Cyber Security — Practice Questions
UPSC-pattern practice questions on cyber security with explanations — IT Act sections, the Budapest Convention, internet shutdowns and cyber agencies.
Questions
These are original UPSC-pattern practice questions. Attempt each one before revealing the answer.
With reference to the Information Technology Act, 2000, consider the following statements:
- Section 66F deals with cyber terrorism.
- Section 79 gives intermediaries complete immunity for third-party content irrespective of whether they observe due diligence.
- Section 70B provides for the Indian Computer Emergency Response Team as the national agency for incident response.
Which of the statements given above is/are correct?
Solution
Statements 1 and 3 are correct. Statement 2 is wrong — the Section 79 “safe harbour” is conditional: an intermediary loses it if it does not observe due diligence or fails to act on a court order or government notification (as read down in Shreya Singhal, 2015).
Answer: C
With reference to the Budapest Convention on Cybercrime, consider the following statements:
- It was drawn up under the Council of Europe.
- India has ratified it.
Which of the statements given above is/are correct?
Solution
Statement 1 is correct — the 2001 convention is a Council of Europe treaty, though non-European States may join. Statement 2 is wrong — India has neither signed nor ratified it.
Answer: A
In Anuradha Bhasin v. Union of India (2020), the Supreme Court held that:
Solution
The Court held that freedom of speech and trade through the internet is protected under Articles 19(1)(a) and 19(1)(g), that suspension cannot be indefinite, and that orders must be proportionate, published and reviewed. The right is not absolute (A is wrong); publication is required (C is wrong); suspension is an executive power exercised under rules, not by Parliament case by case (D is wrong).
Answer: B
Consider the following pairs:
| Body | Parent organisation / law |
|---|---|
| 1. CERT-In | Ministry of Electronics and Information Technology |
| 2. NCIIPC | National Technical Research Organisation |
| 3. Indian Cyber Crime Coordination Centre | Ministry of Home Affairs |
| 4. Data Protection Board of India | Digital Personal Data Protection Act, 2023 |
How many of the pairs given above are correctly matched?
Solution
All four are correct. The usual traps are placing NCIIPC or I4C under MeitY.
Answer: D
Mains
Discuss the role of social networking sites in creating internal security challenges. How can the State respond without curbing legitimate free speech?
Solution
Introduction: Social networking sites have made every citizen a broadcaster. The same reach that helps in disasters and policing also spreads rumours, hate and extremist propaganda at speed.
Body:
- Challenges: rumour-driven mob violence (the context of Tehseen Poonawalla, 2018); online radicalisation and recruitment; deepfakes and coordinated influence operations; encrypted coordination of crime; live disclosure of security operations.
- State response: IT Act Section 69A blocking with safeguards (upheld in Shreya Singhal, 2015); platform due diligence under the IT Rules, 2021; fact-checking and counter-narratives; digital literacy; capacity of cyber police (I4C).
- Safeguards for free speech: restrictions must fall within Article 19(2); vague offences such as Section 66A are unconstitutional; shutdowns must be proportionate and reviewed (Anuradha Bhasin, 2020).
Conclusion: The answer is precise, transparent and reviewable regulation plus a resilient, media-literate public — not blanket censorship.
Cyber warfare has become an integral part of hybrid threats to national security. Discuss the challenges it poses for India and outline the elements of an effective national response.
Solution
Introduction: Hybrid warfare blends conventional force, proxies, economic pressure and information operations. Cyber attacks are attractive in this mix because they are cheap, deniable and can disable a society without crossing a physical border — as Stuxnet (2010) first showed.
Body:
- Challenges:
- Attacks on critical information infrastructure — power, banking, telecom, health (AIIMS, 2022).
- State-backed APTs for espionage; supply-chain risks from imported hardware and software.
- Attribution is hard, so deterrence is weak.
- Information operations and deepfakes that polarise society.
- Skill shortage and fragmented institutions; an IT Act from 2000 not designed as a security law.
- Elements of a response:
- Law and policy: an updated national cyber security strategy replacing the 2013 policy; a dedicated cyber security law.
- Institutions: clear roles for CERT-In, NCIIPC, NSCS and the Defence Cyber Agency; sectoral CERTs; mandatory reporting (2022 directions).
- Capability: skilled workforce; indigenous trusted hardware and software; security audits and red-teaming of CII.
- Deterrence and diplomacy: offensive-defensive capability under civilian oversight; participation in UN norm-making and partnerships for information sharing.
- Society: cyber hygiene and digital literacy.
Conclusion: In hybrid conflict, the front line runs through every network. India needs a whole-of-nation approach — law, institutions, technology and people — to keep its digital growth secure.