Ethical Hacker Liability and Organizational Risk Acceptance

Introduction to Ethical Hacking

Answer Correct answer: A — The organization is at fault because it did not fix all identified vulnerabilities.

An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?

The organization is at fault because it did not fix all identified vulnerabilities. Correct Answer
Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.
John is at fault because he did not emphasize the necessity of patching all vulnerabilities.
The organization is not at fault because they used their resources as per their understanding.

Community Votes

47%

29%

24%

47% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The core trap is confusing 'risk acceptance' with 'negligence'; while organizations can accept risks, they remain liable for breaches resulting from known, unpatched vulnerabilities.

This question tests the ethical hacker's scope of liability versus the organization's ultimate responsibility for risk management. The page establishes that the organization is at fault for failing to remediate identified vulnerabilities, regardless of resource constraints.

Many learners choose B, believing that because the hacker identified the issue, he shares blame for the breach if it wasn't fixed immediately.

Community Discussion (15 comments)

blehbleh 👍 1 Selected: A

This is A. You don't just have a breach of security and it not be the companies fault because they decided not to fix it due to whatever reasons, money, accepting risk, etc... If you read anything about hacks, breaches, anything at all on google you can see that at no point is a company never not blamed for their lack of security or patching. They are still at fault even if they have limited funds.

LoveBug4 👍 1 Selected: A

John is not at fault, as per Module 1, page 48, it is the limitation of an ethical hacker. So, either A or D. I would say A as it doesn't matter why, but they didn't fix the identified vulnerabilities.

yicx1 👍 1

It's AAAAAAA. Just imagine your personal information was obtained by someone and they make scam calls all the time. You found that this is because you registered an account for an online shopping app, and they don't have money to fix the vulnerability issue. Whose fault it this?

abcd_qw 👍 1

"because they did not adequately manage the vulnerabilities" -- how can they adequately manage the vulnerabilities ,somebody please say about that

Spamerz 👍 4 Selected: D

Organization used Risk Management. It means, they must first look to most severe vulnerability and go down, depending on resources. Both parties MUST NOT BLAME EACH OTHER, because it is not ethical. So, both - John and organization are right, just "sht happens".

LordXander 👍 1 Selected: B

AI says B, in practice it will be B (did the company implement a risk acceptance procedure and etc? well, they don't have the budget to fix so I doubt there's a acceptance process)

qtygbapjpesdayazko 👍 2 Selected: A

Keyword "opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability." is A

jettguo 👍 1 Selected: A

I choose A, I think John do not have executive decisions on which vulnerability to fix, and he did his duty to present all the vulnerabilities he discovered.

qwerty100 👍 2 Selected: B

B. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities. The key is : a data breach occurs exploiting a different vulnerability

anarchyeagle 👍 3 Selected: A

I could not see how this answer is not A. It's clearly invoking Risk Management in which some risks have been mitigated while others are Accepted based on resource limitations. The only doubt in the question comes from the wording. Is the vulnerability that was exploited not identified by John, or was it an accepted vulnerability by the company? Either way, John was a contractor not an employee. It's the company's responsibility to understand that there is a risk in not seeking a second opinion. A is the only answer. The company is always responsible for their security without a contract transferring all risk to a third party company..

brrbrr 👍 1 Selected: B

B is the correct answer. Option A suggests that the organization is at fault because it did not fix all identified vulnerabilities. However, in the context of limited resources, organizations often need to prioritize and allocate their resources strategically. In the scenario described, the organization decided to fix the most severe vulnerability based on its understanding and resource limitations. While it's true that addressing all vulnerabilities would be ideal, practical constraints may prevent this. Therefore, placing the entire blame on the organization may not be fair. Option B is a more balanced choice, indicating that both the organization and John share responsibility. This acknowledges that the organization made a decision based on its constraints, but it also suggests that John, as the ethical hacker, has a role in emphasizing the importance of addressing all vulnerabilities and the potential risks associated with leaving some unpatched.

barey 👍 2

Tricky, chat GPT4 says: In this scenario, both the organization and the ethical hacker, John, share responsibility. The organization chose to prioritize fixing only the most severe vulnerability due to limited resources, but it is their responsibility to make informed decisions based on the advice given by the ethical hacker. And Azure AI: A. The organization is at fault because it did not fix all identified vulnerabilities. but whan i aske why: he statement B can be seen as accurate because both the organization and John have roles in managing the vulnerabilities. John, as an ethical hacker, should emphasize the importance of addressing all identified vulnerabilities, LOL i put B on Exam

[Removed] 👍 1

Im not certain about the reliability of that information

[Removed] 👍 1

Hey team can we double-check this response

insaniunt 👍 1 Selected: B

B. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is A. In ethical hacking engagements, the consultant identifies vulnerabilities and provides recommendations, but the decision to mitigate, accept, or transfer risk rests solely with the organization (the client). By choosing to fix only the most severe vulnerability due to limited resources, the organization exercised its right to manage risk based on priority. However, this does not absolve them of liability; they are still at fault for the breach because they failed to secure the system against known threats.

Why the Other Options Are Wrong

Option B is incorrect because the ethical hacker fulfilled their duty by identifying and reporting the vulnerabilities; they do not share operational responsibility for the organization's security posture. Option C is wrong for the same reason—the hacker’s role is advisory, not custodial. Option D is incorrect because claiming the organization is 'not at fault' ignores the reality that they chose to leave a known vulnerability exposed, leading to the breach.

Community Comment Notes

Community consensus heavily favored A, with many noting that 'Risk Management' implies prioritizing fixes. As Spamerz noted, the organization used risk management principles by addressing the most severe issues first. Others like anarchyeagle pointed out that John was a contractor, reinforcing that the final security decisions and their consequences belong to the organization.

Exam Strategy

Always remember that in cybersecurity exams, the 'owner' of the asset (the organization) bears the ultimate responsibility for its security. Consultants provide expertise, but clients make the business decisions regarding risk acceptance.

Frequently Asked Questions

Can an ethical hacker be held liable for a breach?

No, unless negligence in testing occurred. The client retains responsibility for implementing fixes.

Does limited budget excuse a data breach?

No. Organizations must prioritize security based on available resources, but they remain accountable for known, unmitigated risks.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide