Which of the following is a security feature provided by the WS-Security extension in the Simple Object Access Protocol (SOAP)?

WS-Security is a specification that provides message-level security for web services. Its primary features operate on the SOAP message itself, independent of the transport protocol. A core feature is message confidentiality, which is achieved by encrypting parts of the SOAP message body or headers. This ensures that even if the transport channel is compromised or the message is intercepted at an intermediary, the sensitive data within the message remains protected. Other key features include message integrity (via digital signatures) and authentication (via security tokens).

A. Transport Layer Security (TLS) provides security at the transport layer (point-to-point), not the message layer. WS-Security provides end-to-end message security.
C. Malware protection is a broader security control, typically handled by anti-malware software or network gateways, not a specific feature of the WS-Security protocol.
D. Session management is typically handled at the application layer or by other protocols; it is not a primary function of the core WS-Security specification.

1. Nadalin, A., Kaler, C., Hallam-Baker, P., & Monzillo, R. (Eds.). (2006). OASIS Web Services Security: SOAP Message Security 1.1.1 (OASIS Standard). OASIS. Section 1, "Introduction".

2. Gong, L., & van der Merwe, J. (2005). Security of Web Services. Stanford University CS155 Course Notes. Lecture 19, Slide 15-18. Available from Stanford University course archives.