CSL Ethical Hacking & Incident Response 3

Question 1

Which U.S. law specifically criminalizes unauthorized interception of electronic communications during incident investigations?

Accepted Answer

Electronic Communications Privacy Act (ECPA)

Answer

ECPA, including the Wiretap Act, prohibits unauthorized interception of electronic communications in transit and applies to both government and private actors.

Question 2

During incident response, chain of custody documentation is critical primarily because:

Accepted Answer

It ensures evidence is admissible in legal proceedings

Answer

Maintaining documented chain of custody ensures digital evidence integrity and admissibility if the incident leads to criminal prosecution or civil litigation.

Question 3

An ethical hacker captures network traffic containing private employee emails during a test. This action most likely violates:

Accepted Answer

Neither law if the employer authorized the penetration test

Answer

If the employer has authorized the network test and employees have been given notice through acceptable use policies, interception is generally lawful under the consent exceptions to ECPA.

Question 4

A threat actor uses a U.S.-based server to attack systems in Germany. Which legal jurisdiction primarily governs prosecution of the attacker?

Accepted Answer

Both nations may have concurrent jurisdiction

Answer

Cybercrime jurisdiction is typically concurrent — both the nation where the attack originates and the nation where harm occurs may prosecute under their respective laws.

Question 5

The NIST SP 800-61 incident response lifecycle includes which four phases?

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

NIST SP 800-61 defines Preparation; Detection & Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity as the four phases.

(CSL) Cybersecurity Law Certification Practice Test

(CSL) Cybersecurity Law Certification Practice Test

CSL Ethical Hacking & Incident Response 3