JSON, XML and YAML Explained: Data Formats for the Network+ Exam

Network automation, REST APIs and configuration management all move structured data around, and CompTIA now expects familiarity with the three formats that carry it.

JSON

JavaScript Object Notation. Lightweight, text-based, and the default for REST APIs.

Two structures: objects in curly braces holding key-value pairs, and arrays in square brackets holding ordered values. They nest arbitrarily.

Six data types: string (double quotes only), number, boolean, null, object and array.

The syntax rules that catch people: keys must be double-quoted strings; single quotes are invalid; no trailing comma after the last element; no comments at all. A trailing comma is the single most common cause of a JSON parse error, and JSON's lack of comments is why YAML is often preferred for human-edited configuration.

XML

Extensible Markup Language. Older, more verbose, and still entrenched in enterprise and SOAP environments.

Data sits in nested tags with optional attributes. It supports namespaces, and schema validation via XSD — which is a real advantage where a contract must be enforced and validated formally.

It is significantly more verbose than JSON for the same data, which is the main reason APIs moved away from it.

For the exam, the association to hold: SOAP and SAML use XML; REST and OIDC use JSON. That is why SAML assertions are XML documents and OIDC ID tokens are JSON Web Tokens.

YAML

YAML Ain't Markup Language. A superset of JSON designed to be written by humans, and the standard for configuration files — Ansible playbooks, Kubernetes manifests, CI pipeline definitions, Docker Compose.

Structure is expressed through indentation rather than brackets, lists use hyphens, and comments begin with #.

The critical rule, and the one that causes most YAML failures: indentation must use spaces, never tabs. A tab character produces a parse error, and because it is invisible it is maddening to find. Inconsistent indentation depth silently changes the structure rather than erroring, which is worse.

Choosing between them

Format	Typical use	Comments
JSON	REST APIs, data interchange	No
XML	SOAP, SAML, enterprise systems	Yes
YAML	Configuration files, automation	Yes

A useful summary: JSON for machines talking to machines, YAML for humans writing configuration, XML where a formal schema or a legacy system requires it.

Where they appear in networking

REST APIs on network controllers, firewalls and cloud platforms return JSON. Automation tools consume YAML. NETCONF uses XML, while RESTCONF supports both XML and JSON. SIEM and log pipelines normalise events into JSON. Infrastructure as code definitions are YAML or JSON.

The practical skill the exam is reaching for is being able to read an API response and locate a value in nested structure.

Security considerations

Parsing untrusted structured data is a genuine attack surface, and CySA+ touches on this.

XML External Entity (XXE) is the significant one. An XML parser that resolves external entities can be induced to read local files, make requests to internal systems, or exhaust resources. The defence is to disable external entity and DTD processing in the parser — it is a parser configuration issue, not a validation issue. XXE appears on the OWASP list and is a likely exam item.

Deserialisation flaws arise when parsed data is turned into objects that execute code. YAML is particularly exposed because some parsers can instantiate arbitrary types; use a safe-load function that handles only plain data.

Resource exhaustion through deeply nested or recursive structures — the "billion laughs" entity expansion attack against XML being the classic.

Injection into generated documents, where unescaped user input breaks the structure of JSON or XML being constructed.

The general rule: validate against a schema where you can, use safe parsers, disable features you do not need, and limit size and nesting depth.

What to remember

JSON uses objects and arrays, double-quoted keys, no trailing commas and no comments. XML is verbose, supports schemas and namespaces, and carries SOAP and SAML. YAML uses indentation with spaces only, allows comments, and is the configuration format for automation. XXE is the headline parsing vulnerability, prevented by disabling external entities.

Related reading: OAuth 2.0 and OpenID Connect · OWASP Top 10 · SDN