Ethical Hacker Liability for Unpatched Vulnerabilities

312-50v13 By islever Editorial Last updated

Introduction to Ethical Hacking

Short answer

A The organization is at fault because it did not fix all identified vulnerabilities.

Question

An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?
  1. The organization is at fault because it did not fix all identified vulnerabilities. Correct Answer
  2. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.
  3. John is at fault because he did not emphasize the necessity of patching all vulnerabilities.
  4. The organization is not at fault because they used their resources as per their understanding.

Key Takeaways

The core concept tested is the distinction between vulnerability assessment (identification) and remediation (fixing), with the common trap being confusion over who owns the residual risk.

This question explores the professional boundaries and liability of an ethical hacker versus the client organization in risk management. The correct answer establishes that the organization bears ultimate responsibility for implementing security controls.

Common mistake: Many learners incorrectly choose B, believing that because John identified the issues, he shares blame for the breach, failing to recognize that remediation is the client's duty.

Expert Analysis

Why the Answer Is Correct

Correct answer: A — The organization is at fault because it did not fix all identified vulnerabilities. In the context of ethical hacking and penetration testing, the engagement typically concludes with a report detailing findings and recommendations. The responsibility for prioritizing and implementing fixes rests entirely with the client organization. Since the organization explicitly chose to fix only the most severe vulnerability despite knowing about others, they accepted the residual risk associated with those unpatched flaws. The breach occurred due to this deliberate decision, making the organization liable.

Why the Other Options Are Wrong

Option B is incorrect because John fulfilled his contractual obligation by identifying and reporting the vulnerabilities; he cannot be held responsible for the client's failure to act. Option C is wrong as there is no indication John failed to emphasize the necessity of patching; the scenario states the organization opted to limit fixes due to resources. Option D is incorrect because using limited resources does not absolve the organization of liability for known risks that were ignored.

Community Comment Notes

The community overwhelmingly voted for A, with users like MHafizC noting that "John did what was tasked, and the company understood the risk." Marcel9999 reinforced this by stating, "John was hired and created his report, the company is then responsible to fix." While one user suggested shared responsibility (B), the consensus correctly identifies that the ethical hacker's role ends at identification and advisory.

Exam Strategy

Focus on the division of responsibilities in security engagements: the tester finds the problems, but the owner fixes them. Always attribute risk acceptance and implementation failures to the client, not the consultant.

Frequently Asked Questions

Does an ethical hacker share liability if the client ignores critical findings?

No, unless the contract specifies ongoing monitoring or implementation duties. Typically, liability for unpatched vulnerabilities lies with the client.

What should John have done differently to avoid ambiguity?

John should have clearly documented the risk acceptance process, ensuring the organization formally acknowledged the consequences of ignoring non-critical vulnerabilities.

More 312-50v13 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. MHafizC 👍 5 Answered A
    I would opt for A. John did what was tasked, and the company understood the risk, but they decided not to do an amendment accordingly.
  2. pindinga1 👍 4 Answered A
    I think John has nothing to do with the company's problems, he has just started to identify the problems, I think he is alternative A
  3. marcel9999 👍 4 Answered A
    John was hired and created his report, the company is then responsible to fix..
  4. killwitch 👍 3 Answered A
    Organization opted to fix only the most severe vulnerability. Other vulnerabilities have been left open, so it's organization's fault.
  5. HazalAlenazi 👍 1 Answered B
    The Organization's Responsibility: 1- They had limited resources, but prioritizing only one vulnerability was a poor risk management decision. 2- Cybersecurity is about holistic protection, not just fixing one critical issue. 3- Ignoring other known vulnerabilities left the system exposed, leading to the data breach. John’s Responsibility: 1- As a professional ethical hacker, John should have clearly communicated the risks of leaving other vulnerabilities unpatched. 2- He should have provided a risk-based prioritization with possible mitigation strategies for all vulnerabilities. 3- If the organization couldn’t patch everything, he could have suggested compensating controls (e.g., monitoring, segmentation, or temporary mitigations). Cybersecurity is a shared responsibility, and this case reflects poor risk prioritization rather than a single point of failure.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide