1z0-479 oracle. Number: 1z0-479 Passing Score: 800 Time Limit: 120 min.

Transcription

1 1z0-479 oracle Number: 1z0-479 Passing Score: 800 Time Limit: 120 min

2 Exam A QUESTION 1 What is the role of a user data store in Oracle Identity Federation (OIF) 11g when it is configured as an Identity Provider (IdP)? (Choose the best answer.) A. Oracle Identity Federation uses the repository to map the information in received assertions to user identities at the destination. B. When creating a new federation, Oracle Identity Federation uses the repository to identify a user and link the new federation ti that user's account. C. Oracle Identity Federation uses the repository to authorize users for access to protected resources. D. Oracle Identity Federation uses the repository to verify user identities and to build protocol assertions. Correct Answer: C /Reference: QUESTION 2 You have defined an application and its associated policies in Oracle Entitlements Server (OES) to protect your customer's banking application. This application is written in Java and deployed on WebLogic, using the WebLogic security module for integration. Using the policy simulator, your policy logic appears to be correct. However, while testing, it appears that your authorization policies are not being applied and all authorization decisions are being returned as false from the security module. Which two configuration settings in your OES admin console may be the cause if this problem? (Choose two.) A. The security module is configured to pull policies instead of having policies pushed to it. B. The application has not been associated with the security module in the OES admin console. C. The security module was not registered correctly when config.sh was run. D. You have not distributed the policies in the OES admin console. E. The security module has not been started. Correct Answer: BD

3 /Reference: QUESTION 3 Identify two artifacts that are present in an application domain of Oracle Access Manager 11g. A. Resources B. Authentication Scheme C. Authentication Policies D. Authentication Modules E. Data Sources Correct Answer: AB /Reference: Reference (5.1.1) QUESTION 4 Identify two registration artifacts that are created when an 11g WebGate is registered using the Oracle Access Management console. A. osso.conf B. oaam_cli.properties C. OAMRequest_short.xml D. ObAccessClient.xml E. cwallet.sso Correct Answer: DE /Reference: Reference QUESTION 5 Your portfolio trading customer is using Oracle Entitlements Server (OES) to externalize authorization decisions from their share dealing application.

4 The trading customer has stipulated the following policy need to be implemented: - Customers can purchase shared only if their credit limit is 20% higher than the value of the shares in their basket at checkout. The value of basket and a customer's credit limit are both available in the application, and can be passed to OES as part of an authorization request if required. You are looking to implement the most efficient policy within OES. Which three steps would you implement? A. Configure a Policy Information Point (PIP) to retrieve the basket value and credit limit from an internal system. B. Configure an authorization policy to include a condition that executes a custom function. C. Configure the application to include the basket value and credit limit in the authorization request. D. Create a custom function to calculate the difference between the basket value and the credit limit. E. Use a PIP to call a web service that returns the calculated difference between the basket value and the credit limit. F. Return an obligation that contains the difference value so that the application can decide whether to allow the transaction or not. Correct Answer: BDF /Reference: QUESTION 6 Which statement is true about a single sign-on operation initiated from a Service Provider using SAML 2.0 in Oracle Identity Federation (OIF)? A. Oracle Access Manager is required as a Service Provider integration module. B. An Oracle Access Manager WebGate is needed to protect the target web resource and redirect requests to OIF. C. HTTP post binding is only supported. D. Any HTTP request hitting the target resource is redirected to the Service Provider's OIF instance. Correct Answer: A /Reference: QUESTION 7 What would you need to configure to use Oracle Adaptive Access Manager (OAAM) along with Mobile Single Sign-On, by using Oracle Access Management Mobile services?

5 A. An appropriate security handler plug-in name needs to be configured for the Mobile Service domain to use OAAM. B. An authentication scheme needs to be configured for the Mobile Service domain to reflect OAAM use. C. A separate application profile needs to be created for OAAM. D. The Mobile Service domain needs to specify a configuration for OAAM. Correct Answer: B /Reference: QUESTION 8 You have configured a new pattern in Oracle Adaptive Access Manager (OAAM) to capture login times of devices. Your customer wants to ensure that devices that are used outside their normal times are blocked. After creating your pattern, which two additional steps must you perform to configure OAAM to meet this requirement? A. Create a transaction definition for the pattern. B. Create a new rule in an existing policy that contains an appropriate condition to evaluate your new pattern. C. Link your chosen policy to the appropriate user groups. D. Configure a block action for your new rule. E. Restart the OAAM Managed Server for the pattern to take effect. Correct Answer: AE /Reference: QUESTION 9

6 Identify two Oracle products that have a certified out-of-the-box integration with Oracle Entitlements Server 11g. A. Oracle API Gateway B. Oracle Virtual Private Database C. Oracle Service Bus D. Oracle Service Registry E. Oracle NoSQL Database Correct Answer: BC /Reference: QUESTION 10 How would you configure an authentication policy for federation in Oracle Access Management 11gR2? A. There are no authentication policies for federation. B. Authentication policies are defined in the Oracle Identity Federation (OIF) console. C. Authentication policies are defined in the Oracle Access Management console for each domain. D. Authentication policies are provided in assertions. Correct Answer: C /Reference: QUESTION 11 What performance data can you see from the Oracle Adaptive Access Manager (OAAM) 11g admin dashboard?

7 A. average processing times B. number of threads running C. CPU utilization D. memory utilization Correct Answer: A /Reference: Reference: QUESTION 12 Which statement is true about Oracle Access Manager 11g session management? A. Oracle Access Manager 11g uses Coherence to reliably cache millions of user sessions simultaneously. B. Oracle Access Manager 11g uses encrypted cookies that track the login time, authentication level, and the idle and maximum session times. C. Oracle Access Manager 11g session information is stored in lightweight directory access protocol (LDAP) directory. D. Oracle Access Manager 11g requires an Oracle database to reliably store session information. Correct Answer: B /Reference: Reference: QUESTION 13 What value will you define in the Oracle Access Manager resource URL field to allow access to an application under the context root /procurement? A. /procurement B. /procurement/* C. /procurement/... D. /procurement/.../* Correct Answer: A

8 /Reference: QUESTION 14 OAM-OAAM basic integration, which is a native integration, requires the OAM server and OAAM admin server in the same access management domain. Which two statements are true in the case of OAM-OAAM basic integration? A. This is unique case in which OAAM data in stored in the OAM schema. B. The OAAM Managed Server needs to be configured in a separate domain. C. The OAAM extension libraries are bundled with the OAM server. D. The knowledge-based Authentication (KBA) challenge mechanism is available in this integration. E. Supported agents for this deployment are WebGate 10g and 11g. Correct Answer: CD /Reference: Reference: QUESTION 15 Which two cookies are created when yiu in to Oracle Access Manager 11g with 11g WebGates? A. ObSSOCookie B. OAM_ID C. OAM_AuthnCookie D. OAM_AuthzCookie E. WL_AUTHCOOKIE_JSESSIONID Correct Answer: AC /Reference: Reference: QUESTION 16 Which three types of attributes does Oracle Entitlements Server support?

9 A. resource attributes B. dynamic attributes C. context attributes D. information attributes E. request attributes Correct Answer: ABC /Reference: Reference: QUESTION 17 When managing Token Issuance conditions and rules in Security Token Service, who is granted access to a requested resource through the Allow type rule? A. Only partners are granted access; everyone else is denied access to the resource. B. Only the partners and users listed in a condition are granted access; everyone else is denied access to the resource. C. Users listed in a condition are granted access; everyone else is denied access to the resource. D. Only Relying Party Partners are granted access; everyone else is denied access to the resource. Correct Answer: B /Reference: Reference: (33.7.2) QUESTION 18 Which component acts as the certified WS-Trust client that can be used to communicate with Security Token Service? A. Token Consumer B. Token Administrator

10 C. OWSM Agent D. OPSS Security Keystore E. User Name Token (UTN) F. WS Policy Correct Answer: C /Reference: Reference: (table 34-1) QUESTION 19 At what checkpoint would you create a challenge policy for Knowledge-Based Authentication for online user authentication? A. Pre-authentication B. AuthentiPad C. Post-Authentication D. Device Identification Correct Answer: A /Reference: QUESTION 20 What are the three main roles that can be adopted by Oracle Access Management and Oracle Fusion Middleware components when using the Identity Context? A. Publisher B. Consumer C. Propagator D. Generator E. Evaluator F. Authorizer Correct Answer: ACE

11 /Reference: Reference: QUESTION 21 Identify three uses of the Knowledge-Based Authentication functionality provided by Oracle Adaptive Access Manager. A. first authentication for forgot password B. second factor authentication for change password C. offline SMS PIN-based authentication D. high risk user authentication E. user authorization Correct Answer: ABC /Reference: QUESTION 22 Which statement is true about Service Providers and Service Profiles in Oracle Access Management Mobile and Social? A. A service Provider instance may or may not have a corresponding Service Profile instance. B. A Service Profile instance may or may not have a corresponding Service Provider instance. C. Each Service Provider instance requires at least one corresponding Service Profile instance. D. One Service Profile cannot be assigned to multiple Service Domains. Correct Answer: C /Reference: Reference: QUESTION 23 When defining an attribute on the Relying Party Partner Profile in Security Token Service, which three types of attribute sources are supported?

12 A. User Store (LDAP) B. CSV File C. Incoming Token Data D. XML File E. Static Value F. User Store (Oracle Identity Analytics Identity Warehouse) Correct Answer: ACE /Reference: Reference: (relying party profile attributes) QUESTION 24 Identify two functions of the heartbeat check performed by Oracle Access Manager Access Servers. A. It checks if an LDAP store can be accessed. B. It check if a WebGate can be accessed. C. It check if a session cache store can be accessed. D. It check if a policy store can be accessed. E. It check if a database can be accessed. Correct Answer: AD /Reference: Reference: (see note) QUESTION 25 What would you need to configure to migrate all agents (WebGates) with different transport security modes from Oracle Access Manager 10g to Oracle Access Manager 11g in the same transport security mode.

13 A. Set the migration_mode property in the oam_migration.properties file to COMPLETE. B. Set the agent_mode_to_override property in the oam_migration.properties file to the new security mode. C. Set the agent_mode_to_override property in the oam_migration.properties file to RETAIN_EXISTING. D. No configuration is required because this is done by default. Correct Answer: B /Reference: Reference: QUESTION 26 Which three statements are true about OAM-OAAM advanced integration? A. Advanced integration using Trusted Authentication Protocol (TAP) is available for OAAM and later only. B. Advanced integration without using TAP does not require the OAAM Managed Server, whereas advanced integration using TAP requires the OAAM Managed Server. C. Advanced integration with TAP works with both WebGate 10g and 11g, whereas advanced integration without TAP works with WebGate 10g only. D. Advanced integration with TAP works with WebGate 10g only, whereas advanced integration without TAP works with both WebGate 10g and 11g. E. In case of advanced integration using TAP, OAM acts as an asserter and not an authenticator. Correct Answer: BCE /Reference: QUESTION 27 Identify three attributes that are a part of mobile device fingerprinting by default when Oracle Adaptive Access Manager is used. A. Operating System Type B. Hardware IMEI Number C. Hardware MAC address D. Hardware IP Address Correct Answer: ABC

14 /Reference: Reference: (native mobile application) QUESTION 28 Identify two ways in which you can specify trusted Identity Provider (Idp) partners while configuring Service Provides (SP) in Oracle Access Management Identity Federation. A. Manually create a new Idp configuration and fill the form with all attributes. B. Import the metadata file generated from an Idp deployment to create a new Identity Provider configuration. C. Automatic discovery of an Idp populates the configuration data. D. A request can be broadcast to all IdPs and the one that matches returns its configuration data is populated. E. A sample XML configuration file is provided, which needs to be modified, and the Server needs to be restarted. Correct Answer: AB /Reference: QUESTION 29 Which service does the Session Management Engine (SME) use internally to provide a high performance, distributed caching system, and to enable the monitoring and management of user sessions in real time? A. Oracle ADF B. Oracle Coherence C. WebGates D. Oracle Adaptive Access Manager Correct Answer: B /Reference: : The Session Management Engine (SME) of Access Manager internally uses Oracle Coherence, a high performance distributed caching system, to enable the monitoring and management of millions of user sessions across the enterprise in real time. Oracle Coherence replicates and distributes session data across all

15 Access Manager run-time servers in the cluster and also communicates changes from the console to the run-time servers. The location of a session is transparent to the client. All Oracle Coherence traffic is automatically encrypted and it also performs automatic failover and reconciliation. For example, if one of the nodes in a cluster fails, Oracle Coherence automatically distributes data from the failed node to the distributed in-memory caches of the other nodes in the cluster. QUESTION 30 Identify two services offered by the Oracle Access Management Suite Plus 11g. A. web-perimeter security functions B. Identity Context C. Identity Provisioning D. Privileged Accounts Management E. Entitlement Certification Correct Answer: BE /Reference: QUESTION 31 Identify three required steps for configuring OAM-OAAM basic integration. A. Set the OAAMEnabled property to true in oam-config.xml. B. Target the OAAM JDBC data source to the OAM Managed Server. C. Protected a resource in an authentication policy using the OAAMBasic authentication scheme. D. Install SOA Suite and configure the Unified Messaging Service (UMS) delivery channel for One Time Pin (OTP). E. Install and configure Oracle Entitlements Server (OES). Correct Answer: ABC /Reference: QUESTION 32 How are Mobile and Social services enabled in Oracle Access Management Suite 11gR2?

16 A. by always installing them separately from Access Manager in order to be enabled B. by clicking the appropriate button in the System Configuration section of Available Services C. by clicking the appropriate button in the System Configuration section of Common Settings D. by clicking the appropriate button in the System Configuration section of Plugins Correct Answer: B /Reference: Reference: QUESTION 33 Identify two settings in the Authentication Scheme definition of Oracle Access Manager 11g. A. Authentication Password B. Challenge Method C. Authentication Level D. Error Message E. Authentication Id Correct Answer: BD /Reference: QUESTION 34 You are configuring Oracle Entitlements Server (OES) and have a requirement to make a connection to an external Policy Information Point (PIP) in order to retrieve an attribute for use in a condition. You need to modify the security module configuration to configure the PIP. Which two options do you have for making this modification?

17 A. Configure the PIP settings in your OES policy and distribute it to each security module as part of the policy distribution. B. Manually edit the jps-config.xml file on each security module. C. Use the OES admin console to define the PIP settings and write them to a database for each security module to retrieve during bootstrap. D. Use the SMConfig UI to configure the settings. Correct Answer: BD /Reference: QUESTION 35 Which statement is true about moving Oracle Access Management Mobile and Social from a test environment to a production environment? A. A new application profile needs to be created always for Internet Identity Services. B. The Challenge Redirect URL in authentication schemes needs to be updated. C. The cwallet.sso file needs to be edited for the production host. D. The merge-creds.xml file needs to be created on the production host. Correct Answer: B /Reference: Reference: QUESTION 36 Which two statements are true about Oracle Access Manager 11g data sources? A. A system Store is optional. B. Embedded LDAP is configured as the default User Identity Store for Oracle Access Management. C. Only one User Identity Store can and must be designated as the System Store. D. You can define as many User Identity Stores as the System Store. E. A system Store contains policy data, including password management data. Correct Answer: BC

18 /Reference: Reference: QUESTION 37 From Oracle Access Manager 11g R1-PS1 (and R2) onward, resource definitions in the policy model have a field protection level that can be protected, unprotected, or excluded. What is the correct behavior for a request that has the excluded protection level? A. Authentication is always performed but session validation is not performed. B. Authentication is not performed but session validation is always performed. C. The WebGate/agent lets the request through without authentication and no validation is performed. D. The OAM_REMOTE_USER header is added to the request. Correct Answer: C /Reference: Reference: QUESTION 38 Identity two settings that are available from the common settings for a session in Oracle Access Manager system configuration. A. Session Lifetime B. Minimum Number of Sessions per User C. Maximum Number of Sessions per User D. Session Cache Memory size E. Session Security Protocol Correct Answer: AC /Reference: Reference: QUESTION 39 Which statement is true about the interaction between a UMS component in the SOA Suite and OAAM?

19 A. OAAM generates and sends the One Time Pin (OTP) directly to a user. B. OAAM generates and sends the OTP to UMS, which submits it to a customer. C. OAAM communicates with the UMS, which generates and submits the OTP to a customer. D. OAAM sends the OTP to a customer directly and UMS validates the PIN. E. UMS generates and sends the OTP direcly to a user. Correct Answer: A /Reference: Reference: QUESTION 40 Which statement is true about scaling out an Oracle Access Manager server in high availability topology? A. Scale out is used when a new Access Manager Managed Server instance is added to a node that is already running one or more server instances. B. Scale out is used to add a new Access Manger Managed Server instance to a new node. C. Scale out is used to add a new WebGate to talk to an existing Access Manager instance. D. Scale out is used to add a new Identity Store to Access Manager instance. Correct Answer: B /Reference: