CSX Use of Force Policies & Procedures 2 — Questions and Answers
Question 1: Under international law, a cyberattack that causes physical destruction comparable to a conventional armed attack may trigger a state's right to respond under which UN Charter provision?
- Article 2(4)
- Article 51 (Correct answer)
- Article 33
- Article 42
Correct answer: Article 51
UN Charter Article 51 preserves the inherent right of self-defense when an armed attack occurs, which international consensus now extends to sufficiently severe cyberattacks.
Question 2: A company's use-of-force policy requires 'proportionality' in cyber countermeasures. What does proportionality mean in this context?
- The countermeasure must use identical tools as the attacker
- The response must be commensurate in scale and effect with the initial attack (Correct answer)
- The response must be approved by a government authority
- The countermeasure must target the same systems the attacker used
Correct answer: The response must be commensurate in scale and effect with the initial attack
Proportionality requires that defensive or retaliatory actions not exceed what is reasonably necessary relative to the severity of the original intrusion.
Question 3: Which principle requires that before employing active cyber defenses, an organization must exhaust less forceful options first?
- Attribution
- Necessity (Correct answer)
- Sovereignty
- Distinction
Correct answer: Necessity
The necessity principle demands that forceful measures only be taken when no adequate peaceful alternative is available.
Question 4: An incident response team wants to deploy a 'beaconing' payload on an attacker's command-and-control server to track them. Under most corporate use-of-force policies, this action is best described as:
- Passive monitoring
- Active defense crossing into offensive action (Correct answer)
- Standard forensic collection
- Authorized penetration testing
Correct answer: Active defense crossing into offensive action
Deploying any payload on external systems—even for tracking—crosses the boundary into offensive action and requires explicit high-level authorization under most policies.
Question 5: The Tallinn Manual 2.0 is best described as:
- A binding NATO treaty governing state-sponsored cyberattacks
- A non-binding scholarly analysis of how international law applies to cyber operations (Correct answer)
- An ISACA policy framework for corporate cyber use of force
- A US federal regulation on active cyber defense
Correct answer: A non-binding scholarly analysis of how international law applies to cyber operations
The Tallinn Manual 2.0 is a non-binding academic study produced by international law experts explaining how existing international law applies to cyber operations.
Question 6: A use-of-force policy requires incident responders to obtain 'escalation authority' before taking any action that could impact external systems. Who most commonly holds this authority in a large enterprise?
- The on-call SOC analyst
- General counsel or C-suite executive (Correct answer)
- The threat intelligence team lead
- The network firewall administrator
Correct answer: General counsel or C-suite executive
Actions affecting external systems carry significant legal and reputational risk, so escalation authority typically rests with legal counsel or senior executive leadership.
Question 7: Which legal doctrine holds that a private company generally cannot 'hack back' against an attacker without government authorization in the United States?
- The Computer Fraud and Abuse Act (CFAA) (Correct answer)
- The Electronic Communications Privacy Act
- The Stored Communications Act
- Executive Order 13636
Correct answer: The Computer Fraud and Abuse Act (CFAA)
The CFAA prohibits unauthorized access to computer systems, meaning private entities that conduct offensive cyber actions against attackers likely violate federal law regardless of intent.
CSX Use of Force Policies & Procedures 2
Under international law, a cyberattack that causes physical destruction comparable to a conventional armed attack may trigger a state's right to respond under which UN Charter provision?