Cyber Laws and Ethics MCQ 60 Tests With Answers (2026)

Incorrect·B: The Computer Fraud and Abuse Act (CFAA)

The CFAA (18 U.S.C. § 1030), enacted in 1986 and repeatedly amended, is the primary US federal anti-hacking statute. It criminalizes unauthorized access, intentional damage to computers, trafficking in access credentials, and extortion involving computer threats. Its broad "exceeds authorized access" language has been debated in landmark cases like Van Buren v. United States (2021).

Incorrect·A: Mandating strict accuracy, security, retention, and auditing of corporate financial records and the IT systems storing them

The Sarbanes-Oxley Act of 2002 (SOX), enacted after Enron and WorldCom frauds, imposes rigorous requirements on publicly traded companies: Section 302 (CEO/CFO personal certification of financial statements), Section 404 (management assessment of internal controls), and Section 802 (criminal penalties for document destruction). IT systems storing financial records must have robust access controls, audit logs, and change management.

Incorrect·D: It criminalizes the circumvention of digital rights management (DRM) and access controls, which can complicate reverse engineering and vulnerability research

DMCA Section 1201 prohibits circumventing "technological protection measures" (TPMs) protecting copyrighted works. This has been used to threaten security researchers reverse-engineering products for vulnerability discovery, even for legitimate defensive research. The EFF has repeatedly petitioned for security research exemptions in the triennial Section 1201 rulemaking proceedings.

Incorrect·C: To establish national standards for protecting individuals' electronic personal health information (ePHI)

The HIPAA Security Rule (45 CFR Parts 160 and 164) establishes national standards for protecting electronic protected health information (ePHI). It requires covered entities and business associates to implement administrative safeguards (policies, training), physical safeguards (facility access controls), and technical safeguards (encryption, access controls, audit controls) to ensure ePHI confidentiality, integrity, and availability.

Incorrect·C: The chronological, documented paper trail that records the seizure, control, transfer, and analysis of electronic evidence

Chain of custody is a fundamental legal requirement for digital evidence admissibility. Every person who handles a piece of evidence — from first acquisition through court presentation — must be documented with timestamps, actions, and signatures. Any break in the chain can lead to evidence suppression and case dismissal, which is why forensic investigators use tamper-evident packaging and hash verification.

Incorrect·B: Payment Card Industry Data Security Standard (PCI-DSS)

PCI-DSS is a contractual security standard developed by the PCI Security Standards Council (founded by Visa, Mastercard, Amex, Discover, JCB). It applies to all entities that store, process, or transmit cardholder data, requiring 12 high-level requirements grouped around network security, access control, monitoring, and vulnerability management. Non-compliance risks fines, increased transaction fees, and loss of card processing rights.

Incorrect·A: It shields them from liability for illegal actions committed by their users, provided they remove the infringing content when legally notified

Safe harbor provisions limit platform liability for user-generated content. Under DMCA Section 512, hosts are shielded from copyright infringement liability if they comply with takedown notices. Under Section 230 of the CDA, platforms are shielded from liability for third-party speech. Both are heavily debated in the context of AI-generated content, deepfakes, and platform moderation.

Incorrect·D: Explain their information-sharing practices to customers and proactively safeguard sensitive data

The GLBA (1999) has three principal rules: (1) The Privacy Rule — requires financial institutions to disclose their data-sharing practices and offer opt-out rights. (2) The Safeguards Rule — requires a written information security program with administrative, technical, and physical safeguards. (3) The Pretexting Provisions — prohibit social engineering to obtain financial information.

Incorrect·D: The technology can be used for both highly beneficial civilian purposes and highly destructive military or malicious purposes

Dual-use dilemmas are central to cybersecurity ethics: offensive tools (Metasploit, Cobalt Strike, network scanners) have legitimate defensive/research purposes but are weaponizable. Vulnerability research, cryptography, and intrusion tools all present this tension. The Wassenaar Arrangement attempts to regulate the international export of dual-use cyber tools. Developers must consider the foreseeable misuse of their creations.

Incorrect·C: The legal process of identifying, preserving, collecting, and producing electronically stored information (ESI) in response to a lawsuit

e-Discovery is governed by the Federal Rules of Civil Procedure (FRCP Rule 26, 34, 37). It requires parties to litigation to identify and preserve all relevant ESI (emails, databases, log files, chat records, metadata) upon anticipating litigation. Failure to properly preserve ESI (spoliation) can result in severe sanctions including adverse inference instructions or default judgment.

Incorrect·B: The Electronic Communications Privacy Act (ECPA)

ECPA (1986) consists of three parts: Title I (Wiretap Act) — prohibits real-time interception of communications; Title II (Stored Communications Act, SCA) — governs government access to stored electronic communications; Title III (Pen Register Act) — regulates metadata collection. Critics note ECPA is significantly outdated relative to modern cloud architectures and communications platforms.

Incorrect·A: It utilizes public key infrastructure (PKI) to cryptographically verify the sender's identity and ensure the document has not been altered

A digital signature uses asymmetric cryptography: the signer hashes the document and encrypts the hash with their private key. The recipient decrypts with the signer's public key and compares hash values. Under the US ESIGN Act, eIDAS (EU), and similar laws globally, PKI-based digital signatures are legally equivalent to handwritten signatures, providing authentication, integrity, and non-repudiation.

Incorrect·A: The "guilty mind" or criminal intent necessary to prove a crime was committed deliberately rather than accidentally

Most serious criminal statutes require both the physical act (Actus Reus) and a guilty mind (Mens Rea). The CFAA requires "intentional" unauthorized access; accidental access is not criminal. Higher levels of Mens Rea (knowingly, willfully) attract more severe penalties. Defense attorneys often challenge Mens Rea in cybercrime cases involving automated tools, shared networks, or misconfigured systems.

Incorrect·D: A sanctioned initiative where organizations legally offer financial rewards to independent researchers who safely discover and report vulnerabilities

Bug bounty programs (run by companies like HackerOne and Bugcrowd, and by major organizations like Google, Apple, and the US DoD) provide a legal safe harbor combined with financial incentive for ethical hackers to report vulnerabilities responsibly. The program scope, rules of engagement, and safe harbor language are critical — activity outside defined scope is not protected.

Incorrect·C: Utilitarianism

Utilitarianism (Jeremy Bentham, John Stuart Mill) is a consequentialist moral theory: an action is right if it maximizes overall happiness or well-being. In cybersecurity ethics, it underpins debates about mass surveillance (small privacy loss for many vs. large security benefit for all) and vulnerability disclosure timing (delay disclosure to protect millions vs. immediate transparency). Contrasts with Deontology, which judges actions by rules regardless of outcome.

Incorrect·B: To require website operators to obtain verifiable parental consent before collecting personal information from children under 13

COPPA (15 U.S.C. § 6501–6506), enforced by the FTC, applies to websites and online services directed at children under 13 or knowingly collecting their data. Requirements include: posting a clear privacy policy, obtaining verifiable parental consent before data collection, providing parental rights to review/delete data, and maintaining reasonable data security. Violations carry civil penalties up to $51,744 per violation.

Incorrect·B: They require users to actively click a button or check a box indicating they agree to the terms before accessing software or a service

Clickwrap agreements require affirmative user action (clicking "I Agree" or checking a consent box), making them legally stronger than browsewrap agreements (which only require visiting a page). Courts (Specht v. Netscape, Meyer v. Uber) have consistently held clickwrap agreements enforceable when there is clear notice of the terms and an unambiguous affirmative act. They form the legal basis for EULAs, privacy policies, and ToS.

Incorrect·A: The illicit, covert infiltration of a competitor's network to steal trade secrets, client lists, or proprietary research

Corporate/industrial espionage involves deliberately stealing confidential business information through unauthorized means — hacking, insider recruitment, or social engineering — to gain a competitive advantage. It is prosecuted under the CFAA, the Economic Espionage Act (EEA) — which specifically protects trade secrets — and civil trade secret law (Defend Trade Secrets Act). Nation-state-sponsored corporate espionage is a significant geopolitical issue.

Incorrect·D: The violation of a user's reasonable expectation of privacy and breach of confidentiality

Even if technically permitted by system privileges, accessing a coworker's communications for unauthorized purposes violates the ethical principles of confidentiality and privacy, breaches the analyst's fiduciary duty to act within authorized scope, violates professional codes of ethics (ISC² Canon 2), and may constitute unlawful interception under the ECPA's Stored Communications Act (18 U.S.C. § 2701).

Incorrect·C: To establish a legally binding contract dictating how a third-party vendor is allowed to handle and protect the data controller's information

GDPR Article 28(3) mandates a written DPA for every controller-processor relationship. The DPA binds the processor to process data only on documented instructions, implement appropriate security measures, delete or return data upon termination, and flow down DPA terms to any sub-processors. It is the primary contractual mechanism for GDPR supply-chain compliance.

Incorrect·C: It is the first international treaty seeking to address internet and computer crime by harmonizing national laws and improving investigative techniques

The Council of Europe Convention on Cybercrime (Budapest Convention, 2001, ETS 185) is the first binding international treaty on cybercrime. It harmonizes criminal law on offenses like unauthorized access, data interference, and fraud; establishes procedural powers for e-evidence preservation; and creates mutual legal assistance (MLAT) obligations. As of 2026, 69+ countries are party to it. A Second Additional Protocol on cross-border evidence was adopted in 2022.

Incorrect·D: The application of existing international law and the laws of armed conflict to cyber operations between sovereign states

The Tallinn Manual (1.0 in 2013, 2.0 in 2017, 3.0 in development) is a non-binding legal study commissioned by NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE). Written by international law experts, it applies existing IHL (jus ad bellum, jus in bello), sovereignty, and state responsibility principles to cyber operations — concluding that cyber operations can constitute acts of force or armed attack under specific thresholds.

Incorrect·A: As "dual-use" goods, meaning member governments strictly control and monitor the export of advanced intrusion software and surveillance technologies

The Wassenaar Arrangement is a multilateral export control regime covering dual-use goods and technologies. In 2013, it added "intrusion software" and "IP network communications surveillance" to dual-use controls. This created significant controversy: legitimate security researchers and companies selling offensive tools (Vupen, Candiru, NSO Group) faced export licensing requirements, while critics argued the controls impeded defensive research and intelligence sharing.

Incorrect·B: It often violates domestic unauthorized access laws (like the CFAA) and risks escalating conflicts or inadvertently damaging innocent third-party infrastructure

Currently, private "hack back" (accessing an attacker's infrastructure to disable or investigate them) is illegal under the CFAA in the US, without explicit government authorization. Attacker infrastructure is typically routed through compromised innocent third parties — so retaliatory actions could constitute attacks on hospitals, ISPs, or foreign government systems. The Active Cyber Defense Certainty (ACDC) Act has been repeatedly proposed in Congress to create a limited exception but has not been enacted.

Incorrect·D: The tactic used by cybercriminals to route attacks through or host infrastructure in countries with weak cyber laws or no extradition treaties

Jurisdictional arbitrage exploits gaps in international law: cybercriminals deliberately base operations in countries with weak cybercrime statutes, no extradition treaties with victim nations, or corrupt law enforcement. This is why Russia, North Korea, and certain Eastern European countries host many cyber gangs with operational impunity. The Budapest Convention's MLAT provisions and US indictments of foreign nationals (even without arrest) are primary tools for addressing this.

Incorrect·C: It limits a copyright owner's rights after the initial sale of a copy, allowing the buyer to resell it; debated heavily regarding whether it applies to purely digital, licensed software

The First Sale Doctrine (17 U.S.C. § 109) allows purchasers of copyrighted physical copies (books, CDs) to resell, lend, or donate them without the copyright holder's permission. Courts (Kirtsaeng v. Wiley, Capitol Records v. ReDigi) have fiercely debated whether it applies to digital downloads — when you purchase software or an e-book, vendors argue you acquire a license (not a copy), and the First Sale Doctrine does not apply, preventing resale.

Incorrect·B: The regulation applies to any organization globally that processes the personal data of EU residents, regardless of where the organization is physically based

GDPR Article 3(2) establishes a market-based extra-territorial scope: the GDPR applies to any controller or processor outside the EU that processes EU residents' data in connection with offering goods/services to them, or monitoring their behavior within the EU. This has forced US technology companies, Asian manufacturers, and global corporations to comply with GDPR or face substantial fines.

Incorrect·A: Deontological Ethics (Kantianism)

Deontological ethics (Immanuel Kant's Categorical Imperative) holds that certain actions are intrinsically right or wrong based on duty and universal moral rules, irrespective of consequences. Applied to cybersecurity: surveillance without consent is wrong even if it prevents terrorism; breaking encryption is wrong even if it aids criminal investigations. Deontological reasoning underpins absolute rights frameworks like the EU Charter of Fundamental Rights.

Incorrect·A: Section 230 of the Communications Decency Act

Section 230 (47 U.S.C. § 230) is often called "the law that created the internet." It states no platform shall be treated as the publisher of user-generated content, providing sweeping immunity for hosting third-party speech. It also allows platforms to moderate content without incurring publisher liability. It is often debated: Should platforms lose immunity if they editorialize? Should AI recommendations be covered? Bipartisan reform proposals are ongoing.

Incorrect·B: The inability to explain or interpret exactly how a deep learning algorithm arrived at a specific decision, deeply complicating legal liability, transparency, and accountability

Deep neural networks can be highly accurate but completely uninterpretable. This creates profound legal challenges: if an AI denies a loan, paroles a prisoner, or misidentifies a suspect, who is liable and on what basis? GDPR Article 22 grants individuals a right to explanation for automated decisions. The EU AI Act requires high-risk AI systems to be transparent and explainable. XAI (Explainable AI) is an active research field addressing this problem.

Incorrect·C: The intentional, reckless, or negligent withholding, hiding, altering, or destroying of digital evidence relevant to ongoing or reasonably anticipated litigation

Spoliation is the wrongful destruction or alteration of evidence. Courts can impose severe sanctions: adverse inference instructions (telling juries to assume the destroyed evidence was unfavorable), striking pleadings, or default judgment. Incident responders must immediately issue litigation holds when a breach reasonably anticipates legal action. The routine deletion of logs during an investigation can constitute spoliation.

Incorrect·D: It holds an employer legally liable for the wrongful acts or negligence committed by an employee operating within the scope of their employment, such as causing a data breach

Respondeat Superior (Latin: "let the master answer") is a vicarious liability doctrine: an employer is legally responsible for tortious (negligent or wrongful) acts of an employee committed within the course and scope of employment. In cybersecurity, this means if a sysadmin negligently misconfigures a server exposing customer data, or an employee falls for a phishing attack resulting in a breach, the employer can face civil liability for the resulting harm.

Incorrect·B: An administrative subpoena used by the FBI to demand communication records and subscriber data without prior judicial approval, often containing a strict gag order

NSLs are authorized by the Electronic Communications Privacy Act (18 U.S.C. § 2709) and other statutes, and are issued by FBI field offices — with no prior judicial review or probable cause requirement. They compel disclosure of subscriber information, toll billing records, and more. Recipients are prohibited (gagged) from disclosing the receipt of an NSL. The EFF and ACLU have challenged NSLs's constitutionality; courts have struck down blanket non-disclosure provisions.

Incorrect·A: Keeping critical vulnerabilities secret to exploit adversaries places the broader civilian and commercial infrastructure at immense risk if the same flaw is discovered by malicious actors

The zero-day hoarding dilemma crystallized with EternalBlue: the NSA's hoarded exploit was stolen and released by the Shadow Brokers, enabling WannaCry and NotPetya ransomware attacks that caused billions in global damage. The US Vulnerabilities Equities Process (VEP) is supposed to govern the "patch vs. keep" decision for discovered zero-days, weighing intelligence value against civilian risk — but the process lacks transparency and independent oversight.

Incorrect·D: Individuals have no reasonable expectation of privacy for information they voluntarily turn over to third parties, like ISPs or banks, allowing the government to obtain it without a strict warrant

The Third-Party Doctrine originated in Smith v. Maryland (1979) and United States v. Miller (1976): information voluntarily disclosed to third parties loses Fourth Amendment protection. Applied to digital privacy, this has meant the government historically could obtain email (stored >180 days), IP logs, and cloud data with only a subpoena. Carpenter v. United States (2018) created a significant exception for historical cell-site location information, requiring a warrant.

Incorrect·C: The scientific techniques and methodology used to extract the evidence must be peer-reviewed, tested, have a known error rate, and be generally accepted by the scientific community (Daubert Standard)

The Daubert Standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) replaced the older Frye Standard for expert testimony in US federal courts. Under Daubert, the judge acts as a "gatekeeper" evaluating whether the methodology is: (1) empirically testable, (2) peer-reviewed, (3) has a known/potential error rate, (4) subject to standards and controls, and (5) generally accepted in the relevant scientific community. Forensic tools like FTK, EnCase, and Volatility must satisfy these criteria when challenged.

Incorrect·C: The threshold is legally ambiguous, but it generally requires a cyberattack that produces physical destruction or casualties comparable to conventional, kinetic armed attacks

The Tallinn Manual's Rule 30 holds that a cyber operation causing effects equivalent to those of a conventional armed attack — physical damage, injury, or death — may constitute a use of force under UN Charter Article 2(4). Below that threshold, states are left with economic sanctions, diplomatic expulsion, and countermeasures. Notable unresolved questions: Does destroying financial infrastructure constitute an armed attack? Does persistent election interference?

Incorrect·D: It grants data subjects the right to ask for a human explanation of an algorithmic decision that significantly affects them (like loan approval) and to challenge that decision

GDPR Article 22 restricts solely automated decisions that produce "significant" legal or similarly significant effects on individuals (loan approval, insurance pricing, hiring). Data subjects have the right to: (1) human review of the decision, (2) express their point of view, and (3) contest the decision. Recital 71 adds that data subjects should receive "meaningful information" about the logic, significance, and consequences of the profiling.

Incorrect·A: They advocate for consumers' ability to legally bypass OEM software locks to repair their own hardware, a practice which manufacturers argue introduces critical security and safety vulnerabilities

Right to Repair legislation (passed in several US states and the EU's Ecodesign Regulation) asserts consumers and independent repair shops should have access to the same parts, tools, and diagnostic software as OEM-authorized repair centers. Manufacturers (Apple, John Deere) invoke DMCA Section 1201 to prevent bypassing software locks in their products. Security researchers warn that enabling repair access could also enable malicious firmware modifications — a genuine safety vs. autonomy tension.

Incorrect·B: Damage to computer systems, including unauthorized access, downloading data without consent, and introducing computer viruses or contaminants

Section 43 of India's IT Act 2000 ("Penalty and Compensation for Damage to Computer, Computer System, etc.") establishes civil liability for unauthorized access, unauthorized downloading of data, computer viruses, damage, disruption, denial of service, and misappropriation of data. Section 66 (added by IT Amendment Act 2008) adds criminal penalties. Section 43A grounds liability for corporates who fail to maintain reasonable security practices protecting sensitive personal data — India's equivalent of a breach liability statute.