nerdexam
(ISC)2

CCSP · Question #54

The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insec

The correct answer is A. Cloud customers and third parties are continually enhancing and modifying APIs.. The prevalence of insecure interfaces and APIs in cloud computing stems from their constant enhancement and modification by cloud customers and third parties, leading to potential vulnerabilities.

Submitted by jordan8· Apr 18, 2026Cloud Application Security

Question

The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insecure interfaces and APIs is so prevalent in cloud computing?

Options

  • ACloud customers and third parties are continually enhancing and modifying APIs.
  • BAPIs can have automated settings.
  • CIt is impossible to uninstall APIs.
  • DAPIs are a form of malware.

How the community answered

(34 responses)
  • A
    88% (30)
  • B
    3% (1)
  • C
    3% (1)
  • D
    6% (2)

Why each option

The prevalence of insecure interfaces and APIs in cloud computing stems from their constant enhancement and modification by cloud customers and third parties, leading to potential vulnerabilities.

ACloud customers and third parties are continually enhancing and modifying APIs.Correct

Cloud environments heavily rely on APIs for management, orchestration, and interaction between services, and these APIs are frequently updated, modified, or extended by both cloud providers and consumers. This rapid evolution and integration increase the likelihood of introducing security flaws, misconfigurations, or inadequate access controls if not carefully managed and secured throughout their lifecycle.

BAPIs can have automated settings.

While automated settings can impact security, the core reason for the prevalence of insecure interfaces is not automation itself but rather the frequent changes and potential for misconfigurations introduced during development.

CIt is impossible to uninstall APIs.

APIs are programmatic interfaces, not software applications that are 'installed' or 'uninstalled' in the traditional sense, making this statement technically inaccurate.

DAPIs are a form of malware.

APIs are fundamental building blocks for communication and functionality, not a form of malware.

Concept tested: CSA Notorious Nine - Insecure APIs threat

Source: https://cloudsecurityalliance.org/research/artifacts/the-notorious-nine-cloud-computing-top-threats-in-2016

Topics

#CSA Notorious Nine#API Security#Cloud Threats#Insecure Interfaces

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCSP Practice