SAML is the correct answer because it is not one of the core standards that WS-Security is built upon.

WS-Security is primarily concerned with securing SOAP messages and it relies on the XML processing model and on XML security specifications such as XML Signature and XML Encryption. In exam language the web services stack that WS-Security operates within commonly includes XML, WSDL, and SOAP, so those are considered part of the underlying technologies rather than the odd one out.

SAML is an assertion and token format defined by OASIS for exchanging authentication and authorization statements. It can be carried inside WS-Security tokens when needed, but it is an independent specification and not one of the foundational specs that WS-Security is defined on.

XML is incorrect because WS-Security depends on XML for message structure and for the XML Signature and XML Encryption standards that implement message protection.

WSDL is incorrect because WSDL defines service interfaces and message formats and it sits with SOAP and XML in the core web services stack that WS-Security secures.

SOAP is incorrect because WS-Security was designed to protect SOAP envelopes and to add security headers and processing rules to SOAP messages.

Full AWS Practitioner Certification Question