CISSP Practice Question: A CISSP discovers a critical zero-day vulnerability in a competitor's product while…

Correct Answer: A. Protect society, the common good, and the infrastructure

Explanation (CISSP Manager Logic):

The (ISC)² Code of Ethics establishes a mandatory hierarchy for its canons. The first canon—protecting society and infrastructure—takes precedence over all others. Discovering a zero-day vulnerability poses a risk to the public and critical infrastructure, requiring the professional to prioritize safety and security over individual or organizational interests.

By prioritizing the first canon, you:

• Ensure the safety of the public and digital ecosystem
• Maintain the integrity of critical infrastructure
• Fulfill the highest level of professional responsibility

While the other options are relevant canons, they fall short because:

• B: Acting honorably is the second canon and is subordinate to the protection of society.
• C: Providing diligent service to principals is the third canon and does not override public safety concern.
• D: Advancing the profession is the fourth and final canon in the hierarchy.

Think like a manager:

When ethical canons conflict, always follow the established hierarchy. The safety of the many (society) outweighs the interests of the few (principals or the profession).