The correct answer is Undocumented application programming interfaces.

Undocumented application programming interfaces are hidden or forgotten endpoints that are not part of the published interface of an application and they often escape design reviews and security testing. These interfaces can expose sensitive functions or data without the expected authentication and authorization controls and they may lack logging and monitoring which makes them attractive targets for attackers.

Because these endpoints are hidden defenders must include discovery scans code reviews and runtime monitoring to find and protect them. Controls include strict authentication and authorization robust input validation rate limiting and audit logging and an explicit deprecation and removal process for any undocumented API.

Hardcoded configuration values are a security weakness but they are not a hidden interface. They refer to secrets or settings embedded in code and they require different controls such as secret management and code scans rather than the discovery and interface protections needed for undocumented APIs.

Cryptographic agility is a design property that allows swapping cryptographic algorithms and libraries and it is a security best practice rather than a hidden interface. It does not describe an interface that attackers use as an entry point so it is not the correct choice.

Managed runtime components such as runtime libraries and virtual machines can have vulnerabilities but they are not by definition hidden application interfaces. They are infrastructure elements that need patching and configuration management rather than the special discovery and access controls used for undocumented APIs.

Full AWS Practitioner Certification Question