Cybersecurity Law Certification (CSL) — Questions and Answers

Question 1: What is the primary legal risk of releasing a cybersecurity tool (e.g., exploit code) that has both offensive and defensive uses?

Export control violations under the EAR
Liability under DMCA Section 1201 for circumvention tools
All of the above (Correct answer)
Copyright infringement of the vulnerability it targets

Correct answer: All of the above

Dual-use cybersecurity tools may implicate DMCA anti-circumvention provisions, export controls under the EAR for intrusion software, and potential CFAA liability.

Question 2: Which of the following is a right granted to individuals under the GDPR?

Right to be forgotten, and the right to access and correct data (Correct answer)
Right to increase data storage duration
Right to sell their personal data
Right to share their data with third parties

Correct answer: Right to be forgotten, and the right to access and correct data

The GDPR grants several fundamental rights to individuals regarding their personal data. Key among these are the "right to be forgotten," allowing individuals to request deletion of their data, and the right to access and rectify inaccurate personal information. These rights empower individuals with greater control and transparency over how their data is handled by organizations.

Question 3: Under GDPR, what is the maximum fine for the most serious violations of data protection obligations?

€20 million or 4% of global annual turnover (Correct answer)
€10 million or 2% of global annual turnover
Unlimited fines at member state discretion
€50 million or 10% of global annual turnover

Correct answer: €20 million or 4% of global annual turnover

GDPR Article 83(5) provides for fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious violations.

Question 4: What is the purpose of a 'penetration testing clause' in a vendor contract?

To allow the vendor to test the client's internal systems without prior notice
To prohibit any security testing of vendor-managed systems
To require the vendor to test the client's employees for security awareness
To grant the client the right to conduct or commission security testing of the vendor's systems (Correct answer)

Correct answer: To grant the client the right to conduct or commission security testing of the vendor's systems

A penetration testing clause grants the client contractual rights to conduct or commission security testing of vendor-managed systems to verify the vendor's security controls are effective.

Question 5: Which legal doctrine allows class action plaintiffs to establish standing in data breach cases even without proven financial harm?

Actual injury requirement
Nominal damages doctrine
Increased risk of future harm as injury-in-fact (Correct answer)
Statutory damages under FCRA

Correct answer: Increased risk of future harm as injury-in-fact

Courts have increasingly recognized that the increased risk of future identity theft or fraud from a data breach constitutes an injury-in-fact sufficient for Article III standing.

Question 6: Which Executive Order significantly strengthened U.S. federal cybersecurity requirements following the SolarWinds attack, mandating zero trust architecture and software supply chain security?

Executive Order 14110 (2023)
Executive Order 13636 (2013)
Executive Order 14028 (2021) (Correct answer)
Executive Order 13800 (2017)

Correct answer: Executive Order 14028 (2021)

EO 14028, 'Improving the Nation's Cybersecurity,' issued in May 2021, mandated zero trust architecture, enhanced logging, software bill of materials (SBOMs), and incident response improvements.

Question 7: Under the Electronic Communications Privacy Act (ECPA), a real-time wiretap of an electronic communication requires which legal standard?

A simple administrative subpoena
A national security letter signed by an FBI director
A subpoena issued by any federal attorney
A court order based on probable cause (Title III order) (Correct answer)

Correct answer: A court order based on probable cause (Title III order)

Real-time interception of electronic communications under ECPA Title III requires a court order supported by probable cause, known as a 'super warrant.'

Question 8: Which provision of the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect the security and confidentiality of customer information?

Fair Credit Reporting Act
Safeguards Rule (Correct answer)
Pretexting Protection
Financial Privacy Rule

Correct answer: Safeguards Rule

The GLBA Safeguards Rule requires financial institutions to implement a comprehensive information security program to protect customer data.

Question 9: What is the significance of the 'cyber equivalent of an armed attack' threshold under the UN Charter Article 51?

All cyberattacks trigger Article 51 self-defense rights
Only cyberattacks causing effects comparable to armed attacks may trigger self-defense rights (Correct answer)
Article 51 does not apply to cyber operations
The threshold is defined by the Budapest Convention

Correct answer: Only cyberattacks causing effects comparable to armed attacks may trigger self-defense rights

Most legal scholars agree that a cyber operation must produce effects comparable to a traditional armed attack (death, injury, or significant destruction) to trigger the right of self-defense under Article 51.

Question 10: Which incident response phase involves identifying the root cause and attack vector of a security breach?

Analysis/Identification (Correct answer)
Eradication
Recovery
Containment

Correct answer: Analysis/Identification

The Analysis/Identification phase focuses on determining what happened, how it happened, and confirming the scope of the incident.

Question 11: Under what authority does the President have the power to impose sanctions on foreign individuals and entities engaged in significant malicious cyber activities?

International Emergency Economic Powers Act (IEEPA) and Executive Order 13694 (Correct answer)
Computer Fraud and Abuse Act
Classified Information Procedures Act
National Cybersecurity Protection Act

Correct answer: International Emergency Economic Powers Act (IEEPA) and Executive Order 13694

EO 13694 (amended by EO 13757) uses IEEPA authority to allow Treasury/OFAC to designate and sanction those responsible for significant malicious cyber-enabled activities.

Question 12: What export control regulation specifically covers the export of cybersecurity tools, including intrusion and surveillance software?

Office of Foreign Assets Control (OFAC) rules
Export Administration Regulations (EAR) (Correct answer)
International Traffic in Arms Regulations (ITAR)
Wassenaar Arrangement directly

Correct answer: Export Administration Regulations (EAR)

The EAR, administered by the Bureau of Industry and Security, implements Wassenaar Arrangement controls on dual-use items including cybersecurity tools.

Question 13: Under the FTC Act Section 5, the FTC can take enforcement action against companies for privacy violations primarily on what legal theory?

Unfair or deceptive acts or practices in or affecting commerce (Correct answer)
Failure to pay federal privacy registration fees
Non-compliance with state breach notification laws
Violations of specific federal data protection statutes

Correct answer: Unfair or deceptive acts or practices in or affecting commerce

The FTC uses its Section 5 authority to pursue companies whose privacy practices constitute unfair or deceptive acts or practices harming consumers.

Question 14: What is the primary legal challenge in attributing state responsibility for cyberattacks under international law?

Cyberattacks never reach the threshold for state responsibility
International law does not recognize cyber operations as state acts
The requirement to prove that the state 'directed or controlled' the specific operation (Correct answer)
MLAT treaties prevent attribution claims

Correct answer: The requirement to prove that the state 'directed or controlled' the specific operation

Under the ILC Articles on State Responsibility, holding a state responsible requires showing the state directed or controlled the private actors conducting the cyber operation (Article 8).

Question 15: What is the legal standard for obtaining a warrant to search digital devices under the Fourth Amendment?

Probable cause (Correct answer)
Reasonable suspicion
Clear and convincing evidence
Preponderance of evidence

Correct answer: Probable cause

A search warrant requires probable cause, meaning a reasonable belief based on articulable facts that evidence of a crime will be found.

Question 16: An incident responder collects volatile memory from a compromised system. Why must this be collected before disk imaging?

Volatile memory contains stronger legal evidence than disk data
Disk imaging corrupts volatile memory contents
RAM data is lost when the system is powered off (Correct answer)
Memory analysis is required by all breach notification laws

Correct answer: RAM data is lost when the system is powered off

RAM is volatile and lost upon shutdown, so it must be captured first to preserve running processes, encryption keys, and in-memory malware artifacts.

Question 17: What is a security breach in the context of incident response?

When a user forgets their login credentials
When the system is down for maintenance
When an employee shares their password
When unauthorized access leads to data or system compromise (Correct answer)

Correct answer: When unauthorized access leads to data or system compromise

A security breach occurs when an unauthorized individual or entity gains access to a computer system, network, or data. This unauthorized access can lead to the compromise, theft, or exposure of sensitive information, or disruption of system operations. It represents a failure in security controls and often triggers an incident response process.

Question 18: Which international treaty, opened for signature in 2001, is the primary multilateral agreement on cybercrime harmonization?

Tallinn Manual Framework
G20 Digital Economy Agreement
Budapest Convention on Cybercrime (Correct answer)
UN Convention on Cybercrime

Correct answer: Budapest Convention on Cybercrime

The Council of Europe's Budapest Convention is the first international treaty on cybercrime, establishing common criminal offenses and procedural tools across signatory nations.

Question 19: Which of the following tools is commonly used in ethical hacking?

Google Chrome
Microsoft Word
Adobe Photoshop
Wireshark (Correct answer)

Correct answer: Wireshark

Wireshark is a widely used and powerful network protocol analyzer that allows ethical hackers and security professionals to capture and interactively browse data flowing on a computer network. It is essential for analyzing network traffic, troubleshooting network problems, and identifying potential security vulnerabilities or malicious activity. The other options are general software not primarily used for ethical hacking.

Question 20: Under the EU's GDPR, what obligation does the 'one-stop-shop' mechanism create for multinationals operating across EU member states?

They must comply with every member state's data protection authority separately
They can choose any member state's DPA as their sole supervisor
The ECJ serves as the single supervisory authority
They deal primarily with the DPA of their EU main establishment (Correct answer)

Correct answer: They deal primarily with the DPA of their EU main establishment

The one-stop-shop mechanism designates the DPA of the controller's main establishment as the lead supervisory authority for cross-border processing activities.

Question 21: Which term describes the legal requirement that an incident response team must preserve all relevant evidence when litigation is reasonably anticipated?

Evidence locker protocol
Regulatory preservation order
Litigation hold (legal hold) (Correct answer)
Subpoena compliance notice

Correct answer: Litigation hold (legal hold)

A litigation hold is a legal obligation to suspend normal deletion policies and preserve all potentially relevant electronically stored information (ESI) once litigation is foreseeable.

Question 22: A U.S. company's GDPR-compliant data processing agreement with a European vendor is voided by a change in EU law. Which legal principle describes this risk?

Regulatory risk / change in law risk (Correct answer)
Breach of contract
Force majeure
Frustration of purpose

Correct answer: Regulatory risk / change in law risk

Regulatory risk refers to the possibility that changes in applicable laws or regulations will render existing contractual arrangements non-compliant or void.

Question 23: Under the National Security Act and related authorities, which body coordinates national-level intelligence on cyber threats and integrates cybersecurity with national security?

NSC Cybersecurity Directorate and ONCD (Correct answer)
CISA alone
FBI Cyber Division only
NIST Cybersecurity Center

Correct answer: NSC Cybersecurity Directorate and ONCD

The National Security Council's Cyber Directorate and the Office of the National Cyber Director (ONCD), created in 2021, coordinate national cybersecurity strategy and policy.

Question 24: What is the legal term for the obligation of companies to have a documented process for identifying, assessing, and managing cybersecurity risks?

Cybersecurity governance
Duty of care
Reasonable security obligation (Correct answer)
Due diligence

Correct answer: Reasonable security obligation

The reasonable security obligation requires organizations to implement security measures appropriate to the sensitivity of data and potential harm from a breach.

Question 25: What is a Service Level Agreement (SLA) in the context of cybersecurity vendor contracts?

An insurance policy covering data breaches
A certification standard for cybersecurity professionals
A government regulation mandating minimum security standards
A contractual commitment defining measurable performance metrics including uptime and incident response times (Correct answer)

Correct answer: A contractual commitment defining measurable performance metrics including uptime and incident response times

An SLA is a contractual agreement that defines measurable service standards, including security-related metrics like uptime, incident response times, and breach notification windows.

Question 26: Under the Stored Communications Act, what category of provider may not disclose the contents of stored communications to non-government entities without subscriber consent?

Electronic communication services
Neither A nor B
Both A and B (Correct answer)
Remote computing services

Correct answer: Both A and B

Both electronic communication services and remote computing services are prohibited under the SCA from disclosing stored communication contents without authorization.

Question 27: Which international treaty requires member nations to provide legal protections for technological protection measures similar to the DMCA?

WIPO Copyright Treaty (WCT) (Correct answer)
Berne Convention
Budapest Convention
TRIPS Agreement

Correct answer: WIPO Copyright Treaty (WCT)

The WIPO Copyright Treaty of 1996 requires signatories to provide adequate legal protection against circumvention of technological protection measures.

Question 28: What is the primary purpose of cybersecurity regulations?

To protect sensitive information and ensure network security (Correct answer)
To increase network speed
To allow unrestricted access to all data
To decrease the cost of information technology

Correct answer: To protect sensitive information and ensure network security

Cybersecurity regulations are established legal frameworks designed to mandate specific security practices and controls for organizations. Their primary purpose is to safeguard sensitive data from unauthorized access, breaches, and cyber threats. This ensures the confidentiality, integrity, and availability of information, thereby enhancing the overall security of networks and systems.

Question 29: A red team engagement differs from a standard penetration test primarily in that it:

Requires no scoping document or rules of engagement
Simulates a full adversarial attack to test detection and response capabilities (Correct answer)
Tests only external network perimeter defenses
Focuses exclusively on web application vulnerabilities

Correct answer: Simulates a full adversarial attack to test detection and response capabilities

Red team engagements simulate real-world threat actors across all attack vectors to evaluate an organization's ability to detect and respond, not just identify vulnerabilities.

Question 30: Which ISO standard provides a framework for establishing, implementing, and continually improving an Information Security Management System (ISMS)?

ISO 22301
ISO 9001
ISO 31000
ISO 27001 (Correct answer)

Correct answer: ISO 27001

ISO/IEC 27001 is the international standard specifying requirements for an ISMS to systematically manage information security risks.

Question 31: Which of the following is considered a cybercrime?

Downloading music legally from a website
Posting on social media
Sending spam emails to friends
Hacking into a government network to steal confidential data (Correct answer)

Correct answer: Hacking into a government network to steal confidential data

Hacking into a government network without authorization, especially with the intent to steal confidential data, is a clear example of a cybercrime. This act involves unauthorized access and data theft, which are explicitly prohibited by cybercrime laws due to the severe potential consequences for national security and privacy. The other options describe legal or benign online activities.

Question 32: A company discovers a competitor has reverse-engineered its proprietary encryption library through clean-room reverse engineering. Is this lawful?

No, it always constitutes copyright infringement
No, it violates the DTSA regardless of method
Yes, reverse engineering for interoperability is generally lawful (Correct answer)
Yes, but only if the competitor had a license

Correct answer: Yes, reverse engineering for interoperability is generally lawful

Clean-room reverse engineering for interoperability has been upheld as lawful under copyright fair use principles, particularly for achieving compatibility.

Question 33: Which rule of the Federal Rules of Civil Procedure specifically addresses electronically stored information (ESI) in discovery?

Rule 34
Rule 37
Rule 45
Rule 26 (Correct answer)

Correct answer: Rule 26

Rule 26(b) governs the scope of discovery and includes specific provisions for ESI, including proportionality and preservation obligations.

Question 34: In vendor contracts, what does a 'limitation of liability' clause typically cap?

The duration of the contractual relationship
The scope of the vendor's cybersecurity obligations
The number of security incidents a vendor must report
The maximum monetary damages a vendor will pay in the event of a breach (Correct answer)

Correct answer: The maximum monetary damages a vendor will pay in the event of a breach

Limitation of liability clauses cap the maximum amount a vendor is financially responsible for, typically tied to fees paid under the contract, limiting exposure in breach scenarios.

Question 35: Under GDPR, a 'data processor' is best defined as which of the following?

An entity that determines the purposes and means of processing personal data
A supervisory authority that oversees GDPR compliance
An individual whose personal data is being processed
A natural or legal person that processes personal data on behalf of a controller (Correct answer)

Correct answer: A natural or legal person that processes personal data on behalf of a controller

A data processor under GDPR Article 4(8) processes personal data on behalf of and under the instructions of a data controller.

Question 36: Under FTC Act Section 5, what cybersecurity standard are companies held to when they fail to protect consumer data?

Strict liability for all data breaches
Unfair or deceptive trade practices standard (Correct answer)
Negligence per se based on NIST standards
Reasonable care under common law

Correct answer: Unfair or deceptive trade practices standard

The FTC uses Section 5's prohibition on unfair or deceptive acts to enforce cybersecurity, finding violations when companies fail to maintain reasonable security promised to consumers.

Question 37: Under GDPR Article 17, the 'right to erasure' (right to be forgotten) is NOT absolute and does not apply when data processing is necessary for:

The exercise of freedom of expression and information (Correct answer)
Marketing purposes
Performance of a contract with the data subject
Archiving purposes in the public interest

Correct answer: The exercise of freedom of expression and information

GDPR Article 17(3) lists exceptions to erasure, including when processing is necessary for exercising freedom of expression, compliance with legal obligations, public interest archiving, or scientific research.

Question 38: How can businesses ensure compliance with cybersecurity regulations?

By only implementing physical security measures
By implementing required safeguards and staying informed about regulations (Correct answer)
By allowing unrestricted access to sensitive data
By reducing cybersecurity budgets

Correct answer: By implementing required safeguards and staying informed about regulations

Businesses ensure compliance with cybersecurity regulations by proactively implementing required technical, administrative, and physical safeguards to protect data. Additionally, staying informed about evolving regulations and continuously updating security practices is essential to adapt to new threats and legal mandates. This dual approach helps maintain a strong and compliant security posture.

Question 39: Under 18 U.S.C. § 1030(c), what threshold of loss within a one-year period elevates a CFAA violation to a felony offense?

$10,000
$5,000 (Correct answer)
$500
$1,000

Correct answer: $5,000

A CFAA violation becomes a felony when it causes loss aggregating at least $5,000 in value within any one-year period to one or more persons.

Question 40: Which doctrine limits the scope of software copyright protection to the literal code and not the underlying ideas or functionality?

Both A and C
Merger doctrine
Scènes à faire doctrine
Idea-expression dichotomy (Correct answer)

Correct answer: Idea-expression dichotomy

The idea-expression dichotomy under 17 U.S.C. § 102(b) ensures copyright protects only the specific expression of ideas in code, not the underlying algorithms or methods.

Question 41: What is the legal authority that permits NSA to conduct bulk collection of certain internet communications under Section 702 of the Foreign Intelligence Surveillance Act?

Executive Order 12333
Patriot Act Section 215
National Security Act Section 501
FISA Section 702 (PRISM and UPSTREAM programs) (Correct answer)

Correct answer: FISA Section 702 (PRISM and UPSTREAM programs)

FISA Section 702 authorizes collection of foreign intelligence from non-U.S. persons reasonably believed to be outside the U.S., including through PRISM (provider-provided) and UPSTREAM (backbone) collection.

Question 42: What does the Cybersecurity Maturity Model Certification (CMMC) assess?

The operational efficiency of contractors
The financial stability of contractors
The physical location of contractors
The cybersecurity practices of contractors (Correct answer)

Correct answer: The cybersecurity practices of contractors

The Cybersecurity Maturity Model Certification (CMMC) is a unified standard for implementing cybersecurity across the defense industrial base. It assesses and certifies the cybersecurity practices and maturity levels of contractors working with the Department of Defense (DoD). This ensures that sensitive unclassified information is adequately protected throughout the supply chain.

Question 43: Under the Gramm-Leach-Bliley Act (GLBA), which rule specifically mandates that financial institutions implement a written information security program?

Safeguards Rule (Correct answer)
Pretexting Rule
Privacy Rule
Disposal Rule

Correct answer: Safeguards Rule

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive written information security program.

Question 44: What is a security assessment questionnaire (SAQ) used for in vendor management?

To contractually transfer cybersecurity risk to the vendor
To satisfy government audit requirements on behalf of the client
To train vendor employees on cybersecurity awareness
To evaluate a vendor's security posture before and during a contractual relationship (Correct answer)

Correct answer: To evaluate a vendor's security posture before and during a contractual relationship

An SAQ is used to gather information about a vendor's security controls, policies, and practices to assess risk and ensure alignment with contractual security requirements prior to and throughout the relationship.

Question 45: Which federal statute primarily protects software code as intellectual property in the United States?

Patent Act (35 U.S.C.)
Copyright Act (17 U.S.C.) (Correct answer)
Trademark Act (Lanham Act)
Trade Secrets Act (18 U.S.C. § 1836)

Correct answer: Copyright Act (17 U.S.C.)

The Copyright Act protects software as a literary work, giving authors exclusive rights to reproduction, distribution, and creation of derivative works.

Question 46: Which provision of the USA FREEDOM Act (2015) ended the NSA's bulk collection of domestic phone metadata and replaced it with a targeted query system requiring court approval?

Section 215 amendment limiting bulk collection (Correct answer)
Section 702 reauthorization
Executive Order 12333 revision
FISA Amendment Act Section 1881a

Correct answer: Section 215 amendment limiting bulk collection

The USA FREEDOM Act amended Section 215 of the PATRIOT Act to end bulk phone metadata collection and required the NSA to seek court-approved targeted queries from telephone companies instead.

Question 47: Which hashing algorithm is most commonly used to verify the integrity of forensic disk images in legal proceedings?

SHA-1
SHA-256 (Correct answer)
CRC-32
MD5

Correct answer: SHA-256

SHA-256 is now the preferred standard for forensic integrity verification because MD5 and SHA-1 have known collision vulnerabilities.

Question 48: What does the GDPR mandate regarding consent?

Consent must be explicit, informed, and freely given (Correct answer)
Consent must be assumed unless stated otherwise
No consent is necessary for personal data processing
Consent can be obtained through verbal agreements only

Correct answer: Consent must be explicit, informed, and freely given

Under the GDPR, consent for processing personal data must be explicit, informed, and freely given. This means individuals must clearly and unambiguously agree to specific data processing activities after being fully informed about what data is collected and for what purpose. Organizations cannot rely on implied consent or pre-ticked boxes, ensuring individuals have genuine control over their data.

Question 49: The Cybersecurity Information Sharing Act (CISA 2015) grants companies legal protection when sharing cyber threat indicators with the government. To qualify for this protection, shared information must be:

Shared within 72 hours of discovery
Scrubbed of personally identifiable information not directly related to the cybersecurity threat (Correct answer)
Classified at the SECRET level
Pre-approved by the Department of Homeland Security

Correct answer: Scrubbed of personally identifiable information not directly related to the cybersecurity threat

CISA 2015 protections apply only when companies scrub PII unrelated to the cybersecurity threat before sharing indicators with federal agencies.

Question 50: Which section of the Digital Millennium Copyright Act (DMCA) prohibits circumventing technological protection measures (TPMs)?

Section 1201 (Correct answer)
Section 512
Section 301
Section 107

Correct answer: Section 1201

DMCA Section 1201 prohibits circumventing technological protection measures that control access to copyrighted works, with limited exceptions.

Question 51: The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards are mandatory for electric utilities. Which federal agency enforces these standards?

EPA
DOE
FERC (Correct answer)
CISA

Correct answer: FERC

The Federal Energy Regulatory Commission (FERC) has authority under the Energy Policy Act of 2005 to approve and enforce NERC CIP reliability standards for the bulk power system.

Question 52: What is the primary legal framework governing cybersecurity requirements for the U.S. financial sector, coordinated by the Financial Stability Oversight Council (FSOC)?

Basel III cybersecurity accord implementation
A single unified federal cybersecurity statute for financial firms
Multiple overlapping regimes: GLBA, FFIEC guidelines, SEC rules, CFTC rules, and state laws (Correct answer)
Dodd-Frank Act Section 165 cybersecurity requirements exclusively

Correct answer: Multiple overlapping regimes: GLBA, FFIEC guidelines, SEC rules, CFTC rules, and state laws

U.S. financial sector cybersecurity is governed by a fragmented regime including GLBA Safeguards Rule, FFIEC examination guidance, SEC/CFTC rules, OCC guidelines, and state laws like NY DFS 23 NYCRR 500.

Question 53: What legal standard describes a vendor's obligation to implement reasonable security measures to protect client data under a contract?

Subrogation
Due diligence / duty of care (Correct answer)
Sovereign immunity
Safe harbor

Correct answer: Due diligence / duty of care

Due diligence and duty of care are legal standards requiring vendors to implement reasonable, appropriate security measures to protect client data they access or process.

Question 54: Under the Electronic Communications Privacy Act (ECPA), what is required before law enforcement can access stored electronic communications older than 180 days?

Subpoena only
Court order under 18 U.S.C. § 2703(d)
Written consent of the provider
Search warrant (Correct answer)

Correct answer: Search warrant

Following the Sixth Circuit's Warshak decision and DOJ policy, a search warrant based on probable cause is required to access stored email content regardless of age.

Question 55: What is the legal term for the obligation to preserve evidence once litigation is reasonably anticipated?

Preservation order
Evidence freeze
Discovery hold
Litigation hold (Correct answer)

Correct answer: Litigation hold

A litigation hold is a legal obligation requiring organizations to preserve all potentially relevant evidence once litigation is reasonably anticipated.

Question 56: Under the Digital Millennium Copyright Act (DMCA) § 1201, which activity is prohibited even when no copyright infringement actually occurs?

Reverse engineering software for interoperability
Circumventing technological protection measures (TPMs) on copyrighted works (Correct answer)
Caching web pages for personal use
Sharing links to publicly available content

Correct answer: Circumventing technological protection measures (TPMs) on copyrighted works

DMCA § 1201 prohibits circumventing access controls (TPMs) on copyrighted works regardless of whether the underlying use would constitute infringement.

Question 57: Which federal agency maintains the National Software Reference Library (NSRL) used to filter known files during digital forensic investigations?

FBI
CISA
NIST (Correct answer)
NSA

Correct answer: NIST

NIST maintains the National Software Reference Library, which provides hash sets of known files to help examiners exclude legitimate software during forensic analysis.

Question 58: Which NIST Special Publication provides guidelines for security categorization of federal information and information systems?

NIST SP 800-37
NIST SP 800-53
NIST SP 800-60 (Correct answer)
NIST SP 800-137

Correct answer: NIST SP 800-60

NIST SP 800-60 provides guidance for mapping information and information system types to security categories (Low, Moderate, High) as required by FIPS 199.

Question 59: What is the key to effective incident response?

Reactive actions without planning
Ignoring the incident until it escalates
A proactive and well-organized response (Correct answer)
Providing public statements before analysis

Correct answer: A proactive and well-organized response

Effective incident response relies on proactive planning, including having a clear strategy, defined roles, and established procedures before an incident occurs. A well-organized response ensures that the team can act swiftly, coordinate efforts, and follow a structured approach to contain, eradicate, and recover from the incident, minimizing its impact. Reactive, unplanned actions often lead to greater damage and longer recovery times.

Question 60: What legal mechanism allows a company to terminate a vendor contract if a material cybersecurity breach occurs?

Arbitration clause
Termination for cause clause (Correct answer)
Limitation of liability clause
Automatic renewal clause

Correct answer: Termination for cause clause

A termination for cause clause gives the contracting party the right to immediately terminate the agreement if the vendor commits a material breach, such as a significant security failure.

Question 61: What is the primary purpose of a non-disclosure agreement (NDA) in the context of trade secret protection?

To create a patent priority date
To establish that reasonable measures were taken to protect the secret (Correct answer)
To create copyright protection for shared information
To comply with DTSA registration requirements

Correct answer: To establish that reasonable measures were taken to protect the secret

NDAs demonstrate that the trade secret owner took reasonable measures to maintain secrecy, which is a required element for trade secret protection under both state and federal law.

Question 62: Under the Economic Espionage Act (EEA), what makes trade secret theft a federal crime distinct from civil trade secret misappropriation?

The value of the trade secret must exceed $5 million
Prosecution requires DOJ authorization
The theft must involve computer access
The theft must benefit a foreign government or instrumentality (Correct answer)

Correct answer: The theft must benefit a foreign government or instrumentality

The EEA specifically criminalizes trade secret theft that benefits a foreign government, instrumentality, or agent, distinguishing it from general commercial theft under 18 U.S.C. § 1832.

Question 63: Under GDPR, which legal basis allows an organization to process personal data without explicit consent when processing is necessary for the performance of a contract?

Vital Interests
Contractual Necessity (Correct answer)
Legal Obligation
Legitimate Interests

Correct answer: Contractual Necessity

GDPR Article 6(1)(b) permits processing without consent when it is necessary for performing a contract to which the data subject is a party.

Question 64: Under the Federal Trade Commission Act, what does the FTC consider 'reasonable security' for companies handling consumer data?

ISO 27001 certification
Security measures appropriate to the company's size, complexity, and the sensitivity of the data (Correct answer)
Implementation of all NIST SP 800-53 controls
SOC 2 Type II audit completion

Correct answer: Security measures appropriate to the company's size, complexity, and the sensitivity of the data

The FTC applies a flexible reasonableness standard that considers the company's resources, the nature of its data, and the cost and availability of security tools.

Question 65: What is the Digital Millennium Copyright Act (DMCA)?

A law that promotes public access to government data
A law that restricts all digital content creation
A law that governs internet speed regulations
A law that protects copyright holders and addresses online piracy (Correct answer)

Correct answer: A law that protects copyright holders and addresses online piracy

The Digital Millennium Copyright Act (DMCA) was enacted to update U.S. copyright law for the digital age. It provides legal protections for copyright owners against infringement on the internet and establishes a "notice and takedown" system for online service providers to remove infringing content. This helps to combat online piracy while offering safe harbors for internet companies.

Question 66: What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect that is not corrected?

$10,000
$100,000
$1.9 million (Correct answer)
$50,000

Correct answer: $1.9 million

HIPAA's tiered penalty structure imposes up to $1.9 million per violation category per calendar year for willful neglect that is not corrected.

Question 67: What is the main goal of ethical hacking?

To exploit security flaws for personal gain
To help organizations identify and fix vulnerabilities (Correct answer)
To bypass security systems for testing
To cause damage to the organization's infrastructure

Correct answer: To help organizations identify and fix vulnerabilities

Ethical hacking, also known as penetration testing, is a proactive security measure where authorized individuals simulate cyberattacks. The main goal is to discover security weaknesses and vulnerabilities in systems, networks, or applications before malicious actors can exploit them. This allows organizations to strengthen their defenses and improve their overall security posture.

Question 68: The Cybersecurity Information Sharing Act (CISA) of 2015 provides liability protection for companies that share cyber threat indicators with the government if they:

Share all data without any scrubbing
Only share with cleared defense contractors
Obtain DOJ approval for each share
Scrub personally identifiable information before sharing (Correct answer)

Correct answer: Scrub personally identifiable information before sharing

CISA 2015 grants liability protection for sharing cyber threat indicators only if companies scrub PII unrelated to the cybersecurity threat before sharing through designated portals.

Question 69: What is the primary legal challenge with using metadata as evidence in cybercrime cases?

Metadata is hearsay and always inadmissible
Metadata cannot be authenticated
Metadata can be altered without detection
Metadata requires expert testimony under Daubert (Correct answer)

Correct answer: Metadata requires expert testimony under Daubert

Because metadata analysis requires specialized knowledge, expert testimony is typically required, and courts apply the Daubert standard to assess its reliability.

Question 70: During incident response, chain of custody documentation is critical primarily because:

It reduces the organization's liability for the breach
It speeds up the remediation process
It satisfies mandatory regulatory reporting requirements
It ensures evidence is admissible in legal proceedings (Correct answer)

Correct answer: It ensures evidence is admissible in legal proceedings

Maintaining documented chain of custody ensures digital evidence integrity and admissibility if the incident leads to criminal prosecution or civil litigation.

Question 71: China's Cybersecurity Law (CSL) of 2017 requires operators of 'critical information infrastructure' to store data locally within China. This type of requirement is known as:

Cross-border transfer prohibition
Data sovereignty mandate
Cybersecurity certification standard
Data localization requirement (Correct answer)

Correct answer: Data localization requirement

Data localization requirements mandate that certain categories of data be stored and processed within national borders, affecting multinational companies' cloud strategies.

Question 72: The HIPAA Breach Notification Rule requires covered entities to notify affected individuals of a breach affecting unsecured PHI within what timeframe?

45 days of discovery
72 hours of discovery
60 days of discovery (Correct answer)
30 days of discovery

Correct answer: 60 days of discovery

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days following discovery of a breach.

Question 73: When conducting a forensic examination of a suspect's smartphone, which constitutional amendment primarily protects against warrantless searches?

Fourth Amendment (Correct answer)
Fifth Amendment
Sixth Amendment
First Amendment

Correct answer: Fourth Amendment

The Fourth Amendment protects against unreasonable searches and seizures, and the Supreme Court in Riley v. California held that police must get a warrant to search a cell phone.

Question 74: A penetration tester discovers a critical vulnerability in software and reverse engineers the code to understand it. Under the DMCA, this activity is most protected by:

Section 1201(f) interoperability exception
Fair use under Section 107
Section 1201(g) encryption research exception
Section 1201(j) security research exception (Correct answer)

Correct answer: Section 1201(j) security research exception

Section 1201(j) specifically covers security testing when the researcher owns the system or has authorization, making it the most applicable DMCA exception.

Question 75: Under the Stored Communications Act (SCA), which entity can lawfully compel an email provider to disclose stored emails?

The employer if they own the email domain
Only the account owner or their attorney
Law enforcement with appropriate legal process such as a warrant or court order (Correct answer)
Any certified cybersecurity professional with cause

Correct answer: Law enforcement with appropriate legal process such as a warrant or court order

The SCA requires law enforcement to obtain a warrant, court order, or subpoena depending on the age and type of stored communications before a provider must disclose them.

Question 76: Mutual Legal Assistance Treaties (MLATs) are primarily used in cybercrime investigations to:

Coordinate sanctions against state-sponsored hackers
Obtain evidence located in foreign jurisdictions through formal legal channels (Correct answer)
Share threat intelligence between governments
Extradite cybercriminals between countries

Correct answer: Obtain evidence located in foreign jurisdictions through formal legal channels

MLATs provide a formal mechanism for law enforcement to request assistance from foreign governments in gathering evidence, such as subscriber records or server logs, located abroad.

Question 77: How does cyber insurance typically interact with vendor contract requirements?

Cyber insurance is only required for federal government contractors
Cyber insurance replaces the need for security provisions in vendor contracts
Vendor contracts often require vendors to carry specified cyber insurance coverage and name clients as additional insureds (Correct answer)
Cyber insurance is a government program covering breach costs for all companies

Correct answer: Vendor contracts often require vendors to carry specified cyber insurance coverage and name clients as additional insureds

Vendor contracts commonly require vendors to maintain specified cyber insurance coverage levels and may require that clients be named as additional insureds, ensuring coverage extends to client losses caused by vendor incidents.

Question 78: A GDPR Data Protection Impact Assessment (DPIA) is mandatory when processing is likely to result in what?

Any use of cloud storage services
A high risk to the rights and freedoms of natural persons (Correct answer)
Cross-border data transfers to any third country
Collection of more than 500 records

Correct answer: A high risk to the rights and freedoms of natural persons

GDPR Article 35 requires a DPIA when processing is likely to result in a high risk to individuals' rights and freedoms, such as large-scale profiling.

Question 79: What is the primary objective of cybercrime laws?

To promote open access to all internet resources
To monitor all internet activities
To regulate the flow of data within countries
To protect individuals and organizations from illegal activities conducted through digital means (Correct answer)

Correct answer: To protect individuals and organizations from illegal activities conducted through digital means

Cybercrime laws are enacted to establish legal frameworks that define and prohibit various criminal activities carried out using computers, networks, and the internet. Their primary objective is to deter, investigate, and prosecute cybercriminals, thereby safeguarding digital assets, personal data, and critical infrastructure from theft, damage, and disruption. These laws aim to create a safer online environment.

Question 80: What is 'indemnification' in the context of cybersecurity vendor contracts?

A requirement to purchase cybersecurity insurance
A government-mandated security standard
A contractual obligation for one party to compensate the other for specified losses or damages (Correct answer)
A provision allowing contract termination after a breach

Correct answer: A contractual obligation for one party to compensate the other for specified losses or damages

Indemnification is a contractual obligation where one party agrees to compensate the other for certain losses, damages, or legal costs arising from specified events such as a vendor-caused data breach.

Question 81: Which EU GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Data minimization
Purpose limitation (Correct answer)
Integrity and confidentiality
Storage limitation

Correct answer: Purpose limitation

Purpose limitation under GDPR Article 5(1)(b) restricts data use to the specific purposes for which it was originally collected.

Question 82: State-level cybercrime laws that go beyond federal statutes are permissible as long as they do not conflict with federal law. Which constitutional principle governs this relationship?

Commerce Clause preemption
Supremacy Clause and federal preemption (Correct answer)
Equal Protection doctrine
Dormant Commerce Clause

Correct answer: Supremacy Clause and federal preemption

The Supremacy Clause means that federal law preempts conflicting state law, but states may enact broader cybercrime protections where Congress has not occupied the field.

Question 83: The concept of 'pseudonymization' under GDPR is best described as which of the following?

Deleting data after its retention period expires
Processing data in a way that it can no longer be attributed to a specific individual without additional information held separately (Correct answer)
Permanently removing all identifying information so re-identification is impossible
Encrypting data so only authorized recipients can read it

Correct answer: Processing data in a way that it can no longer be attributed to a specific individual without additional information held separately

Pseudonymization replaces direct identifiers with artificial ones; the data remains personal data because re-identification is possible with the separately stored key.

Question 84: What is the primary legal standard that protects corporate directors from personal liability for good-faith cybersecurity decisions that later prove wrong?

Safe harbor provision
Best efforts standard
Business judgment rule (Correct answer)
Duty of loyalty exception

Correct answer: Business judgment rule

The business judgment rule protects directors who make informed, good-faith decisions in the corporation's best interest, even if those decisions lead to losses.

Question 85: The NIST SP 800-61 incident response lifecycle includes which four phases?

Triage, Investigation, Remediation, Reporting
Discovery, Exploitation, Lateral Movement, Exfiltration
Identify, Protect, Detect, Respond
Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)

Correct answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines Preparation; Detection & Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity as the four phases.

Question 86: Which provision of the National Defense Authorization Act (NDAA) addresses cybersecurity requirements for defense contractors handling Controlled Unclassified Information (CUI)?

DFARS 252.204-7012 and CMMC requirements (Correct answer)
FAR cybersecurity clauses
FISMA moderate baseline requirements
Executive Order 13556

Correct answer: DFARS 252.204-7012 and CMMC requirements

DFARS clause 252.204-7012 requires defense contractors to implement NIST SP 800-171 controls, with the Cybersecurity Maturity Model Certification (CMMC) program expanding and formalizing these requirements.

Question 87: The Virginia Consumer Data Protection Act (VCDPA) differs from CCPA primarily in that VCDPA applies to data processors through which mechanism?

Mandatory processor registration with a state data protection authority
Contractual obligations imposed by controllers via data processing agreements (Correct answer)
Annual processor certification filings with the Virginia Attorney General
Direct regulatory obligations imposed on processors by the state AG

Correct answer: Contractual obligations imposed by controllers via data processing agreements

Under the VCDPA, processors are governed primarily through contracts with controllers rather than direct state-imposed obligations on processors.

Question 88: Which U.S. state was the first to enact a comprehensive consumer data privacy law that became effective in 2020?

Colorado
Texas
California (Correct answer)
Virginia

Correct answer: California

California's Consumer Privacy Act (CCPA) became effective January 1, 2020, making it the first comprehensive U.S. state consumer privacy law.

Question 89: What is the role of encryption in data protection?

To make data accessible to everyone
To protect data by making it unreadable without decryption keys (Correct answer)
To collect and store data in bulk
To remove data from a network

Correct answer: To protect data by making it unreadable without decryption keys

Encryption plays a critical role in data protection by transforming data into an unreadable, encoded format. This process ensures that only authorized individuals with the correct decryption keys can access and understand the information. By rendering data unintelligible to unauthorized parties, encryption significantly enhances confidentiality and security, especially for data in transit and at rest.

Question 90: Under which legal theory can a corporation be held liable for cybersecurity failures of its officers if those failures resulted in harm to shareholders?

Respondeat superior
Breach of fiduciary duty (Correct answer)
Strict liability
Negligence per se

Correct answer: Breach of fiduciary duty

Corporate directors and officers owe fiduciary duties of care and loyalty to shareholders, and systematic failure to oversee cybersecurity risks can constitute a breach.

Question 91: A cybercriminal in Country A hacks servers in Country B to steal data from victims in Country C. Which legal principle best supports Country C asserting criminal jurisdiction?

Passive personality principle
Territorial principle
Flag state jurisdiction
Effects doctrine (Correct answer)

Correct answer: Effects doctrine

The effects doctrine allows Country C to assert jurisdiction because the harmful effects of the cybercrime were felt by its nationals or within its territory.

Question 92: Under the Defense Federal Acquisition Regulation Supplement (DFARS), defense contractors must report cyber incidents involving covered defense information within:

30 days of discovery
1 hour of discovery
24 hours of discovery
72 hours of discovery (Correct answer)

Correct answer: 72 hours of discovery

DFARS clause 252.204-7012 requires contractors to report cyber incidents involving covered defense information or networks to the DoD Cyber Crime Center (DC3) within 72 hours.

Question 93: What due diligence process should companies conduct before engaging a cybersecurity vendor?

Review only the vendor's marketing materials
Check only whether the vendor carries cybersecurity insurance
Rely solely on the vendor's self-attestation without independent verification
Assess the vendor's security certifications, practices, financial stability, and past incident history (Correct answer)

Correct answer: Assess the vendor's security certifications, practices, financial stability, and past incident history

Proper vendor due diligence includes reviewing security certifications (SOC 2, ISO 27001), security questionnaires, financial stability, past breach history, and reference checks before contracting.

Question 94: When a pentester performs social engineering on employees as part of an authorized engagement, the primary legal protection comes from:

Common law fraud defenses
The ethical hacker's professional certification
The written authorization in the signed scope of work (Correct answer)
The First Amendment right to free speech

Correct answer: The written authorization in the signed scope of work

Written authorization explicitly permitting social engineering tactics in the scope of work is the legal basis that distinguishes it from criminal fraud or impersonation.

Question 95: What is the main objective of data breach notification requirements under data protection laws?

To increase the fines on the organization
To provide compensation to individuals affected by the breach
To inform individuals so they can protect their data (Correct answer)
To punish the organization for data breaches

Correct answer: To inform individuals so they can protect their data

The main objective of data breach notification requirements is to promptly inform affected individuals about security incidents involving their personal data. This allows individuals to take necessary steps to protect themselves from potential harm, such as identity theft or fraud, by changing passwords or monitoring financial accounts. It also promotes transparency and accountability from organizations handling sensitive information.

Question 96: Which concept in corporate cybersecurity law refers to the baseline security practices that a reasonable company in a given industry should implement?

Minimum viable security
Regulatory floor
Industry standard of care (Correct answer)
Safe harbor baseline

Correct answer: Industry standard of care

The industry standard of care sets the benchmark for negligence claims by measuring a company's security practices against what is reasonable for its industry.

Question 97: A security researcher discovers a critical zero-day vulnerability and discloses it publicly without notifying the vendor. Under which legal theory could the researcher face civil liability from the vendor?

Defamation by implication
Strict products liability
Tortious interference with business relations (Correct answer)
Negligence per se under the CFAA

Correct answer: Tortious interference with business relations

A vendor might argue that premature public disclosure intentionally interferes with its business relationships and reputation, establishing tortious interference, though such claims rarely succeed.

Question 98: Which cybersecurity regulation requires operators of critical infrastructure to report significant cyber incidents to CISA within 72 hours under U.S. law?

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) (Correct answer)
National Defense Authorization Act
Homeland Security Act
Executive Order 14028

Correct answer: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

CIRCIA, signed into law in 2022, requires covered entities in critical infrastructure sectors to report significant cyber incidents to CISA within 72 hours.

Question 99: Which international framework, updated in 2023, provides guidance on responsible state behavior in cyberspace as a non-binding norm?

Budapest Convention protocols
WTO digital trade rules
NATO cyber defense commitments
UN GGE (Group of Governmental Experts) framework (Correct answer)

Correct answer: UN GGE (Group of Governmental Experts) framework

The UN GGE process has produced consensus reports establishing non-binding norms for responsible state behavior in cyberspace, including the applicability of international law.

Question 100: What sanction can a court impose when a party fails to preserve electronically stored information that should have been preserved?

Adverse inference instruction (Correct answer)
Criminal referral only
Automatic judgment against the spoliating party
Contempt of court only

Correct answer: Adverse inference instruction

An adverse inference instruction allows the jury to presume that destroyed evidence would have been unfavorable to the party that failed to preserve it.

Cybersecurity Law Certification (CSL)

The CSL exam validates knowledge of cybersecurity law across ten domains including data protection, privacy regulations, digital forensics, corporate liability, intellectual property, and legal compliance frameworks such as GDPR, HIPAA, and the Computer Fraud and Abuse Act (CFAA).

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds