A Security Administrator has some concerns about the confidentiality of data when using SOAP. Which of the following BEST describes the Security Administrator's concerns?

Question

Options

• AThe SOAP header is not encrypted and allows intermediaries to view the header data.
• BThe SOAP protocol supports weak hashing of header information.
• CThe SOAP protocol can be easily tampered with, even though the header is encrypted.
• DThe SOAP protocol does not support body or header encryption which allows assertions to be viewed

• A
  94% (16)
• C
  6% (1)

Explanation

SOAP messages travel through a chain of intermediaries (proxy nodes, routers, gateways) before reaching their final destination. By default, SOAP does not encrypt its header - only WS-Security explicitly adds encryption. This means any intermediary in the message path can read the SOAP header, which may contain sensitive information such as routing data, authentication tokens, or service-level assertions. This is a confidentiality concern because data intended only for the end recipient may be exposed to intermediate nodes. Answer A correctly identifies this architectural issue: unencrypted headers are visible to intermediaries along the SOAP message path.

No community discussion yet for this question.