021.3 Ethical Behavior (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security researcher discovers a zero-day vulnerability in a widely used email server. The researcher is not affiliated with the vendor. The researcher wants to disclose the vulnerability ethically, but the vendor has a history of ignoring reports. What is the most balanced approach?

   • APrivately report to the vendor, wait a reasonable period, and then coordinate public disclosure if no fix is forthcoming.
   • BSell the vulnerability to a government agency for national security purposes.
   • CPublish the vulnerability immediately to force the vendor to act.
   • DKeep the vulnerability secret to avoid legal liability.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is evaluating two vendors for a new security tool. One vendor is a former employer of the architect, and the architect still holds stock options in that company. The architect's current employer does not know about the stock options. What is the most ethical course of action?

   • ARecuse themselves from the vendor selection process.
   • BRecommend the former employer's tool because it is technically superior.
   • CRecommend the other vendor to avoid any appearance of bias.
   • DDisclose the stock options to the employer and let them decide how to proceed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester finds a vulnerability in a third-party software used by their employer. The vendor has a public bug bounty program. What is the most appropriate action?

   • AKeep the vulnerability secret to avoid legal liability.
   • BPublish the vulnerability on a public exploit database to warn other users.
   • CExploit the vulnerability to demonstrate the risk to the employer.
   • DSubmit the vulnerability to the vendor's bug bounty program with a clear report.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security student wants to test their skills on a live website without permission. They argue it is for learning. What is the key ethical flaw in this reasoning?

   • AThe student lacks the technical skill to perform the test safely.
   • BThe student is using a personal computer, not a company one.
   • CThe student is not doing it for financial gain.
   • DThe student does not have authorization from the website owner.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A marketing team asks a security analyst to provide customer email addresses for a promotional campaign. The analyst knows that the company's privacy policy prohibits sharing customer data for marketing without consent. What should the analyst do?

   • ARefuse the request and explain the privacy policy and legal requirements.
   • BProvide the emails but ask the marketing team to delete them after the campaign.
   • CAnonymize the emails before sharing them.
   • DProvide the emails because the request comes from an internal team.
   Reveal Solution Discussion Select an answer first