312-50V9 · Question #178
Which initial procedure should an ethical hacker perform after being brought into an organization?
The correct answer is C. Sign a formal contract with non-disclosure. Before any work begins, an ethical hacker must execute a formal contract that includes a non-disclosure agreement to legally authorize the engagement and protect all parties.
Question
Which initial procedure should an ethical hacker perform after being brought into an organization?
Options
- ABegin security testing.
- BTurn over deliverables.
- CSign a formal contract with non-disclosure.
- DAssess what the organization is trying to protect.
How the community answered
(20 responses)- B5% (1)
- C90% (18)
- D5% (1)
Why each option
Before any work begins, an ethical hacker must execute a formal contract that includes a non-disclosure agreement to legally authorize the engagement and protect all parties.
Beginning security testing without a signed contract means the hacker has no legal authorization, turning the activity into unauthorized access.
Turning over deliverables is the final phase of an engagement, not an initial step.
A signed formal contract with NDA is the foundational requirement before any ethical hacking activity starts. It defines the scope, grants legal authorization for testing, and creates confidentiality obligations that protect the organization's sensitive data. Without this document, any subsequent technical activity - even well-intentioned - could be considered unauthorized and expose the hacker to criminal liability.
Assessing what the organization is trying to protect is a valid early scoping activity, but it must occur after the contract and NDA are in place to ensure confidentiality obligations already exist.
Concept tested: Ethical hacking engagement initiation - contract and NDA requirement
Source: https://www.eccouncil.org/code-of-ethics/
Topics
Community Discussion
No community discussion yet for this question.