UPSC CSE Prelims
Cyber Security Previous Year Questions (PYQs)
Showing solved Previous Year Questions for Chapter: Cyber Security
Topic Breakdown: Scroll →
In India, the term “Public Key Infrastructure” is used in the context of
Detailed Explanation:
Answer: Option 1 — Digital security infrastructure
Public Key Infrastructure (PKI) is a comprehensive framework used specifically for digital security infrastructure in India. It enables secure electronic communication and transactions through digital certificates, certificate authorities, and cryptographic key pairs (public and private keys), ensuring authentication, confidentiality, integrity, and non-repudiation of digital data.
📝 Short Notes: Public Key Infrastructure (PKI)
- Definition: PKI is a set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.
- Components: Includes Certificate Authority (CA), Registration Authority (RA), digital certificates, certificate repositories, and certificate revocation lists (CRL).
- Function: Uses asymmetric cryptography with a pair of keys - public key (shared openly) and private key (kept secret) for encryption and digital signatures.
- Applications in India: Used in e-governance initiatives, digital signatures, secure email, online banking, e-commerce, and Aadhaar-based authentication.
- Controller of Certifying Authorities (CCA): Under the IT Act 2000, CCA is the authority to license and regulate Certifying Authorities in India.
- Benefits: Ensures data confidentiality, integrity, authentication, and non-repudiation in digital communications and transactions.
In India, under cyber insurance for individuals, which of the following benefits are generally covered, in addition to payment for the funds and other benefits?
- Cost of restoration of the computer system in case of malware disrupting access to one's computer
- Cost of a new computer if some miscreant wilfully damages it, if proved so
- Cost of hiring a specialized consultant to minimize the loss in case of cyber extortion.
- Cost of defence in the Court of Law if any third party files a suit.
Select the correct answer using the code given below:
Detailed Explanation:
Answer: Option 2 — 1, 3 and 4 only
Cyber insurance for individuals covers digital risks and financial losses arising from cyber incidents. It includes restoration costs for compromised systems, legal defense expenses, and consultant fees for handling cyber extortion, but excludes physical damage to hardware caused by willful acts of vandalism.
✅ Statement 1 – Correct: Cyber insurance covers the cost of restoring computer systems and data corrupted or disrupted by malware attacks.
❌ Statement 2 – Incorrect: Cyber insurance does not cover physical damage to hardware or replacement costs due to willful physical vandalism; it covers only digital risks and cyber-related losses.
✅ Statement 3 – Correct: Cyber insurance covers expenses for hiring specialized consultants to investigate cyber extortion threats (such as ransomware) and minimize associated losses.
✅ Statement 4 – Correct: Cyber insurance provides coverage for legal defense costs when a third party files a lawsuit for privacy breaches, data theft, or defamation resulting from a cyber incident.
Consider the following statements: A digital signature is
- an electronic record that identifies the certifying authority issuing it
- used to serve as a proof of identity of an individual to access information or server on Internet
- an electronic method of signing an electronic document and ensuring that the original content is unchanged
Which of the statements given above is/are correct?
Detailed Explanation:
Answer: Option 3 — 3 only
A digital signature is a cryptographic mechanism used to authenticate the identity of the sender and ensure that the content of an electronic document has not been altered after signing. Only statement 3 correctly captures this fundamental purpose.
❌ Statement 1 – Incorrect: A digital signature does not identify the certifying authority; instead, it uses a digital certificate issued by a Certificate Authority (CA) to verify the signer's identity, but the signature itself is created by the signer's private key.
❌ Statement 2 – Incorrect: Digital signatures are primarily used for ensuring document integrity and authenticity, not for accessing information or servers on the Internet; access control typically relies on usernames, passwords, tokens, or biometric authentication.
✅ Statement 3 – Correct: A digital signature is indeed an electronic method of signing documents that ensures non-repudiation and integrity by creating a unique cryptographic hash that detects any changes to the original content.
📝 Short Notes: Digital Signatures
- Definition: A digital signature is a cryptographic technique that validates the authenticity and integrity of electronic messages, documents, or software.
- Technology: Based on Public Key Infrastructure (PKI) using asymmetric cryptography—a private key to sign and a public key to verify.
- Key Functions: Authentication (verifies sender identity), Integrity (detects alterations), and Non-repudiation (sender cannot deny signing).
- Process: A hash of the document is created and encrypted with the signer's private key; recipients decrypt it with the public key to verify authenticity.
- Legal Status in India: Digital signatures are legally recognized under the Information Technology Act, 2000, and have the same validity as handwritten signatures.
- Certificate Authority (CA): Trusted third parties (like NIC, eMudhra) issue digital certificates that bind a public key to an individual or organization.
- Common Uses: E-filing of tax returns, online banking, e-governance services, legal documents, and software distribution.
🧐 Not Sure What to Study Next?
Get a personalised study plan based on your goals, time and revision needs.
The terms ‘Wanna Cry, Petya and Eternal Blue' sometimes mentioned in the news recently are related to
Detailed Explanation:
The correct answer is Cyberattacks (Option 3). WannaCry and Petya are ransomware attacks that encrypt data and demand payment. EternalBlue is a cyber exploit that was used to spread the WannaCry attack by exploiting a Microsoft Windows vulnerability.
Ransomware is a type of malware that locks or encrypts a user's data and demands a ransom for restoring access. Major cyberattacks like WannaCry (2017) highlighted the importance of regular software updates and strong cybersecurity practices.
In India, it is legally mandatory for which of the following to report on cybersecurity incidents?
- Service providers
- Data centres
- Body corporate
Select the correct answer using the code given below:
Detailed Explanation:
Answer: Option 4 — 1, 2 and 3
✅ Statement 1 – Correct: Service providers are legally mandated to report cybersecurity incidents to CERT-In (Indian Computer Emergency Response Team) under Section 70B of the Information Technology Act, 2000, and the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013.
✅ Statement 2 – Correct: Data centres are explicitly listed among the entities required to mandatorily report cybersecurity incidents to CERT-In under the IT (CERT-In) Rules, 2013. This includes incidents like data breaches, unauthorized access, and system compromises within six hours of noticing or being brought to notice.
✅ Statement 3 – Correct: Body corporates (companies and organizations) are required to report specified cybersecurity incidents to CERT-In under the IT Act, 2000, and associated rules. This obligation ensures timely response to cyber threats affecting business operations and sensitive data.