Ethical Hacker Liability and Organizational Risk Acceptance
Short answer
A The organization is at fault because it did not fix all identified vulnerabilities.
Question
Key Takeaways
The core trap is confusing 'risk acceptance' with 'negligence'; while organizations can accept risks, they remain liable for breaches resulting from known, unpatched vulnerabilities.
This question tests the ethical hacker's scope of liability versus the organization's ultimate responsibility for risk management. The page establishes that the organization is at fault for failing to remediate identified vulnerabilities, regardless of resource constraints.
Common mistake: Many learners choose B, believing that because the hacker identified the issue, he shares blame for the breach if it wasn't fixed immediately.
Expert Analysis
Why the Answer Is Correct
The correct answer is A. In ethical hacking engagements, the consultant identifies vulnerabilities and provides recommendations, but the decision to mitigate, accept, or transfer risk rests solely with the organization (the client). By choosing to fix only the most severe vulnerability due to limited resources, the organization exercised its right to manage risk based on priority. However, this does not absolve them of liability; they are still at fault for the breach because they failed to secure the system against known threats.
Why the Other Options Are Wrong
Option B is incorrect because the ethical hacker fulfilled their duty by identifying and reporting the vulnerabilities; they do not share operational responsibility for the organization's security posture. Option C is wrong for the same reason—the hacker’s role is advisory, not custodial. Option D is incorrect because claiming the organization is 'not at fault' ignores the reality that they chose to leave a known vulnerability exposed, leading to the breach.
Community Comment Notes
Community consensus heavily favored A, with many noting that 'Risk Management' implies prioritizing fixes. As Spamerz noted, the organization used risk management principles by addressing the most severe issues first. Others like anarchyeagle pointed out that John was a contractor, reinforcing that the final security decisions and their consequences belong to the organization.
Exam Strategy
Always remember that in cybersecurity exams, the 'owner' of the asset (the organization) bears the ultimate responsibility for its security. Consultants provide expertise, but clients make the business decisions regarding risk acceptance.
Frequently Asked Questions
Can an ethical hacker be held liable for a breach?
Does limited budget excuse a data breach?
Community Votes
47% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 15 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 15
-
Spamerz 👍 4 Answered DOrganization used Risk Management. It means, they must first look to most severe vulnerability and go down, depending on resources. Both parties MUST NOT BLAME EACH OTHER, because it is not ethical. So, both - John and organization are right, just "sht happens".
-
anarchyeagle 👍 3 Answered AI could not see how this answer is not A. It's clearly invoking Risk Management in which some risks have been mitigated while others are Accepted based on resource limitations. The only doubt in the question comes from the wording. Is the vulnerability that was exploited not identified by John, or was it an accepted vulnerability by the company? Either way, John was a contractor not an employee. It's the company's responsibility to understand that there is a risk in not seeking a second opinion. A is the only answer. The company is always responsible for their security without a contract transferring all risk to a third party company..
-
barey 👍 2Tricky, chat GPT4 says: In this scenario, both the organization and the ethical hacker, John, share responsibility. The organization chose to prioritize fixing only the most severe vulnerability due to limited resources, but it is their responsibility to make informed decisions based on the advice given by the ethical hacker. And Azure AI: A. The organization is at fault because it did not fix all identified vulnerabilities. but whan i aske why: he statement B can be seen as accurate because both the organization and John have roles in managing the vulnerabilities. John, as an ethical hacker, should emphasize the importance of addressing all identified vulnerabilities, LOL i put B on Exam
-
qwerty100 👍 2 Answered BB. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities. The key is : a data breach occurs exploiting a different vulnerability
-
qtygbapjpesdayazko 👍 2 Answered AKeyword "opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability." is A
Show 10 more comments
-
brrbrr 👍 1 Answered BB is the correct answer. Option A suggests that the organization is at fault because it did not fix all identified vulnerabilities. However, in the context of limited resources, organizations often need to prioritize and allocate their resources strategically. In the scenario described, the organization decided to fix the most severe vulnerability based on its understanding and resource limitations. While it's true that addressing all vulnerabilities would be ideal, practical constraints may prevent this. Therefore, placing the entire blame on the organization may not be fair. Option B is a more balanced choice, indicating that both the organization and John share responsibility. This acknowledges that the organization made a decision based on its constraints, but it also suggests that John, as the ethical hacker, has a role in emphasizing the importance of addressing all vulnerabilities and the potential risks associated with leaving some unpatched.
-
blehbleh 👍 1 Answered AThis is A. You don't just have a breach of security and it not be the companies fault because they decided not to fix it due to whatever reasons, money, accepting risk, etc... If you read anything about hacks, breaches, anything at all on google you can see that at no point is a company never not blamed for their lack of security or patching. They are still at fault even if they have limited funds.
-
yicx1 👍 1It's AAAAAAA. Just imagine your personal information was obtained by someone and they make scam calls all the time. You found that this is because you registered an account for an online shopping app, and they don't have money to fix the vulnerability issue. Whose fault it this?
-
LoveBug4 👍 1 Answered AJohn is not at fault, as per Module 1, page 48, it is the limitation of an ethical hacker. So, either A or D. I would say A as it doesn't matter why, but they didn't fix the identified vulnerabilities.
-
LordXander 👍 1 Answered BAI says B, in practice it will be B (did the company implement a risk acceptance procedure and etc? well, they don't have the budget to fix so I doubt there's a acceptance process)
-
jettguo 👍 1 Answered AI choose A, I think John do not have executive decisions on which vulnerability to fix, and he did his duty to present all the vulnerabilities he discovered.
-
abcd_qw 👍 1"because they did not adequately manage the vulnerabilities" -- how can they adequately manage the vulnerabilities ,somebody please say about that
-
insaniunt 👍 1 Answered BB. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.
-
[Removed] 👍 1Im not certain about the reliability of that information
-
[Removed] 👍 1Hey team can we double-check this response
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.