Which statement is true about the WS-Security standard?

Question

Options

• AIt is a Java EE standard for protecting SOAP services.
• BIt relies on HTTP security mechanism to protect SOAP messages in transmit.
• CIt provides message-level security.
• DIt defines protocol-specific ways of protecting SOAP messages.

• A
  5% (3)
• B
  2% (1)
• C
  91% (53)
• D
  2% (1)

Explanation

WS-Security (Web Services Security) operates at the message level, meaning security is embedded directly into the SOAP message itself - through XML encryption, digital signatures, and security tokens - regardless of what transport protocol carries it. This makes option C correct.

Why the distractors are wrong:

• A is wrong because WS-Security is an OASIS standard, not a Java EE specification - it is platform and language agnostic.
• B is wrong because WS-Security is specifically designed not to rely on HTTP-level security (like TLS/HTTPS); message-level security means the message is protected even if the transport layer is not.
• D is wrong because WS-Security is explicitly protocol-independent - it secures the SOAP message itself, so the same protection applies over HTTP, SMTP, JMS, or any other transport.

Memory tip: Think of WS-Security as a "sealed envelope" - the message carries its own security wherever it travels, rather than relying on a "secure hallway" (transport-level security like HTTPS).

No community discussion yet for this question.