Which of the following statements are true about applying security to SOA Services? 

SOA Services must base access control decisions on roles, attributes, rules, and so on, that are universal to all consumers. 

SOA Services are difficult to secure due to a lack of security standards for Web Services. 

SOA Services are a type of monolithic application with self-contained identity and role management. 

Data returned by a SOA Service may need to be redacted according to data classification schemes, depending on the privileges of users.