Java EE's support for WS-Security includes handling which two types of security credentials? (Choose two.)

Question

Options

• AX.509 certificates
• BSAML tokens
• COAuth Bearer tokens
• DTwo-factor authentication tokens

Explanation

A (X.509 certificates) and B (SAML tokens) are the correct answers.

Java EE's WS-Security implementation, built on the OASIS WSS specification, explicitly defines credential profiles for X.509 Certificate Tokens (used for asymmetric encryption and digital signatures in SOAP messages) and SAML Tokens (used to convey identity assertions and federated security claims within the message header). These are core, standardized credential types wired directly into the WS-Security framework through their respective WSS token profiles.

C (OAuth Bearer tokens) is wrong because OAuth is a protocol designed for REST/HTTP APIs (JAX-RS context), not SOAP-based WS-Security - they operate in fundamentally different transport and message models. D (Two-factor authentication tokens) is a process/concept, not a credential type defined anywhere in the WS-Security specification, making it a distractor playing on familiarity with general security terminology.

Memory tip: Think "WS = Web Services = SOAP world" - X.509 and SAML both live natively in the XML/SOAP/enterprise identity ecosystem, while OAuth belongs to the REST/modern-web world. If the credential sounds like it comes from a browser-based or RESTful context, it's almost certainly not a WS-Security answer.

No community discussion yet for this question.