Quiz S90.20: Arcitura Education SOA Security Lab

The correct answer is A.
Here is why A is the best solution, and why the others are not.
Problem summary
The architecture has two main security and availability problems:
1. Database A is a critical shared resource inside Organization A
- Component B depends on it directly.
- Service A also depends on it.
- A denial-of-service attack against Service A caused Database A to be unavailable for long periods.
- This in turn harmed Component B, which needs guaranteed fast access.
2. Services B, C, and D are external services and have been victims of malicious intermediary attacks
- These attacks destabilized Service A’s performance.
- So the communication among the external services needs message-layer security.
Why A is correct
Option A addresses both the database protection and the external message security correctly.
1. It introduces a utility service to encapsulate Database A
- A utility service acts as a controlled intermediary around the database.
- This reduces direct exposure of Database A.
- It can enforce authentication and access control for all access to the database.
- This is especially important because Database A is critical to internal Component B and must not be overwhelmed by external service activity.
2. It limits concurrent requests from outside the organizational boundary
- This directly addresses the denial-of-service risk.
- Since Service A is external and previously caused Database A to become unavailable, throttling or limiting outside access is a sensible mitigation.
- That helps preserve availability for Component B, which has mission-critical requirements.
3. It applies Data Confidentiality and Data Origin Authentication patterns to messages in the external composition
- This protects messages exchanged between Services A, B, C, and D.
- Data Confidentiality protects against eavesdropping and tampering with message content.
- Data Origin Authentication ensures that each service can verify who sent the message.
- Together, these help defend against malicious intermediary attacks.
Why the other answers are wrong
Option B
- This focuses on establishing secure communication only between Service Consumer A and Service A.
- But the main attack issue involves Services B, C, and D being attacked during service-to-service exchanges.
- Also, the proposed “Service Perimeter Guard” around Database A is not the best fit here because the database problem is not primarily about perimeter authentication alone; it is about availability and controlled access.
- It does not address the need to protect Component B from service-driven overload as well as A does.
Option C
- Symmetric session-key encryption is useful, but the description is awkward and incomplete as a solution.
- It does not properly address the denial-of-service issue against Database A.
- Replicating Database A “so that only the replicated version can be accessed” is not a good solution to the stated problem.
- The core issue is protecting the original critical database and ensuring controlled access, not merely duplicating it.
Option D
- Direct Authentication only verifies credentials submitted by Service Consumer A.
- That does not solve the malicious intermediary attacks between services.
- It also does not adequately protect Database A from excessive or abusive access.
- Replicating the database again does not address the main availability problem described.
Key concept behind the correct answer
This question is really testing two security patterns:
- Utility Service / service encapsulation around the database to protect availability and control access
- Message-layer security patterns such as Data Confidentiality and Data Origin Authentication to protect service-to-service communication
Together, these reduce the risk of:
- denial of service on Database A
- malicious intermediary attacks among Services A, B, C, and D
Final answer
A is correct because it best protects Database A from external abuse and secures the external service interactions against malicious intermediary attacks.

The correct answer is A.
Here is why, in detail.
What the question is asking
There are two requirements:
1. Service A must be able to verify that the response from Service B was not modified in transit.
2. Performance must improve, because Service B is doing redundant security processing on every message exchange, but Service A’s security credentials still must be verifiable.
The current setup
Right now, every request from Service A to Service B includes an X.509 certificate. Service B:
- validates the certificate by checking the CA’s public key
- verifies the certificate’s signature
- performs revocation checking against an external repository
Because this happens multiple times during the same runtime service activity, the repeated certificate validation and revocation checking is causing latency.
What a good solution should do
A proper solution should:
- preserve security credential verification
- reduce repeated expensive security checks
- allow response integrity verification so Service A can detect tampering
- avoid unnecessary redesign that breaks the existing trust model
Why A is correct
Option A applies the Trusted Subsystem pattern.
This is the key idea:
- Instead of Service B doing all security processing itself for every call, a utility service handles the security work.
- That utility service can verify Service A’s credentials once during the session.
- After successful authentication, it can issue a SAML token.
- Service A can reuse that token during the same runtime service activity.
- Since the token is short-lived, repeated certificate revocation checks are no longer needed for each message.
- The utility service can also digitally sign responses so Service A can verify that response messages were not modified in transit.
Why this fits the requirements
1. Response integrity
If the utility service digitally signs the response, Service A can verify the signature and know whether the message was altered.
2. Improved performance
The expensive certificate validation and revocation checking are done only once, not for every message.
3. Security credentials still verified
Service A still proves its identity with its certificate, but the result is cached or represented by a short-lived SAML token for subsequent exchanges.
4. No intermediaries between A and B
The question says no intermediary service agents reside between Service A and Service B. The Trusted Subsystem pattern does not necessarily mean a network intermediary between them in the sense of a message hop inserted into every exchange; rather, it means centralizing security processing in a trusted component. In the context of the options, this is the intended architectural fit.
Why the other options are wrong
Option B
This says Service B itself should be redesigned to issue a SAML token after the first exchange.
Problem:
- It does reduce repeated verification, but it does not address the response integrity requirement as clearly as A does.
- More importantly, it leaves the redundant security processing with Service B rather than moving it into a trusted subsystem, which is the pattern meant to solve this kind of problem.
- Also, the wording suggests that Service B is still directly handling security logic, which is the source of the performance issue.
Option C
This focuses on WS-Security-Policy transport binding assertions and transport-layer security.
Problem:
- Transport-layer security such as TLS protects the communication channel, not the message after it leaves the channel.
- If there are intermediaries or if the message is stored and forwarded, transport security alone does not provide end-to-end message integrity.
- The statement “encrypting the messages, attackers cannot modify message contents” is incorrect. Encryption does not by itself guarantee integrity; you need digital signatures or authenticated encryption for that.
- It also does not solve the certificate validation/revocation performance problem.
Option D
This suggests Data Origin Authentication and Service Perimeter Guard.
Problem:
- This adds a perimeter service, which conflicts with the note that no intermediary service agents reside between A and B.
- It also changes the architecture too much and introduces unnecessary replication of CA repositories.
- Encrypting messages and attaching a signed hash may help integrity, but the solution is not aligned with the described performance bottleneck and is overly complex.
- It does not cleanly address the reuse of verified credentials during the same runtime activity.
Short summary
A is correct because it:
- uses the Trusted Subsystem pattern to centralize and minimize repeated security processing
- allows Service A’s credentials to be verified once and reused via a short-lived SAML token
- improves performance by eliminating repeated certificate revocation checks
- enables message integrity verification through digital signatures on responses
If you want, I can also explain why this is a classic Trusted Subsystem pattern sce

The correct answer is B.
Here is why.
What the question is really asking
There are two separate concerns:
1. Service-to-service message security between Service A and Service B
- The current approach uses digital certificates for every exchange between A and B.
- That works for integrity and authentication, but it is too slow.
- So the solution must preserve message integrity and authenticity while improving performance.
2. Protection of Databases A and B
- Both databases are vulnerable to direct malicious access.
- The solution must protect them with minimal performance overhead.
Why B is correct
B says to use:
- Brokered Authentication with WS-Secure Conversation Security Context Tokens (SCTs)
- A symmetric session key for messages between Services A and B
- The Trusted Subsystem pattern for the databases
This matches both requirements very well.
1. Why WS-Secure Conversation improves performance
Digital certificates and public-key cryptography are relatively expensive, especially if used repeatedly for every message exchange.
WS-Secure Conversation solves this by:
- performing the expensive authentication only once at the start of the conversation
- then deriving a security context token (SCT)
- using a symmetric session key for subsequent messages
Symmetric cryptography is much faster than repeatedly using digital certificates for every message. That makes it a strong fit for the performance problem described.
So between Services A and B:
- integrity is maintained through message signing
- authenticity is maintained through the established security context
- runtime performance improves because the expensive certificate-based exchange is replaced by a more efficient session-based mechanism
2. Why the Trusted Subsystem pattern is the right database protection
The databases are vulnerable to direct access, so they should not be exposed to clients or other services directly.
The Trusted Subsystem pattern means:
- the service acts as the trusted gateway to the database
- only the service can access the database using privileged credentials
- external attackers cannot connect directly to the database and read or modify records
This protects the databases with minimal impact on performance because:
- the database is not burdened with repeated end-user authentication checks
- the service handles authentication/authorization before database access
- it avoids expensive per-record encryption schemes that could degrade performance
Why the other options are wrong
A. Brokered Authentication with SAML tokens, and public-key encryption of databases
- SAML tokens can reduce repeated authentication, but the answer is weak on database protection.
- Encrypting the databases with the public key of the service is not the standard or most efficient way to protect database records.
- This does not best satisfy the “minimal additional impact on performance” requirement.
C. Direct Authentication with Username tokens and password-based encryption
- Direct Authentication does not address the performance issue well.
- Username tokens and shared identity store are not as appropriate as WS-Secure Conversation for high-performance service-to-service messaging.
- Encrypting databases with service passwords as keys is poor practice and not a robust design.
D. Brokered Authentication with SAML tokens and password-based database encryption
- Again, the database protection choice is weak.
- Using service passwords as encryption keys for databases is not a good or realistic security design.
- It also does not provide the best performance improvement for the A-to-B message exchange compared with WS-Secure Conversation.
Key takeaway
The best solution is:
- For Service A and Service B: use Brokered Authentication with WS-Secure Conversation and symmetric session keys
- For Databases A and B: use the Trusted Subsystem pattern
That is exactly what option B describes.
Final answer: B

The correct answer is C.
Here is why.
What happened in the attacks?
The problem describes two different attacks against Database A, both launched by authorized but malicious service consumers:
1. Exception-based attack
A malicious consumer sent a sequence of requests designed to trigger different exception conditions in the database.
The goal was to learn about the database through error messages and exception behavior.
2. Injection-based attack
A malicious consumer sent input designed to exploit the database server, resulting in deletion of records and tables.
This is a classic data-driven attack such as SQL injection, XPath injection, or a similar form of malicious input manipulation.
So the security issue is not that the consumers were unauthorized. They were authorized.
The issue is that authorized users can still send malicious input and provoke harmful database behavior.
Why C is correct
Option C says to apply:
- Exception Shielding pattern
- Message Screening pattern
These two directly address the two attack types described.
Message Screening
This pattern inspects incoming messages for malicious or dangerous content before they reach the vulnerable component.
It helps prevent:
- SQL injection
- XPath injection
- malformed or malicious input
- other data-driven attacks
In this scenario, Service A would screen incoming request messages before forwarding them to the database-related services. That blocks the malicious input attack that caused record/table deletion.
Exception Shielding
This pattern prevents sensitive or dangerous exception details from being exposed to the requester.
It helps prevent:
- information leakage through stack traces
- database schema disclosure
- detailed error messages that help an attacker refine attacks
In this scenario, the first attack was about provoking exceptions to generate useful error messages. Exception Shielding would sanitize or suppress those messages so they do not reveal internal database details.
Why the other options are wrong
A. Data Confidentiality + Data Origin Authentication
These patterns protect message secrecy and authenticity.
They ensure:
- messages are encrypted
- messages are digitally signed
- sender identity can be verified
But that does not stop a legitimate, authenticated user from sending malicious input. An attacker can still be authenticated and still send SQL injection payloads or intentionally trigger exceptions. So this does not solve the problem.
B. Service Perimeter Guard + Trusted Subsystem
This sounds like a structural control around service access, but the description is not the best fit.
The main issue is not simply that access needs a perimeter. The attacks are caused by malicious input from authorized consumers. The needed defense is input screening and exception shielding, not just perimeter enforcement. Also, the text in option B incorrectly suggests that only authorized requests are forwarded, but these consumers are already authorized. Authorization alone does not prevent malicious payloads.
D. Trusted Subsystem
A trusted subsystem is not the best fit for this scenario as described.
The option suggests using a snapshot and replaying the request against it, but this is not the standard or most direct way to prevent injection attacks or exception-information leakage. It also does not match the core attack patterns in the question as well as option C does.
Key takeaway
The attacks were caused by malicious content in requests from authorized users.
So the correct protection is to:
- screen incoming messages to block malicious input
- shield exceptions so they do not leak useful information
That is exactly what option C provides.
Final answer: C

The correct answer is B.
Here is why B is the best solution, mapped to each of the new security requirements.
First, let’s restate the problem in security terms:
- Service A authenticates Service Consumers A and B.
- Service A then calls Services B and C.
- Service A also calls a legacy system that has weak access control, no auditing, and returns detailed error messages.
- The upgrade must ensure:
1. Different consumers get only the data they are allowed to see.
2. All legacy system access is logged.
3. B and C must know which consumer of Service A initiated the request.
4. Confidential legacy error details must not leak to the consumer.
Why B works
B proposes these key ideas:
1. Trusted Subsystem pattern with a utility service
- Service A does not directly manage all legacy-system interaction.
- Instead, a utility service is introduced to encapsulate access to the legacy system.
- This is a classic Trusted Subsystem use: a trusted intermediary handles protected access and can centrally enforce policies, logging, and error handling.
2. Signed SAML assertion passed by Service A
- After Service A authenticates the consumer, it creates a signed SAML assertion containing authentication and authorization information.
- This assertion conveys the identity of Service Consumer A or B to Services B and C.
- This satisfies requirement 3: B and C are given the identity of Service A’s consumer, so they can tailor behavior or data accordingly.
3. Filtering responses based on consumer permissions
- The utility service filters response messages back to the consumer based on the SAML assertion information.
- This satisfies requirement 1: consumer A and consumer B have different permission levels, so the returned response must be restricted accordingly.
4. Logging all access requests to the legacy system
- The utility service logs all data access requests made to the legacy system.
- This satisfies requirement 2: auditing is added externally because the legacy system itself cannot audit.
5. Exception Shielding
- The utility service applies Exception Shielding so detailed legacy error codes are not passed back to the consumer.
- This satisfies requirement 4: confidential internal error information is hidden.
Why the other options are wrong
Option A
- It suggests letting Services B and C directly authenticate the consumers and share the identity store.
- That is not the right architectural approach here because B and C are downstream services; they should not be responsible for re-authenticating the original consumer in this way.
- It also incorrectly says the service consumers submit credentials to the legacy system through Service A.
- The legacy system only has a single account and does not support that kind of per-consumer authentication.
- The Message Screening pattern is also not the right fit for protecting legacy error leakage in this scenario.
Option C
- It proposes a Service Perimeter Guard around Service A, but the problem is not mainly about perimeter enforcement at the front door.
- The design needs a trusted intermediary for legacy access, logging, and shielding.
- It also says consumer authentication is performed using digital certificates, which is not what the scenario specifies.
- It does not properly address the logging requirement for the legacy system.
Option D
- It also uses Trusted Subsystem, which is closer to the right direction.
- But it says Service A forwards the service consumer’s credentials to Services B and C and to the legacy system.
- That is not ideal and does not align with the proper use of a trusted subsystem or SAML-based identity propagation.
- It does not clearly satisfy requirement 3 in the right way.
- It is less correct than B because B explicitly uses signed SAML assertions, logging, and exception shielding in a coherent design.
How B maps to the requirements
Requirement 1:
- Different consumers have different permissions.
- B uses the SAML assertion information and response filtering to ensure only authorized data is returned.
Requirement 2:
- Legacy access must be logged.
- B explicitly adds logging in the utility service.
Requirement 3:
- B and C must know the identity of the original consumer.
- B uses a signed SAML assertion to propagate consumer identity from Service A to B and C.
Requirement 4:
- Legacy error details must not be exposed.
- B applies Exception Shielding to suppress confidential legacy error information.
Final conclusion
B is correct because it combines the right security patterns in the right places:
- Trusted Subsystem for centralized protected access to the legacy system
- SAML assertion for identity propagation
- Logging at the utility service
- Exception Shielding to prevent leakage of internal errors
If you want, I can also explain the specific security patterns involved and why each one fits this architecture.

The correct answer is D.
Here is why, step by step.
What is the actual security problem?
The suspicious part of the flow is this:
Service C sends data to Service B, and Service B later passes data derived from Service C to Service D.
Service D then uses that data in a database retrieval request.
If the data from Service C is malformed and ends up influencing a database request, this creates a classic SQL injection risk. Even though Service C is outside the organization, the danger is not only about trusting the source; it is about preventing harmful content from reaching the database access point in a form that could be interpreted as SQL.
What is the best way to prevent the attack?
The best architectural measure in the options is the Message Screening pattern.
This pattern places a screening component between the untrusted service and the downstream service. The screening component inspects incoming messages and rejects or filters out harmful content before it can propagate further.
In this scenario, the screening component should be placed between Service C and Service B, because:
- Service C is the external source of the potentially malicious data.
- Service B receives that data and passes it along.
- Blocking or cleansing the data as early as possible reduces the chance that it will be used in a database request by Service D.
Why not Data Origin Authentication?
Options B and C propose Data Origin Authentication, which means Service C digitally signs its messages so Service B can verify that the data really came from Service C and was not modified in transit.
That is useful for integrity and authenticity, but it does not solve SQL injection.
Why not?
Because a digitally signed message can still contain malicious SQL payloads.
Authentication tells you who sent the message, not whether the content is safe to use in a database query.
So if Service C itself is compromised, or if an attacker can make Service C send hostile but validly signed input, the injection risk still remains.
Therefore, Data Origin Authentication is not the right primary defense here.
Why is D better than A?
Option A also mentions the Message Screening pattern, which is the right idea, but it misstates the placement and the contract requirement.
It says to position a perimeter service between Service C and Service B. However, the scenario is better addressed by placing a service agent between the services, which is the proper pattern name in this context.
More importantly, A says to use an optional WS-Policy assertion for logging. That is incorrect for the privacy disclosure requirement.
What is needed for the logging requirement?
The problem says:
Each service that writes data to a database must keep a separate log file that records a timestamp of each database record change.
Because of a data privacy disclosure requirement, the service contracts need to indicate that this logging activity may occur.
This means the logging behavior must be disclosed in the service contract using an ignorable WS-Policy assertion, not an optional one.
Why ignorable?
An ignorable policy assertion communicates to consumers that the behavior may occur, while not forcing all consumers to explicitly support it.
An optional assertion is different in meaning and is not the correct choice here.
Why D is correct
Option D correctly combines both required improvements:
1. Security improvement:
- Apply Message Screening
- Put a service agent between Service C and Service B
- Screen or filter message content before Service B processes it
- This helps prevent SQL injection content from reaching Service D
2. Contract/privacy improvement:
- Update the service contracts for Services B and D
- Use an ignorable WS-Policy assertion
- This properly discloses the logging activity required by the privacy rule
Summary
The best answer is D because it:
- uses Message Screening to block harmful data originating from Service C before it can lead to SQL injection, and
- uses an ignorable WS-Policy assertion to satisfy the logging disclosure requirement.
In short:
- SQL injection defense: Message Screening via a service agent
- Privacy disclosure: ignorable WS-Policy assertion
If you want, I can also explain why each of the other options is wrong in a side-by-side comparison.

The correct answer is A.
Why A is correct
The problem describes three separate security issues:
1. Plaintext credentials
- The attack happened because Service Consumer A’s security credentials were sent in plaintext.
- This means the solution must provide message-level confidentiality, not just transport-level security.
2. Replay attacks
- An attacker could capture a valid request and resend it later.
- To prevent this, requests need freshness protection, such as a timestamp, nonce, or message expiration.
3. Malicious intermediaries
- Because the message may pass through other systems, the security protections must survive intermediaries.
- That again points to message-level security with signatures and encryption.
Why option A fits
Option A says to apply:
- Data Origin Authentication pattern
- Data Confidentiality pattern
Together, these provide message-layer security for the request from Service Consumer A to Service A.
How this helps:
- Data Confidentiality ensures the credentials are encrypted, so they are not exposed in plaintext.
- Data Origin Authentication ensures Service A can verify who sent the message and that the message was not altered.
- Adding a timestamp helps counter replay attacks by allowing Service A to reject old or reused messages.
The listed standards are also appropriate:
- WS-Policy
- Used to define security requirements and policies.
- WS-Security-Policy
- Used to express message security requirements such as signing, encryption, and timestamps.
- XML Encryption
- Used to encrypt XML message content.
- XML Signature
- Used to digitally sign XML messages.
Why the other options are incorrect
Option B
- Talks about a Service Perimeter Guard and Trusted Subsystem, but the description is less suitable for directly protecting the consumer-to-service request from plaintext exposure and replay.
- It also relies too much on perimeter processing rather than explicitly ensuring secure message-level protection from consumer to service.
- WS-Trust may help with token exchange, but this option does not directly address the stated need as clearly as A.
Option C
- Uses a shared secret key between Service Consumer A and the perimeter service.
- That is not aligned with the described scenario and does not properly address the cross-domain trust and message-level protection requirements.
- It also falls back to transport-layer security between Service A and the consumer, which does not solve the plaintext credential problem in transit through intermediaries.
Option D
- Suggests creating a composite trust domain across all participants.
- That is not realistic or appropriate here, since the systems belong to different security domains and the trust relationship is limited.
- It also assumes that malicious intermediaries cannot access data simply because everything is within one domain, which does not match the scenario.
- This option is conceptually flawed for the described attack conditions.
Industry standards required by the proposed solution
For option A, the relevant standards are:
- WS-Policy
- WS-Security-Policy
- XML Encryption
- XML Signature
Note:
- A timestamp is a security mechanism typically defined in WS-Security, even though it is not listed separately in the option’s standards list.
In short
The best solution is to use message-level security with encryption, digital signatures, and timestamps. This prevents plaintext credential exposure, helps stop replay attacks, and protects against malicious intermediaries. Therefore, A is correct.

The correct answer is A.
Here is why.
What the scenario is asking
Service B originally could access Services C, D, and E directly, but after C, D, and E are moved into Service Inventory B, they become protected by:
- a private network
- a firewall
So the problem is:
- Service B still needs to reach C, D, and E
- but direct access would weaken the security boundary of Service Inventory B
- and the solution should have minimal performance impact
What option A proposes
Option A combines:
- Service Perimeter Guard
- Brokered Authentication
This means:
1. A perimeter service is placed at the edge of Service Inventory B.
2. All incoming requests to services inside the private network go through this perimeter service before they reach the firewall or internal services.
3. The perimeter service performs authentication on behalf of the internal services.
4. It issues a security token to Service B.
5. Service B then uses that token when accessing Services C, D, and E.
Why this is the best fit
This approach is secure because:
- internal services C, D, and E remain protected inside the private network
- Service B does not need direct network-level access to them
- authentication is centralized at the perimeter
- internal services can trust requests that arrive with a valid token
It also has minimal performance impact because:
- authentication is handled once at the perimeter instead of repeatedly by each internal service
- token-based access reduces repeated credential checks
- the firewall and internal services are not burdened with extra security processing for every request
Why the other options are wrong
Option B: Service Perimeter Guard + Message Screening
This focuses on filtering messages and checking IP addresses for origin identity, plus scanning for malicious content.
Problems:
- IP address checking is not strong authentication
- message screening is about content inspection, not enabling secure access for Service B
- it does not solve the need for controlled access to the newly isolated services in a clean way
- it adds inspection overhead without directly addressing trusted service-to-service access
Option C: Brokered Authentication by extending the firewall
This suggests turning the firewall into an authentication broker with single sign-on.
Problems:
- firewalls should primarily enforce network access rules, not act as full authentication brokers
- combining too many responsibilities into the firewall is not a good security design
- it is less aligned with service-oriented security patterns
- it is not as clean or modular as placing a perimeter service in front of the internal inventory
Option D: Data Confidentiality + Direct Authentication
This proposes encrypting the message and using a utility service to validate it.
Problems:
- encryption protects data confidentiality, but does not directly solve network access to the private inventory
- direct authentication still implies direct interaction with internal services, which is what the scenario is trying to avoid
- it does not provide the perimeter-based access control needed for Service Inventory B
- it is more complex and less efficient for the composition flow described
Key idea to remember
When a service inventory is isolated inside a private network, and another service still needs access, the best solution is usually to place a trusted perimeter component in front of the inventory that:
- authenticates external or neighboring services
- issues tokens or assertions
- allows internal services to remain protected and hidden
That is exactly what Option A describes.
Final answer: A

The correct answer is B.
Why B is correct
The problem is not primarily about keeping the data secret. It is about proving two things:
1. Service A is receiving correct, complete, and unmodified data from Services B, C, and D.
2. The messages involved can be traced back to the correct sources, so the owner of Service A can defend itself against false claims from Service Consumer A.
The best way to support this is to apply Data Origin Authentication to the messages exchanged between:
- Service Consumer A and Service A
- Service A and Services B, C, and D
Data Origin Authentication helps ensure that:
- a message really came from the stated sender
- the message was not altered in transit
This is exactly what is needed when someone claims that the returned data was incorrect or incomplete. If the service can show that all incoming messages from B, C, and D were authentic and unchanged, then it can demonstrate that the assembled response was based on valid source data.
Also, the answer says to log all messages sent to service consumers. That is useful because logs provide evidence of what Service A actually returned. If Service A logs the outgoing response, it can later prove that the response it sent was correct and complete, even if the consumer presents a different version.
Why the other options are wrong
A. Data Origin Authentication and Data Confidentiality
This is too focused on confidentiality. Encryption protects messages from being read by unauthorized parties, but it does not by itself prove the source or integrity in a way that resolves the dispute. The key issue here is authentication and non-alteration, not secrecy.
C. Brokered Authentication
Brokered Authentication is used when one service passes security credentials on behalf of a consumer to other services. That is not the problem here. The problem is not that Services B, C, and D need to know who Consumer A is. The problem is proving that the data received and returned was genuine and unmodified.
D. WS-Policy assertion about logging and prosecution
This is not a technical security solution. A policy statement about logging and prosecution does not prove message authenticity, integrity, or provenance. It may discourage fraud, but it does not provide evidence.
Key idea
To resolve disputes about the correctness and source of data, you need evidence based on authenticated, integrity-protected messages and message logging. That is why B is the best answer.
If you want, I can also explain why Data Origin Authentication is different from encryption, digital signatures, and brokered authentication.

The correct answer is A.
Here is why:
The core problem is not the uniqueness constraint itself. The problem is that when a public consumer tries to update a public record to an ID that already belongs to a private record, the database error message reveals sensitive information. In other words, the system is leaking private data through error text.
The required solution must do two things:
1. Prevent the public consumer from learning that a private record with that ID exists.
2. Preserve the rule that all database records, both private and public, must have unique ID values.
Why A is correct
Option A applies the Exception Shielding pattern, which is specifically designed to prevent internal exceptions and low-level error details from leaking to external consumers.
Instead of returning the raw database error message, Service A should replace it with a generic or sanitized error message. For example, it could say:
"Update failed due to an invalid identifier"
or
"Update could not be completed"
This avoids exposing the fact that the conflicting ID belongs to a private record.
The second part of A says to append a code to each ID value indicating whether the record is private or public. This ensures uniqueness while also separating the namespace for private and public records. However, this part must be handled carefully in design so that the access control logic does not itself reveal private record existence. The key idea is that the IDs remain unique, but the external consumer does not receive the internal conflict detail.
Why the other options are incorrect
B is incorrect
Changing the database so ID values no longer need to be unique would violate the stated requirement. The question explicitly says all database records must have unique ID values. So this option breaks a core constraint.
C is incorrect
Encrypting the ID with the consumer’s private key is not an appropriate solution. It changes the value in a way that makes it unsuitable as a stable unique database identifier across consumers. Also, encryption is not the right mechanism for preventing information leakage in this case. It introduces complexity and does not directly solve the error message disclosure problem.
D is incorrect
This option tries to hide the issue by pretending the update succeeded and then notifying a human administrator. This is not a proper technical control and creates consistency problems. The consumer is told the update worked even though it did not, which can lead to incorrect system behavior and data integrity issues. It also does not provide a clean architectural fix.
Summary
The best solution is to sanitize or shield the exception so the public consumer never sees the private-record conflict detail, while maintaining unique IDs through an internal naming or classification approach.
Therefore, A is the correct answer.