A Security Administrator has some concerns about the confidentiality of data when using SOAP. Which of the following BEST describes the Security Administrator's concerns?

SOAP is built on a message-path model where messages may pass through one or more intermediary nodes before reaching their final destination, and by default the SOAP header is transmitted in plaintext XML. This means any intermediary in the chain - including potentially untrusted nodes - can inspect header data that may contain authentication tokens, routing directives, or other sensitive metadata. WS-Security can be used to selectively encrypt header elements, but this protection is optional and not applied by default.

SOAP does not define any built-in hashing of header information; it is a plain XML-based protocol, and WS-Security provides optional digital signing as an extension rather than a weak native hashing mechanism.

The concern is that SOAP headers are readable in plaintext, not that encrypted headers can be tampered with; the default state is no encryption, not weak encryption.

WS-Security extensions for SOAP do support both body and header encryption; the actual risk is that these extensions are not enforced by default, leaving headers exposed.