Advanced XML & SOAP Web Services test (Advanced)

Sample questions

5 sample questions from the Advanced XML & SOAP Web Services test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. What is the correct behavior for validating a WS-Security timestamp (`wsu:Timestamp`) during message processing?

   1. The timestamp's Created and Expires values are ignored, and replay attacks are prevented using the message's sequence number.
   2. Only the Created value is checked against the current time, and the nonce is not required for replay prevention.
   3. The timestamp's Created and Expires values must be checked against the current time, and the nonce must be validated to prevent replay attacks.
   4. The Expires value is checked against the current time, and the nonce is used to determine the message's priority.

   Answer: C. The timestamp's Created and Expires values must be checked against the current time, and the nonce must be validated to prevent replay attacks.

   In WS-Security, the `wsu:Timestamp` element contains `Created` and `Expires` values that must be validated against the current time to ensure the message is not expired or too old. Additionally, the nonce must be checked to prevent replay attacks, ensuring that each message is processed only once.

2. Which statement best describes the difference in versioning complexity between SOAP and REST?

   1. SOAP's versioning is more complex due to WSDL and WS-* standards, while REST uses media types and URL paths for versioning.
   2. SOAP uses URL paths for versioning, while REST uses WSDL contracts and WS-* standards for versioning.
   3. SOAP and REST both rely on XML-based versioning strategies, making them equally complex.
   4. SOAP and REST have similar versioning complexity, as both use HTTP headers for versioning.

   Answer: A. SOAP's versioning is more complex due to WSDL and WS-* standards, while REST uses media types and URL paths for versioning.

   SOAP versioning is tightly coupled with WSDL contracts and WS-* standards, requiring changes to the WSDL and potentially breaking compatibility if not handled carefully. REST, on the other hand, typically uses media types (e.g., application/vnd.example.v1+json) or URL paths (e.g., /api/v1/resource) for versioning, making it more flexible and easier to manage.

3. A contract-first web service is deployed, but it fails to be compatible with other systems. What is the most likely correct configuration of the endpoint?

   1. The endpoint relies on the service's implementation to define the message structure.
   2. The endpoint uses a custom style not defined in the WSDL.
   3. The endpoint uses an rpc/encoded style, which is not WS-I compliant.
   4. The endpoint is configured with a document/literal wrapped style, which is the WS-I Basic Profile recommendation.

   Answer: D. The endpoint is configured with a document/literal wrapped style, which is the WS-I Basic Profile recommendation.

   In contract-first web services, the WSDL is written first, and it defines the endpoint's style. The document/literal wrapped style is the WS-I Basic Profile recommendation, ensuring compatibility and stability across different platforms and languages. Other options are either incorrect or not directly related to the contract-first configuration.

4. When a SOAP fault occurs over HTTP, how is it localized and what HTTP status code is returned?

   1. The SOAP fault is returned in the Body with HTTP status 500.
   2. The SOAP fault is returned in the Header with HTTP status 400.
   3. The SOAP fault is returned in the Footer with HTTP status 503.
   4. The SOAP fault is returned in the Body with HTTP status 200.

   Answer: A. The SOAP fault is returned in the Body with HTTP status 500.

   SOAP faults are always returned in the Body of the SOAP message, and when using HTTP as the transport, they are accompanied by an HTTP status code of 500 (Internal Server Error) for SOAP 1.1. This ensures that the fault is properly localized within the message and the HTTP layer provides a general indication of the error.

5. Which of the following accurately describes the process of implementing a contract-first web service?

   1. Use REST principles to define the service contract and then generate the WSDL.
   2. Write the service implementation first and generate the WSDL from the code.
   3. Define the XSD and WSDL first, then generate code from them.
   4. Use XML Schema to define the service behavior and then generate the WSDL from the schema.

   Answer: C. Define the XSD and WSDL first, then generate code from them.

   In contract-first web services, the XSD and WSDL are designed first to define the service's interface and data structures. Code is then generated from these contracts, ensuring consistency and stability across different platforms and versions. This approach is the core principle of contract-first design, as opposed to code-first, where the WSDL is generated from code.