Cybersecurity, Data and Digital Governance

1.Surface Web, Deep Web and Dark Web

• Surface Web and Deep WebImportance 3/5
  What does each of the two layers contain, with everyday examples such as search-engine pages, bank portals and academic databases? Understand why deep-web content stays out of search results. Is the often-quoted percentage split between the two layers a measured figure or a rough estimate?
• Dark Web and Its UsesImportance 4/5
  Is the dark web the same as the deep web? Understand how it differs in access and in purpose. Learn its features, its legal uses (for example whistleblowing and anonymous journalism) alongside its illegal markets, and why I4C monitors it with AI-based tools.
• Tor and Onion RoutingImportance 3/5
  Understand how layered (onion) routing hides who is connecting and where from. Remember where the idea began and what other darknet networks exist, such as I2P and Freenet. Is Tails a browser, or something else?

2.Encryption and Digital Signatures

• Encryption, Keys and CryptographyImportance 3/5
  Be clear about encryption, decryption, plaintext, ciphertext and key. What does encryption protect: secrecy, identity or both? Understand why the secrecy and length of a key decide how strong the protection is.
• Symmetric and Asymmetric EncryptionImportance 4/5
  How do the two types differ in the number and use of keys? Understand the key-distribution problem and why real systems such as HTTPS combine both types. Remember common examples of each, such as AES and RSA.
• End-to-End EncryptionImportance 4/5
  Who holds the keys in end-to-end encryption, and who is kept out? Is every messaging app or VPN end-to-end encrypted by default? Understand why this feature clashes with demands for traceability, which is covered under the IT Rules.
• Hashing and How It Differs from EncryptionImportance 3/5
  What is a hash, and why can it not be turned back into the original data? Distinguish hashing from encryption. Learn where hashes are used, such as password storage, integrity checks, digital signatures and blockchain, and remember the SHA family as an example.
• Post-Quantum CryptographyImportance 3/5
  Why do quantum computers threaten today's public-key encryption, and what does "harvest now, decrypt later" mean? Distinguish post-quantum cryptography (new mathematical methods) from quantum key distribution (physics). What has India's Department of Science and Technology task force proposed for a move to quantum-safe systems?
• Digital Signature and How It WorksImportance 5/5UPSC 2019
  Understand the steps of signing and verifying: which key signs, which key checks, and what the hash does. What three things does a digital signature prove? Does it keep the content secret? Be clear about how this use of keys differs from encryption.
• Electronic Signatures and eSign Under the IT ActImportance 3/5
  Which sections of the IT Act give legal recognition to digital and electronic signatures? Distinguish a digital signature (based on public-key technology) as one kind of electronic signature. How does the Aadhaar-based eSign service work?
• Digital Certificates, Certifying Authorities and the CCAImportance 4/5UPSC 2019, 2020
  Remember what a digital certificate contains (public key, holder, issuer, validity) and what it proves. Who licenses Certifying Authorities in India, and what is the Root Certifying Authority? Understand the chain of trust and what revocation means.
• SSL/TLS Certificates and HTTPSImportance 3/5
  How does a website's certificate help set up an encrypted HTTPS connection? Understand the handshake in outline. What does the padlock in the browser prove, and does it show that a site is honest?

3.Cyber Threats and Attacks

• Malware and Its Types (Virus, Worm, Trojan, Spyware, Rootkit)Importance 4/5
  Distinguish a virus, a worm and a trojan by how each spreads and hides. Remember what spyware, adware, keyloggers and rootkits do, with Pegasus as an example of spyware.
• RansomwareImportance 5/5UPSC 2018
  How does ransomware work, and what is double extortion? How is an extortion-only data leak different? Remember WannaCry, Petya and EternalBlue, and how they are linked.
• Botnets and Distributed Denial-of-Service AttacksImportance 3/5
  What is a botnet? Distinguish a denial-of-service attack from a distributed one. What is the role of the Cyber Swachhta Kendra in India?
• Phishing, Vishing, Smishing and Social EngineeringImportance 4/5
  Distinguish phishing, spear-phishing, vishing, smishing and quishing by the channel each uses. Does social engineering target people or systems, and why? Understand how these methods feed KYC and courier scams.
• Zero-Day Vulnerabilities and Advanced Persistent ThreatsImportance 3/5
  What is a zero-day vulnerability, and why is it valuable to attackers? How does an advanced persistent threat differ from a one-off attack? Why is the time between the disclosure of a flaw and its exploitation shrinking (for example with AI), and why does this matter for patching?
• Software Supply-Chain Attacks (Axios Hack)Importance 3/5
  How does a supply-chain attack reach many users through one trusted software source? Understand the method used in the Axios case (hijacked account, fake updates, hidden dependency). What is Axios, and what is npm? Remember SolarWinds as the classic earlier case.
• Other Attack Methods (Man-in-the-Middle, Cryptojacking, Juice Jacking)Importance 2/5
  Remember what each of these terms means: man-in-the-middle, cryptojacking, juice jacking and SQL injection.
• Attacks on Connected Devices (E-Rickshaw Battery Systems)Importance 2/5
  What does a battery management system do in an electric vehicle? Understand how weak or default passwords on Bluetooth-enabled systems let a nearby attacker switch off e-rickshaw batteries. Why does this case show the weak security of low-cost connected devices?
• Cyber Warfare and State-Sponsored AttacksImportance 3/5
  How does a state-backed attacker differ from an ordinary criminal? Remember Stuxnet as the classic case. What does cyber terrorism mean, and which section of the IT Act deals with it?
• Attacks on Critical Infrastructure in India (Kudankulam, AIIMS)Importance 4/5
  Why are power, health and nuclear systems attractive targets? Remember the Kudankulam malware incident of 2019, the 2026 leak from a contractor, and the AIIMS Delhi attack of 2022. Understand why even non-core data can help a hostile actor, and why breach disclosure is a problem.
• AI in Cyber Attack and DefenceImportance 3/5
  How can AI help attackers, and how can it help defenders? Understand why AI agents that act beyond their limits in cyber tests raise a new kind of risk. What can AI models that find software flaws at scale change, and what AI tools does I4C use?

4.Cyber Frauds and Telecom Security

• Digital Arrest ScamsImportance 5/5
  How does a digital arrest scam work? Does any Indian law allow arrest over a video call? Learn the Supreme Court's own-motion case and its August 2026 directions (an RBI SOP on mule accounts, e-Zero FIR and money restoration). What was the inter-departmental committee set up to do?
• Mule Accounts and Fraud-Detection Tools (MuleHunter.AI)Importance 3/5
  What is a mule account? Remember MuleHunter.AI of the Reserve Bank Innovation Hub, the suspect scoring idea and how these tools link with I4C's reporting system and Suspect Registry. Why does fast freezing of accounts matter?
• Other Common Online Frauds (SIM Swap, Investment Scams, Fake Apps)Importance 3/5
  Understand how SIM swap, investment and task scams, fake loan apps and UPI collect-request fraud work, and the warning signs of each.
• Cyber InsuranceImportance 3/5UPSC 2020
  Remember what an individual cyber insurance policy usually covers, such as loss of funds, restoration of data, help against extortion and legal defence.
• SIM Binding for Messaging AppsImportance 4/5
  Understand what SIM binding means, which services it covers and why the Department of Telecommunications ordered it in November 2025. Understand the fraud from accounts that outlive their SIM. What concerns were raised, and what was the WhatsApp username dispute about?
• IMEI and IMEI TamperingImportance 4/5
  What is an IMEI, how many digits does it have, and what does its first part (the TAC) show? Who allocates TACs? What counts as tampering, which section of the Telecommunications Act, 2023 punishes it, and what is the penalty? Why does tampering defeat tracking?
• Sanchar Saathi, Chakshu and CEIRImportance 4/5
  What do the citizen tools of Sanchar Saathi do: Chakshu, CEIR and the check for connections in your name? What did the November 2025 order on pre-installing the Sanchar Saathi app require, and was it kept or withdrawn? What is the Financial Fraud Risk Indicator, and who uses it?
• Telecom Cyber Security Rules, 2024Importance 3/5
  Under which Act were these Rules made, and what do they aim to do? Which main duties fall on telecom entities? How did the 2025 amendment bring app-based services into their reach?

5.Cybersecurity Institutions and Policy

• CERT-In and Its Directions on Reporting IncidentsImportance 5/5UPSC 2017
  Under which section of the IT Act and which ministry does CERT-In work? Who must report cyber incidents, within what time, and for how long must logs be kept under the 2022 directions? Understand the audit guidelines and advisories CERT-In has issued.
• NCIIPC and Critical Information InfrastructureImportance 4/5
  What counts as critical information infrastructure, and what is a "protected system"? Remember NCIIPC's legal basis and its parent body. Distinguish its role from CERT-In's.
• Indian Cyber Crime Coordination Centre (I4C) and Its PlatformsImportance 5/5
  Under which ministry does I4C work, and what is its role? Remember its main platforms: the National Cybercrime Reporting Portal, the 1930 helpline, the citizen financial fraud reporting system, Samanvaya, Sahyog and the Suspect Registry. Understand its AI initiatives.
• National Cyber Security Coordinator and Other BodiesImportance 3/5
  Remember where the National Cyber Security Coordinator sits, and what the NCCC, the Cyber Swachhta Kendra and the Defence Cyber Agency each do.
• National Cyber Security Policy, 2013 and the Pending National StrategyImportance 4/5
  What were the main aims of the 2013 policy? Understand the gaps it left. Has India's new national cyber security strategy been released, and why is one needed?
• Cyber Awareness and Skilling Programmes (ISEA, e-SafeHER)Importance 2/5
  Remember the aim of the ISEA programme under MeitY and of e-SafeHER, including who runs it and whom it trains. What does Cyber Surakshit Bharat, a related awareness effort, aim to do?
• Budapest Convention and India's PositionImportance 3/5
  What is the Budapest Convention, and which body and year are linked to it? Why has India not joined it?
• UN Convention Against CybercrimeImportance 4/5
  Remember the milestones: adoption by the UN General Assembly, opening for signature at Hanoi, and the rule for entry into force. Distinguish signing from ratifying. Has India signed it, and has it ratified it? Has the Convention entered into force? Understand the criticism on rights and surveillance.

6.IT Act and Intermediary Rules

• Objectives of the IT Act, 2000 and the 2008 AmendmentImportance 4/5
  Why was the Act made, and which international model law was it based on? What did the 2008 amendment add? Has a draft of the proposed Digital India Act, meant to replace the Act, been published?
• Cyber Offences Under the IT Act (Sections 43, 66 to 66F, 67 to 67B)Importance 4/5
  Which section covers which offence: damage to computers (civil, s. 43), identity theft, impersonation, privacy violation, cyber terrorism, and obscene or child-related material? Understand how these overlap with the Bharatiya Nyaya Sanhita.
• Section 66A and the Shreya Singhal JudgmentImportance 4/5
  What did Section 66A punish, and why was it struck down in 2015 under Article 19(1)(a)? Is Section 66A still in the Act today? What did the judgment say about blocking under Section 69A and about Section 79?
• Blocking and Interception Powers (Sections 69 and 69A)Importance 4/5
  Distinguish interception (s. 69) from blocking (s. 69A). Who may order each, on what grounds, and with what safeguards? Why are blocking orders kept confidential, and why is this criticised?
• Safe Harbour for Intermediaries Under Section 79Importance 4/5
  Who is an intermediary? What protection does Section 79 give, and when is it lost? What did the Karnataka High Court decide on Section 79(3)(b) and the Sahyog portal? Has the Supreme Court taken up the challenges to them and decided them? Remember the BitChat takedown as an example of an order under Section 79(3)(b) through Sahyog, and the debate on whether such orders should go through Section 69A.
• Due Diligence and Grievance Redressal for IntermediariesImportance 4/5
  What is a Significant Social Media Intermediary, and what user threshold applies? Remember the three officers it must appoint and its content-removal duties. What is the Grievance Appellate Committee, and when can a user go to it?
• Traceability of the First OriginatorImportance 3/5
  Which services and which offences does the traceability rule cover? Why does it conflict with end-to-end encryption? What was WhatsApp's challenge to the rule?
• Digital Media Ethics Code for OTT and Digital NewsImportance 3/5
  Remember the age categories for content, and where parental locks and age verification apply. What are the three tiers of the grievance structure?
• Rules on Synthetically Generated Information and Faster TakedownsImportance 5/5
  What counts as synthetically generated information, and what is excluded? What labelling and metadata duties apply, and what checks must large platforms make? What are the new takedown time limits, and which kinds of content do they cover? When did the amendment come into force?
• Fact Check Unit Amendment and Its Striking DownImportance 2/5
  What did the 2023 Fact Check Unit amendment allow the government to do? Which court struck it down, and on what ground? Has the Supreme Court decided the Union's appeal against that judgment?

7.Data Protection and Privacy

• Right to Privacy and the Puttaswamy JudgmentImportance 4/5
  Remember the 2017 judgment: the size of the bench and the Article under which privacy was placed. Understand the proportionality test for limiting privacy. Which committee was set up in 2017 to draft a data protection law, and what did it produce?
• Personal and Non-Personal Data, and Data LocalisationImportance 3/5UPSC 2019
  Distinguish personal, sensitive personal and non-personal data. Does the DPDP Act keep a separate sensitive category, and where did that category come from? What does data localisation mean? Understand the arguments for and against it, with examples such as the RBI's payment data rule and the online gaming rule on keeping game data in India.
• Digital Public Infrastructure and Digital SovereigntyImportance 4/5UPSC 2018, 2022
  Understand what makes Digital Public Infrastructure (UPI, Aadhaar) different from ordinary digital services. What risk to digital sovereignty does reliance on foreign cloud and AI create, as the Nayara Energy and Microsoft case showed? What is MeghRaj?
• Scope and Key Terms of the DPDP ActImportance 5/5
  Which data does the Act cover? Understand what it leaves out, such as non-digital data and data a person makes public. Remember the defined actors: data principal, data fiduciary, data processor, consent manager and Significant Data Fiduciary. Understand consent and "legitimate uses".
• Rights and Duties of Data PrincipalsImportance 4/5
  Remember the rights of a data principal: information, correction and erasure, grievance redressal and nomination. Does the Act also place duties on individuals, and what happens with false complaints?
• Obligations of Data Fiduciaries and Significant Data FiduciariesImportance 4/5
  Remember the duties of every fiduciary: notice, consent, security, breach intimation and erasure. Understand the extra duties of a Significant Data Fiduciary: a data protection officer, audit and impact assessment.
• Exemptions, Cross-Border Transfers and the RTI AmendmentImportance 4/5
  Under what grounds can the State be exempted from the Act, and why is this criticised? How does the negative-list model of transfers abroad work? Understand how the Act changed the RTI Act's exemption for personal information.
• Data Protection Board of India and PenaltiesImportance 4/5
  What kind of body is the Board, and how does it work? Which body hears appeals against its orders? What is the maximum penalty under the Act? Have the Board's members been appointed?
• DPDP Rules, 2025 and Phased ImplementationImportance 5/5
  In which month and year were the Rules notified? Which provisions took effect at once, and which fall due in later phases? Remember the breach intimation time limit and consent manager registration. Has the government's proposal to shorten the phased timeline been notified?

8.Online Gaming, Social Media and Child Safety

• Promotion and Regulation of Online Gaming Act, 2025Importance 5/5
  What are the three categories of online games under the Act? Understand what it bans for online money games, covering offering, advertising and payments. What does it promote? Understand the old debate on skill versus chance that it ended.
• Online Gaming Rules, 2026 and the Online Gaming Authority of IndiaImportance 4/5
  Remember the composition and functions of the Online Gaming Authority of India. What triggers a determination of a game, and how long does it take? Learn the registration rules, the role of banks and payment gateways, the grievance route and the rule on keeping game data in India.
• Processing Children's Data Under the DPDP ActImportance 4/5
  Who counts as a child under the Act? What consent is needed to process a child's data? Understand the ban on tracking and targeted advertising aimed at children. Why does weak age verification limit these safeguards?
• Laws Against Online Child Sexual Abuse Material (CSEAM)Importance 4/5
  Which laws apply: IT Act Section 67B, the POCSO Act, the Juvenile Justice Act and the Bharatiya Nyaya Sanhita? What did the Supreme Court hold in 2024 on storing or viewing such material, and what change of term did it recommend? Remember the reporting and blocking mechanisms and the duties of platforms.
• Age Limits for Children on Social MediaImportance 4/5
  What graded approach to children's access has the Union government been considering, and has any law been brought? Remember the PRAGYATA screen-time guidelines. What does Australia's minimum-age law require? Understand the age-verification problem.
• Addictive Platform Design and Algorithmic FeedsImportance 2/5
  Why is platform design (feeds, autoplay) now treated as a harm, as in the US case against Meta and YouTube? How did the plaintiffs avoid the protection Section 230 gives platforms? What do Australia's "My Feed, My Way" proposal and the EU Digital Services Act offer users?

1. 1.

   With reference to digital signatures in India, consider the following statements:
   1. A digital signature confirms that the information originated from the signer and has not been altered.
   2. The Controller of Certifying Authorities is appointed by the Central Government under Section 17 of the Information Technology Act, 2000.
   3. Section 3 of the Information Technology Act, 2000 gives legal sanctity to digital signatures based on symmetric cryptosystems.
   Which of the statements given above is/are correct?

   1. A1 only
   2. B2 and 3 only
   3. C1 and 2 only
   4. D1, 2 and 3
2. 2.

   With reference to the CERT-In Directions of 28 April 2022 issued under Section 70B(6) of the Information Technology Act, 2000, consider the following statements:
   1. Service providers, intermediaries, data centres, body corporate and Government organisations must report listed cyber incidents to CERT-In within 6 hours of noticing them.
   2. Logs of all ICT systems must be kept for a rolling 180 days within India.
   3. Data centres, VPS, cloud and VPN providers must keep subscriber records for only 180 days.
   How many of the statements given above are correct?

   1. AOnly one
   2. BOnly two
   3. CAll three
   4. DNone
3. 3.

   Consider the following statements:
   Statement-I: The dark web is a subset of the deep web, but its content cannot be reached through standard search engines.
   Statement-II: The dark web requires specific browsers and networks, such as Tor, to access its content.
   Which one of the following is correct in respect of the above statements?

   1. ABoth Statement-I and Statement-II are correct and Statement-II explains Statement-I
   2. BBoth Statement-I and Statement-II are correct and Statement-II does not explain Statement-I
   3. CStatement-I is correct but Statement-II is incorrect
   4. DStatement-I is incorrect but Statement-II is correct
4. 4.

   Consider the following pairs:

   Term	Description
   1. WannaCry	Ransomware outbreak of May 2017 that spread through Microsoft Windows computers
   2. Petya	Spyware that secretly records what a user types
   3. EternalBlue	Exploit developed by the US National Security Agency that was later leaked and used in attacks

   Which of the pairs given above is/are correctly matched?

   1. A1 and 2 only
   2. B2 and 3 only
   3. C1, 2 and 3
   4. D1 and 3 only
5. 5.

   Match List I with List II:

   List I (Body)	List II (Feature)
   A. CERT-In	1. Unit of the NTRO, created under Section 70A of the IT Act
   B. NCIIPC	2. Issued the Directions of 28 April 2022 under Section 70B(6) of the IT Act
   C. Controller of Certifying Authorities	3. Licenses and regulates the working of Certifying Authorities
   D. I4C	4. Attached office of the Ministry of Home Affairs since 1 July 2024

   Select the correct answer using the code given below:

   1. AA-2, B-1, C-3, D-4
   2. BA-1, B-2, C-3, D-4
   3. CA-2, B-1, C-4, D-3
   4. DA-3, B-4, C-2, D-1
6. 6.

   With reference to the Supreme Court's judgment in Shreya Singhal v. Union of India (2015), consider the following statements:
   1. Section 66A of the Information Technology Act, 2000 was struck down as violative of Article 19(1)(a) and not saved under Article 19(2).
   2. Section 69A and the Blocking Rules, 2009 were held to be unconstitutional.
   3. Section 79(3)(b) was read down so that an intermediary must act on actual knowledge from a court order or a notification by the appropriate government or its agency.
   Which of the statements given above is/are correct?

   1. A1 and 2 only
   2. B2 and 3 only
   3. C1, 2 and 3
   4. D1 and 3 only
7. 7.

   As of October 2026, consider the following statements about the Digital Personal Data Protection (DPDP) framework in India:
   1. The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased compliance period.
   2. The Data Protection Board of India consists of four members and functions digitally.
   3. The highest penalty of ₹250 crore applies to failure to give breach notification.
   4. The DPDP Act was enacted on 11 August 2023.
   How many of the statements given above are correct?

   1. AOnly one
   2. BOnly two
   3. COnly three
   4. DAll four
8. 8.

   As of April 2026, consider the following statements about the Promotion and Regulation of Online Gaming (PROG) Act, 2025 and the rules under it:
   1. The Act bans an online money game only if its outcome depends wholly on chance.
   2. The Act recognises three segments: e-sports, online social games and online money games.
   3. A registration certificate issued under the Online Gaming Rules, 2026 is valid for a period of up to 10 years.
   Which of the statements given above is/are correct?

   1. A1 only
   2. B1 and 2 only
   3. C1 and 3 only
   4. D2 and 3 only
9. 9.

   As of October 2026, which one of the following is correct about the United Nations Convention against Cybercrime?

   1. AIt was adopted by the UN Security Council in December 2024 and is already in force
   2. BIt enters into force 90 days after the 40th instrument of ratification and has not yet entered into force
   3. CIt was adopted by the UN General Assembly in December 2022
   4. DIt enters into force 90 days after its adoption by the UN General Assembly
10. 10.

    As of February 2026, under the IT Rules, 2021 as amended for synthetically generated (AI) content and in force from 20 February 2026, within what period must a platform take down such content once it is flagged by a court or the government?

    1. A3 hours
    2. B6 hours
    3. C12 hours
    4. D24 hours
11. 11.

    As of March 2026, consider the following statements about SIM binding for messaging apps in India:
    1. In November 2025, the Department of Telecommunications directed app-based platforms such as WhatsApp, Telegram, Signal and Snapchat to implement SIM binding.
    2. SIM binding means the app can be used only with one specific, active SIM card.
    3. The direction was issued by the Telecom Regulatory Authority of India.
    How many of the statements given above are correct?

    1. AOnly one
    2. BOnly two
    3. CAll three
    4. DNone
12. 12.

    With reference to the International Mobile Equipment Identity (IMEI), consider the following statements:
    1. It is a unique 15-digit number identifying a mobile device.
    2. The first eight digits form the Type Allocation Code (TAC), which identifies the individual device.
    3. The GSMA assigns a unique IMEI to every individual handset.
    How many of the statements given above are correct?

    1. AOnly one
    2. BOnly two
    3. CAll three
    4. DNone
13. 13.

    Consider the following pairs:

    Term	Feature
    1. Symmetric encryption	Uses a single, shared key for both encryption and decryption
    2. Asymmetric encryption	Uses a public key for encryption and a private key for decryption
    3. End-to-end encryption	Decryption keys are held by the cloud service provider

    Which of the pairs given above is/are correctly matched?

    1. A1 only
    2. B2 and 3 only
    3. C1 and 2 only
    4. D1, 2 and 3
14. 14.

    With reference to the institutional framework against "digital arrest" scams in India, consider the following statements:
    1. The Indian Cyber Crime Coordination Centre functions under the Ministry of Electronics and Information Technology.
    2. The e-Zero FIR mechanism allows an FIR to be registered regardless of jurisdiction.
    3. The Reserve Bank of India frames rules for banks on suspicious transactions.
    Which of the statements given above is/are correct?

    1. A1 and 2 only
    2. B2 and 3 only
    3. C1 and 3 only
    4. D1, 2 and 3
15. 15.

    Under India's Digital Personal Data Protection Act, 2023, which one of the following is prohibited in respect of children?

    1. AProcessing of a child's data even with verifiable parental consent
    2. BSeeking verifiable parental or guardian consent before processing a child's data
    3. CClassifying online content into age categories
    4. DBehavioural tracking of children and targeted advertising directed at children

1. 1.

   UPSC 2022

   Consider the following :
   1. Aarogya Setu
   2. CoWIN
   3. DigiLocker
   4. DIKSHA
   Which of the above are built on top of open-source digital platforms ?

   1. A1 and 2 only
   2. B2, 3 and 4 only
   3. C1, 3 and 4 only
   4. D1, 2, 3 and 4
2. 2.

   UPSC 2020

   In India, the term “Public Key Infrastructure” is used in the context of

   1. ADigital security infrastructure
   2. BFood security infrastructure
   3. CHealth care and education infrastructure
   4. DTelecommunication and transportation infrastructure
3. 3.

   UPSC 2020

   In India, under cyber insurance for individuals, which of the following benefits are generally covered, in addition to payment for the loss of funds and other benefits ?
   1. Cost of restoration of the computer system in case of malware disrupting access to one’s computer
   2. Cost of a new computer if some miscreant wilfully damages it, if proved so
   3. Cost of hiring a specialized consultant to minimize the loss in case of cyber extortion
   4. Cost of defence in the Court of Law if any third party files a suit
   Select the correct answer using the code given below :

   1. A1, 2 and 4 only
   2. B1, 3 and 4 only
   3. C2 and 3 only
   4. D1, 2, 3 and 4
4. 4.

   UPSC 2019

   Which of the following adopted a law on data protection and privacy for its citizens known as 'General Data Protection Regulation' in April 2016 and started implementation of it from 25th May, 2018?

   1. AAustralia
   2. BCanada
   3. CThe European Union
   4. DThe United States of America
5. 5.

   UPSC 2019

   Consider the following statements : A digital signature is
   1. an electronic record that identifies the certifying authority issuing it
   2. used to serve as a proof of identity of an individual to access information or server on Internet
   3. an electronic method of signing an electronic document and ensuring that the original content is unchanged
   Which of the statements given above is/are correct?

   1. A1 only
   2. B2 and 3 only
   3. C3 only
   4. D1, 2 and 3
6. 6.

   UPSC 2018

   The identity platform 'Aadhaar' provides open "Application Programming Interfaces (APIs)". What does it imply ?
   1. It can be integrated into any electronic device.
   2. Online authentication using iris is possible.
   Which of the statements given above is/are correct ?

   1. A1 only
   2. B2 only
   3. CBoth 1 and 2
   4. DNeither 1 nor 2
7. 7.

   UPSC 2018

   With reference to digital payments, consider the following statements :
   1. BHIM app allows the user to transfer money to anyone with a UPI-enabled bank account.
   2. While a chip-pin debit card has four factors of authentication, BHIM app has only two factors of authentication.
   Which of the statements given above is/are correct ?

   1. A1 only
   2. B2 only
   3. CBoth 1 and 2
   4. DNeither 1 nor 2
8. 8.

   UPSC 2018

   The terms ‘WannaCry, Petya and EternalBlue’ sometimes mentioned in the news recently are related to

   1. AExoplanets
   2. BCryptocurrency
   3. CCyber attacks
   4. DMini satellites
9. 9.

   UPSC 2017

   In India, it is legally mandatory for which of the following to report on cyber security incidents ?
   1. Service providers
   2. Data centres
   3. Body corporate
   Select the correct answer using the code given below :

   1. A1 only
   2. B1 and 2 only
   3. C3 only
   4. D1, 2 and 3
10. 10.

    UPSC 2016

    'SWAYAM', an initiative of the Government of India, aims at

    1. Apromoting the Self Help Groups in rural areas
    2. Bproviding financial and technical assistance to young start-up entrepreneurs
    3. Cpromoting the education and health of adolescent girls
    4. Dproviding affordable and quality education to the citizens for free
11. 11.

    UPSC 2016

    Regarding 'DigiLocker', sometimes seen in the news, which of the following statements is/are correct?
    1. It is a digital locker system offered by the Government under Digital India Programme.
    2. It allows you to access your e-documents irrespective of your physical location.
    Select the correct answer using the code given below.

    1. A1 only
    2. B2 only
    3. CBoth 1 and 2
    4. DNeither 1 nor 2
12. 12.

    UPSC 2014

    In addition to fingerprint scanning, which of the following can be used in the biometric identification of a person?
    1. Iris scanning
    2. Retinal scanning
    3. Voice recognition
    Select the correct answer using the code given below.

    1. A1 only
    2. B2 and 3 only
    3. C1 and 3 only
    4. D1, 2 and 3