Ethical Hacker Liability for Unpatched Vulnerabilities
An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is the distinction between vulnerability assessment (identification) and remediation (fixing), with the common trap being confusion over who owns the residual risk.
This question explores the professional boundaries and liability of an ethical hacker versus the client organization in risk management. The correct answer establishes that the organization bears ultimate responsibility for implementing security controls.
Many learners incorrectly choose B, believing that because John identified the issues, he shares blame for the breach, failing to recognize that remediation is the client's duty.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: A — The organization is at fault because it did not fix all identified vulnerabilities. In the context of ethical hacking and penetration testing, the engagement typically concludes with a report detailing findings and recommendations. The responsibility for prioritizing and implementing fixes rests entirely with the client organization. Since the organization explicitly chose to fix only the most severe vulnerability despite knowing about others, they accepted the residual risk associated with those unpatched flaws. The breach occurred due to this deliberate decision, making the organization liable.Why the Other Options Are Wrong
Option B is incorrect because John fulfilled his contractual obligation by identifying and reporting the vulnerabilities; he cannot be held responsible for the client's failure to act. Option C is wrong as there is no indication John failed to emphasize the necessity of patching; the scenario states the organization opted to limit fixes due to resources. Option D is incorrect because using limited resources does not absolve the organization of liability for known risks that were ignored.Community Comment Notes
The community overwhelmingly voted for A, with users like MHafizC noting that "John did what was tasked, and the company understood the risk." Marcel9999 reinforced this by stating, "John was hired and created his report, the company is then responsible to fix." While one user suggested shared responsibility (B), the consensus correctly identifies that the ethical hacker's role ends at identification and advisory.Exam Strategy
Focus on the division of responsibilities in security engagements: the tester finds the problems, but the owner fixes them. Always attribute risk acceptance and implementation failures to the client, not the consultant.
Frequently Asked Questions
Does an ethical hacker share liability if the client ignores critical findings?
No, unless the contract specifies ongoing monitoring or implementation duties. Typically, liability for unpatched vulnerabilities lies with the client.
What should John have done differently to avoid ambiguity?
John should have clearly documented the risk acceptance process, ensuring the organization formally acknowledged the consequences of ignoring non-critical vulnerabilities.