Exam 312-50v12 topic 1 question 141 discussion

The ans is A

John notified the organization of the vulnerabilities but chose to not fix all, so John is not at fault and the answer has to be A.

This is A. You don't just have a breach of security and it not be the companies fault because they decided not to fix it due to whatever reasons, money, accepting risk, etc... If you read anything about hacks, breaches, anything at all on google you can see that at no point is a company never not blamed for their lack of security or patching. They are still at fault even if they have limited funds.

John is not at fault, as per Module 1, page 48, it is the limitation of an ethical hacker. So, either A or D. I would say A as it doesn't matter why, but they didn't fix the identified vulnerabilities.

It's AAAAAAA. Just imagine your personal information was obtained by someone and they make scam calls all the time. You found that this is because you registered an account for an online shopping app, and they don't have money to fix the vulnerability issue. Whose fault it this?

"because they did not adequately manage the vulnerabilities" -- how can they adequately manage the vulnerabilities ,somebody please say about that

Organization used Risk Management. It means, they must first look to most severe vulnerability and go down, depending on resources. Both parties MUST NOT BLAME EACH OTHER, because it is not ethical. So, both - John and organization are right, just "sht happens".

AI says B, in practice it will be B (did the company implement a risk acceptance procedure and etc? well, they don't have the budget to fix so I doubt there's a acceptance process)

Keyword "opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability." is A

I choose A, I think John do not have executive decisions on which vulnerability to fix, and he did his duty to present all the vulnerabilities he discovered.

B. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities. The key is : a data breach occurs exploiting a different vulnerability

I could not see how this answer is not A. It's clearly invoking Risk Management in which some risks have been mitigated while others are Accepted based on resource limitations. The only doubt in the question comes from the wording. Is the vulnerability that was exploited not identified by John, or was it an accepted vulnerability by the company? Either way, John was a contractor not an employee. It's the company's responsibility to understand that there is a risk in not seeking a second opinion. A is the only answer. The company is always responsible for their security without a contract transferring all risk to a third party company..

B is the correct answer. Option A suggests that the organization is at fault because it did not fix all identified vulnerabilities. However, in the context of limited resources, organizations often need to prioritize and allocate their resources strategically. In the scenario described, the organization decided to fix the most severe vulnerability based on its understanding and resource limitations. While it's true that addressing all vulnerabilities would be ideal, practical constraints may prevent this. Therefore, placing the entire blame on the organization may not be fair. Option B is a more balanced choice, indicating that both the organization and John share responsibility. This acknowledges that the organization made a decision based on its constraints, but it also suggests that John, as the ethical hacker, has a role in emphasizing the importance of addressing all vulnerabilities and the potential risks associated with leaving some unpatched.

Tricky, chat GPT4 says: In this scenario, both the organization and the ethical hacker, John, share responsibility. The organization chose to prioritize fixing only the most severe vulnerability due to limited resources, but it is their responsibility to make informed decisions based on the advice given by the ethical hacker. And Azure AI: A. The organization is at fault because it did not fix all identified vulnerabilities. but whan i aske why: he statement B can be seen as accurate because both the organization and John have roles in managing the vulnerabilities. John, as an ethical hacker, should emphasize the importance of addressing all identified vulnerabilities, LOL i put B on Exam

Im not certain about the reliability of that information

B. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.