20 First Time

S90.20 Exam Questions & Answers

About S90.20 Exam

Exam Topics & Objectives

4-Week Study Plan for S90.20

Week 1: Fundamental SOA & Services Architecture

Week 2: Microservices Architecture & Technology Concepts

Week 3: Fundamental & Advanced Security for Services

Week 4: Security Lab Implementation & Exam Preparation

Sample S90.20 Questions

Frequently Asked Questions

What is the S90.20 certification exam?

What are the prerequisites for taking the S90.20 exam?

How long is the S90.20 exam and what is the format?

What topics are covered in the S90.20 exam?

How is the S90.20 exam scored and what is the passing grade?

Pass S90.20 First Time