Exam 312-50v13 topic 1 question 141 discussion

I would opt for A. John did what was tasked, and the company understood the risk, but they decided not to do an amendment accordingly.

Organization opted to fix only the most severe vulnerability. Other vulnerabilities have been left open, so it's organization's fault.

John was hired and created his report, the company is then responsible to fix..

The Organization's Responsibility: 1- They had limited resources, but prioritizing only one vulnerability was a poor risk management decision. 2- Cybersecurity is about holistic protection, not just fixing one critical issue. 3- Ignoring other known vulnerabilities left the system exposed, leading to the data breach. John’s Responsibility: 1- As a professional ethical hacker, John should have clearly communicated the risks of leaving other vulnerabilities unpatched. 2- He should have provided a risk-based prioritization with possible mitigation strategies for all vulnerabilities. 3- If the organization couldn’t patch everything, he could have suggested compensating controls (e.g., monitoring, segmentation, or temporary mitigations). Cybersecurity is a shared responsibility, and this case reflects poor risk prioritization rather than a single point of failure.

I think John has nothing to do with the company's problems, he has just started to identify the problems, I think he is alternative A