Exam 312-50v11 topic 1 question 222 discussion

It doesn't say if it's with the company's permission. If it is - white hat if it isn't - gray hat

Gray hats are the individuals who work both offensively and defensively at various times. Gray hats might help hackers to find various vulnerabilities in a system or network and, at the same time, help vendors to improve products (software or hardware) by checking limitations and making them more secure. White Hat - a hacker who has authority to perform security assessment or with legal contract and agreements to an organization. Gray Hat - don't have authority to perform any security assessment to anyone.

Who only have permission to find a vulnerability he called as a white hat other-wise they called as gray hat

it's public facing, so he didn't need permission. It's White Hat

ChatGPT: Nicolas would be classified as a White-hat hacker. White-hat hackers are ethical hackers who use their skills to help organizations and individuals by finding and fixing security vulnerabilities. In this case, Nicolas discovered a zero-day vulnerability and responsibly disclosed it to the owner of the public-facing system, providing guidance on how to protect against it. Additionally, Nicolas informed Microsoft about the vulnerability, contributing to the overall improvement of security. The key characteristic of a white-hat hacker is the ethical use of their skills to enhance security, often through activities such as penetration testing, vulnerability assessment, and responsible disclosure of security issues.

White-hat hackers have permissions while grey-hat hackers don't and work both offensively and defensively

Nicolas falls into the category of a gray hat hacker. Gray hat hackers are individuals who may discover and disclose vulnerabilities or security issues to the affected parties, but they may not have explicit permission to do so. In this case, Nicolas identified a zero-day vulnerability and informed both the system owner and the relevant company (Microsoft) about the issue. While his intentions seem to be responsible, the fact that he discovered a zero-day vulnerability without explicit permission makes him a gray hat hacker.

According to the narrative Nicholas did not have the permission from the system owner.

Neither the owner of the public facing system nor Microsoft gave Nicolas the permission to do it, he was not employed by them, so it's Gray hat.

Agreed no permission.

He didn’t have permission

Gray hat hackers often look for vulnerabilities in a system without the owner's permission or knowledge. If issues are found, they report them to the owner, sometimes requesting a small fee to fix the problem C Answer

The correct option is B White hacker

White hat hackers are individuals authorized to find and exploit vulnerabilities in a system. Gray Hat hackers typically don’t cause damages to a victim — they discover vulnerabilities that can potentially cause damages. Then, these grey hatters reach out to the affected parties and notify them regarding the issues.

The correct is C. They did not hire him or give him the permission to do it.

the intention of this question is to show how a white hat hacker reports a vulnerability responsibly... it's not gray... b/c we are not told HOW the hacker found the vulnerability... it could have been by accident... nothing malicious

It was unauthorized.