easyMultiple SelectObjective-mapped
CRISC API Gateway Security Practice Question
A risk practitioner is identifying risks related to a new API gateway implementation. Which TWO of the following are MOST likely to be significant risks?
⚠ Common exam trap
Watch out — candidates often confuse operational risks (scalability, cost) with security risks, or they incorrectly assume that outdated programming languages are a direct risk to the API gateway itself, when in fact the gateway abstracts away language-specific vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insufficient logging of API requests.
Insufficient logging of API requests (A) is a significant risk because it impairs the ability to detect, investigate, and respond to security incidents such as unauthorized access, injection attacks, or data exfiltration. Without comprehensive logs, the organization cannot perform effective forensic analysis or meet compliance requirements (e.g., PCI DSS, SOX). In the context of an API gateway, which acts as the central entry point for all API traffic, missing logs create a blind spot for threat detection and incident response. Insecure direct object references (C) allow an attacker to access unauthorized data by manipulating object identifiers (e.g., user IDs, file paths) in API requests. This is a common API vulnerability that can lead to data breaches, especially if the gateway does not enforce proper authorization checks. Together, these two represent critical security risks that could compromise confidentiality and integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insufficient logging of API requests.
Why this is correct
Logging is critical for detection and forensics; its absence is a risk.
- ✗
Lack of scalability for peak loads.
Why it's wrong here
Scalability is a performance issue, not a primary security risk.
- ✓
Insecure direct object references (IDOR) allowing unauthorized data access.
Why this is correct
IDOR is a top API security risk per OWASP.
- ✗
Use of outdated programming language.
Why it's wrong here
Language choice is indirect; more specific to implementation.
- ✗
High licensing cost.
Why it's wrong here
Cost is a financial concern, not a risk identification priority.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.