nerdexam
EC-Council

312-50V11 · Question #72

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests…

The correct answer is D. Immediately stop work and contact the proper legal authorities. When evidence of serious illegal activity is discovered during a security assessment, the professional must immediately halt work and report to law enforcement rather than continuing or interfering.

Information Security and Ethical Hacking Fundamentals

Question

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking. What should you do?

Options

  • AConfront the client in a respectful manner and ask her about the data.
  • BCopy the data to removable media and keep it in case you need it.
  • CIgnore the data and continue the assessment until completed as agreed.
  • DImmediately stop work and contact the proper legal authorities.

How the community answered

(31 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    3% (1)
  • D
    87% (27)

Why each option

When evidence of serious illegal activity is discovered during a security assessment, the professional must immediately halt work and report to law enforcement rather than continuing or interfering.

AConfront the client in a respectful manner and ask her about the data.

Confronting the client could alert them to destroy evidence and may place the security professional in a dangerous or legally compromised situation.

BCopy the data to removable media and keep it in case you need it.

Copying data to removable media could constitute tampering with potential evidence and may violate laws governing the handling of materials related to criminal activity.

CIgnore the data and continue the assessment until completed as agreed.

Ignoring discovered evidence of a serious crime violates professional ethics codes and may constitute a failure to meet legal obligations to report known criminal activity.

DImmediately stop work and contact the proper legal authorities.Correct

Security professionals have both an ethical and legal obligation to report evidence of serious crimes such as human trafficking to the appropriate authorities. Continuing the engagement, confronting the client, or copying data could compromise a criminal investigation and expose the professional to legal liability. Immediately stopping work and contacting law enforcement is the only appropriate response.

Concept tested: Ethical and legal obligations when discovering criminal activity

Source: https://www.eccouncil.org/code-of-ethics/

Topics

#penetration testing ethics#legal obligations#ethical hacking#incident reporting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice