CSL Ethical Hacking & Incident Response 3 — Questions and Answers
Question 1: Which U.S. law specifically criminalizes unauthorized interception of electronic communications during incident investigations?
- Electronic Communications Privacy Act (ECPA) (Correct answer)
- Computer Fraud and Abuse Act (CFAA)
- Stored Communications Act (SCA)
- Federal Information Security Management Act (FISMA)
Correct answer: Electronic Communications Privacy Act (ECPA)
ECPA, including the Wiretap Act, prohibits unauthorized interception of electronic communications in transit and applies to both government and private actors.
Question 2: During incident response, chain of custody documentation is critical primarily because:
- It speeds up the remediation process
- It ensures evidence is admissible in legal proceedings (Correct answer)
- It reduces the organization's liability for the breach
- It satisfies mandatory regulatory reporting requirements
Correct answer: It ensures evidence is admissible in legal proceedings
Maintaining documented chain of custody ensures digital evidence integrity and admissibility if the incident leads to criminal prosecution or civil litigation.
Question 3: An ethical hacker captures network traffic containing private employee emails during a test. This action most likely violates:
- Only the CFAA if done without authorization
- ECPA's Wiretap Act regardless of employer consent to the test
- Neither law if the employer authorized the penetration test (Correct answer)
- The SCA but not the Wiretap Act
Correct answer: Neither law if the employer authorized the penetration test
If the employer has authorized the network test and employees have been given notice through acceptable use policies, interception is generally lawful under the consent exceptions to ECPA.
Question 4: A threat actor uses a U.S.-based server to attack systems in Germany. Which legal jurisdiction primarily governs prosecution of the attacker?
- Germany only, as it is the victim nation
- The U.S. only, as the attack originated there
- Both nations may have concurrent jurisdiction (Correct answer)
- International law exclusively governs cross-border cyberattacks
Correct answer: Both nations may have concurrent jurisdiction
Cybercrime jurisdiction is typically concurrent — both the nation where the attack originates and the nation where harm occurs may prosecute under their respective laws.
Question 5: The NIST SP 800-61 incident response lifecycle includes which four phases?
- Identify, Protect, Detect, Respond
- Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
- Triage, Investigation, Remediation, Reporting
- Discovery, Exploitation, Lateral Movement, Exfiltration
Correct answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity
NIST SP 800-61 defines Preparation; Detection & Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity as the four phases.
Question 6: When a pentester performs social engineering on employees as part of an authorized engagement, the primary legal protection comes from:
- The First Amendment right to free speech
- The written authorization in the signed scope of work (Correct answer)
- The ethical hacker's professional certification
- Common law fraud defenses
Correct answer: The written authorization in the signed scope of work
Written authorization explicitly permitting social engineering tactics in the scope of work is the legal basis that distinguishes it from criminal fraud or impersonation.
Question 7: Which concept describes an ethical hacker's obligation to disclose vulnerabilities to the vendor before public release?
- Full disclosure
- Coordinated vulnerability disclosure (Correct answer)
- Bug bounty policy
- Penetration test report
Correct answer: Coordinated vulnerability disclosure
Coordinated vulnerability disclosure (CVD) involves notifying the vendor first and allowing time to patch before any public announcement of the vulnerability.
CSL Ethical Hacking & Incident Response 3
Which U.S. law specifically criminalizes unauthorized interception of electronic communications during incident investigations?