Which Web Service Architecture Component Secures SOAP Message Integrity and Confidentiality?
Short answer
B WS-Security extends SOAP to authenticate users and preserve the integrity and confidentiality of SOAP messages.
Question
Key Takeaways
The question tests your ability to map a security requirement (authentication plus SOAP message integrity and confidentiality) onto the correct WS-* specification, and the trap is confusing descriptive WSDL or policy metadata with the actual message-level security mechanism.
WS-Security is the SOAP extension in the Web Service Architecture that authenticates users and preserves the integrity and confidentiality of SOAP messages. This page confirms why WS-Security (B) — not WS-Policy, WS-Work Processes, or WSDL — is the component Rebecca needs for secure web service communication.
Common mistake: Learners often pick WS-Policy because the word 'Policy' sounds like a security control, but WS-Policy only describes capabilities and requirements of a service — it does not encrypt, sign, or authenticate anything.
Expert Analysis
Why the Answer Is Correct
WS-Security (often written WSS) is the OASIS standard that extends SOAP by adding security tokens, XML Signature, and XML Encryption directly into the SOAP message header, so message-level integrity, confidentiality, and user authentication travel with the message regardless of transport. That matches Rebecca's requirement exactly: authenticate employees using web services while preserving the integrity and confidentiality of SOAP messages. As one community member, insaniunt, phrased it, "WS-Security is an extension of SOAP that provides a set of mechanisms to ensure the integrity and confidentiality of SOAP messages." Another commenter, shaody, adds the authentication purpose: "It is an extension of SOAP and aims to maintain the integrity and confidentiality of SOAP messages as well as to authenticate users." Nothing in the other three options performs signing or encryption of the SOAP payload.
Why the Other Options Are Wrong
WS-Policy (C) is a framework for expressing the capabilities, requirements, and general characteristics of a web service as policy assertions; it can state that WS-Security should be used but it enforces nothing by itself. WS-Work Processes (A) refers to WS-BPEL-style business process composition and has nothing to do with message protection. WSDL (D) is the XML-based interface description language that tells a client which operations, bindings, and endpoints a service exposes — it is documentation of the contract, not a security mechanism. Choosing WSDL is the classic 'sounds technical and web-service-y' distractor.
Community Comment Notes
All voting learners converged on WS-Security, with 100 votes recorded for B and no dissent. insaniunt and shaody both anchor their reasoning in the exact CEH phrasing about SOAP extension, integrity, and confidentiality, which is the definition you should memorize verbatim for exam day. LordXander's terse note "CEHv12 - 1890" simply keys the item to the official courseware module, confirming this is a definition-recall question rather than a scenario-analysis one.
Official Reference
- https://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf
- https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss
These links open the official vendor documentation in a new tab.
Exam Strategy
When a CEH question names a security property (integrity, confidentiality, authentication) alongside SOAP, map it instantly to WS-Security; reserve WS-Policy for describing requirements and WSDL for describing interfaces. Watch for the phrase 'extension of SOAP' — it is the signature of WS-Security in EC-Council wording.
Frequently Asked Questions
Why is WS-Policy not the component that secures SOAP messages?
Does WSDL provide message-level security for web services?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
insaniunt 👍 2 Answered BRebecca is using WS-Security to secure the communication. WS-Security is an extension of SOAP that provides a set of mechanisms to ensure the integrity and confidentiality of SOAP messages in web services
-
shaody 👍 1 Answered BWS-Security: It is an extension of SOAP and aims to maintain the integrity and confidentiality of SOAP messages as well as to authenticate users.
-
LordXander 👍 2 Answered BCEHv12 - 1890
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.