Why was India’s Information Technology Act, 2000 introduced?
A Legal recognition of e-records
B Cybercrime-only legislation
C Telecom licensing framework
D Online tax collection system
Answer: A. Legal recognition of e-records. The Act gives legal recognition to electronic records and signatures and supports electronic commerce and e-governance.
Which provision recognizes electronic records under the IT Act?
A Section 6
B Section 4
C Section 43
D Section 79
Answer: B. Section 4. Section 4 provides legal recognition to electronic records when statutory conditions are met.
Government agencies using electronic records and filing are addressed by which IT Act provision?
A Section 4
B Section 66C
C Section 6
D Section 70B
Answer: C. Section 6. Section 6 enables the use and acceptance of electronic records and electronic signatures by government and its agencies.
Digital signatures under the IT Act rely on which cryptographic combination?
A Shared password and PIN
B Symmetric encryption alone
C Biometric scan and checksum
D Asymmetric crypto with hash
Answer: D. Asymmetric crypto with hash. The Act defines a digital signature through an asymmetric crypto system together with a hash function.
Who issues a Digital Signature Certificate under the IT Act framework?
A Licensed Certifying Authority
B CERT-In incident team
C Data Protection Board
D Local police station
Answer: A. Licensed Certifying Authority. A licensed Certifying Authority issues Digital Signature Certificates under the statutory framework.
Which responsibility belongs to the Controller of Certifying Authorities?
A Investigating every cybercrime
B Licensing and supervising CAs
C Issuing court warrants
D Operating public websites
Answer: B. Licensing and supervising CAs. The Controller licenses and supervises Certifying Authorities and performs the functions assigned by the Act.
Someone accesses a computer without permission and copies data. Which provision may support compensation for such acts?
A Section 4
B Section 67A
C Section 43
D Section 79
Answer: C. Section 43. Section 43 covers specified unauthorized acts involving computer resources and provides for compensation to the affected person.
Dishonest or fraudulent acts listed under Section 43 can become a computer-related offence under which provision?
A Section 65
B Section 70A
C Section 72
D Section 66
Answer: D. Section 66. Section 66 applies when an act referred to in Section 43 is done dishonestly or fraudulently.
Using another person’s password or unique identification feature can amount to which IT Act offence?
A Section 66C identity theft
B Section 66D personation
C Section 67A publication
D Section 72 disclosure
Answer: A. Section 66C identity theft. Section 66C addresses fraudulent or dishonest use of another person’s electronic signature, password, or unique identification feature.
Bank impersonation used to cheat someone online most directly engages which IT Act section?
A Section 66E
B Section 66D
C Section 67C
D Section 70
Answer: B. Section 66D. Section 66D addresses cheating by personation using a communication device or computer resource.
Capturing or publishing a private-area image without consent in privacy-violating circumstances is addressed by which section?
A Section 66B
B Section 67
C Section 66E
D Section 72A
Answer: C. Section 66E. Section 66E concerns intentional or knowing capture, publication, or transmission of a private-area image without consent in circumstances violating privacy.
Which intent is central to cyber terrorism under Section 66F?
A Avoid paying a subscription
B Bypass routine login checks
C Promote a commercial product
D Threaten sovereignty or security
Answer: D. Threaten sovereignty or security. Section 66F concerns specified unauthorized access or interference carried out with intent to threaten India’s unity, integrity, security, or sovereignty, or to strike terror.
Publishing or transmitting obscene material electronically is covered by which IT Act section?
A Section 67
B Section 67A
C Section 66C
D Section 70B
Answer: A. Section 67. Section 67 addresses publishing or transmitting obscene material in electronic form.
Which provision addresses electronic material containing sexually explicit acts or conduct?
A Section 67
B Section 67A
C Section 67C
D Section 72
Answer: B. Section 67A. Section 67A addresses publishing or transmitting material containing sexually explicit acts or conduct in electronic form.
Material depicting children in sexually explicit acts is specifically addressed by which provision?
A Section 66D
B Section 67A
C Section 67B
D Section 69A
Answer: C. Section 67B. Section 67B addresses electronic material and specified conduct involving children in sexually explicit acts or conduct.
Which section may apply when an official discloses electronic records without consent after gaining access under Act powers?
A Section 43
B Section 66F
C Section 79
D Section 72
Answer: D. Section 72. Section 72 addresses breach of confidentiality and privacy by a person who obtained access under powers conferred by the Act and then discloses the material without consent, subject to the law.
When personal information obtained under a lawful contract is disclosed to cause wrongful gain or loss, which provision is relevant?
A Section 72A
B Section 72
C Section 66B
D Section 70A
Answer: A. Section 72A. Section 72A concerns disclosure of personal information in breach of a lawful contract with intent or knowledge of likely wrongful loss or gain.
Which provision authorizes public-access blocking directions on specified statutory grounds?
A Section 66C
B Section 69A
C Section 70B
D Section 79
Answer: B. Section 69A. Section 69A provides the Central Government or a specially authorized officer power to direct blocking for the grounds specified in the Act, subject to prescribed safeguards.
What protected status can Section 70 confer on a specified computer resource?
A Section 67
B Section 69A
C Section 70
D Section 72A
Answer: C. Section 70. Section 70 provides for declaring specified computer resources, including critical information infrastructure, as protected systems.
Section 70A concerns the national nodal agency for protecting what?
A Consumer complaint portals
B Digital signature certificates
C Online content ratings
D Critical information infrastructure
Answer: D. Critical information infrastructure. Section 70A provides for a national nodal agency concerning protection of Critical Information Infrastructure.
Which body is the national agency for cyber incident response under Section 70B?
A CERT-In
B The Election Commission
C The Data Protection Board
D The Telecom Regulatory Authority
Answer: A. CERT-In. Section 70B identifies the Indian Computer Emergency Response Team, or CERT-In, as the national agency for cyber security functions.
How does Section 79 generally protect an eligible intermediary?
A Complete immunity from law
B Conditional safe-harbour protection
C Automatic ownership of content
D Exemption from court orders
Answer: B. Conditional safe-harbour protection. Section 79 offers conditional protection regarding third-party information when statutory conditions and due-diligence requirements are met; it is not blanket immunity.
Under the IT Act, an intermediary generally handles what in relation to another person?
A Only its own publications
B Only government databases
C Third-party electronic information
D Only signed court records
Answer: C. Third-party electronic information. An intermediary receives, stores, or transmits an electronic record on behalf of another person, or provides related services.
Which action is important for maintaining an intermediary’s Section 79 protection?
A Ignore lawful directions
B Select every user message
C Rewrite third-party records
D Meet prescribed due diligence
Answer: D. Meet prescribed due diligence. Intermediaries must satisfy applicable statutory conditions and observe prescribed due diligence to claim Section 79 protection.
Under the current IT Rules, how must permitted synthetically generated information be identified when the rule applies?
A Prominent label and metadata
B Unmarked audio only
C Private watermark alone
D User profile disclosure
Answer: A. Prominent label and metadata. Rule 3(3)(a)(ii) requires covered synthetically generated information not prohibited under sub-clause (i) to carry a prominent label or audio disclosure and permanent metadata or another provenance mechanism, to the extent technically feasible.
Under the current IT Rules, who must publish the Grievance Officer’s name and contact details?
A Every individual user
B The intermediary
C Only the complainant
D The local court
Answer: B. The intermediary. The IT Rules require an intermediary to prominently publish its Grievance Officer’s name, contact details, and complaint mechanism.
Within what period must an intermediary acknowledge an ordinary user grievance under the current IT Rules?
A Three working days
B Seven calendar days
C Twenty-four hours
D Thirty days
Answer: C. Twenty-four hours. The current consolidated IT Rules require an intermediary to acknowledge a grievance within twenty-four hours.
Under the current IT Rules, which deadlines apply to ordinary grievances and specified removal requests under Rule 3(2)(a)?
A Twenty-four hours; seven days
B Fifteen days; seventy-two hours
C Thirty days; three hours
D Seven days; thirty-six hours
Answer: D. Seven days; thirty-six hours. The current Rule 3(2)(a) generally requires resolution within seven days, while specified content-removal grievances under its proviso must be resolved within thirty-six hours.
Under Rule 3(2)(b), what response period applies to complaints about private-area, nudity, sexual-conduct, or impersonation content?
A Within two hours
B Within twenty-four hours
C Within thirty-six hours
D Within seven days
Answer: A. Within two hours. For covered complaints under Rule 3(2)(b), the intermediary must take reasonable and practicable measures to remove or disable access within two hours.
When actual knowledge arises from a competent court order or qualifying reasoned government intimation, how soon must an intermediary act under Rule 3(1)(d)?
A Within two hours
B Within three hours
C Within thirty-six hours
D Within seventy-two hours
Answer: B. Within three hours. The consolidated Rule 3(1)(d), effective from 15 November 2025, sets a three-hour period for removal or disabling access after the specified actual knowledge.
Within what period may an aggrieved person appeal a Grievance Officer’s decision to the Grievance Appellate Committee?
A Seven days
B Fourteen days
C Thirty days
D Ninety days
Answer: C. Thirty days. The IT Rules allow the aggrieved person to appeal to the Grievance Appellate Committee within thirty days of the specified communication.
What kind of commencement schedule do the Digital Personal Data Protection Rules, 2025 establish?
A All rules start immediately
B Only annual commencement dates
C No commencement schedule
D Staggered commencement dates
Answer: D. Staggered commencement dates. The Rules specify different commencement dates: some provisions start on publication, Rule 4 after one year, and other specified rules after eighteen months.
Under the DPDP Act, who is called a Data Principal?
A Individual whose data relates
B Entity deciding processing purposes
C Government-appointed auditor
D Online grievance officer
Answer: A. Individual whose data relates. A Data Principal is the individual to whom the personal data relates.
Which description best matches a Data Fiduciary under the DPDP Act?
A Only stores encrypted backups
B Decides purpose and means
C Reviews court evidence
D Issues digital certificates
Answer: B. Decides purpose and means. A Data Fiduciary determines the purpose and means of processing personal data, alone or together with others.
How does the DPDP Act define a child?
A Person under sixteen
B Person under fourteen
C Person under eighteen
D Person under twenty-one
Answer: C. Person under eighteen. The DPDP Act defines a child as an individual who has not completed eighteen years of age.
What must clearly demonstrate a Data Principal’s consent under the DPDP Act?
A Silence after a notice
B Preselected optional boxes
C Continued website browsing
D Clear affirmative action
Answer: D. Clear affirmative action. Consent under the Act must involve a clear affirmative action and satisfy the statutory standards of being free, specific, informed, unconditional, and unambiguous.
Which action is expressly listed as a Data Principal right under the DPDP Act?
A Correction of personal data
B Demanding unlimited retention
C Blocking every lawful audit
D Choosing another person’s purpose
Answer: A. Correction of personal data. The Act includes the right to correction and erasure of personal data, subject to the Act’s provisions.
Which statute replaced the Indian Evidence Act, 1872 and includes current electronic-record evidence provisions?
A Bharatiya Nyaya Sanhita
B Bharatiya Sakshya Adhiniyam
C Bharatiya Nagarik Suraksha Sanhita
D Information Technology Rules
Answer: B. Bharatiya Sakshya Adhiniyam. The Bharatiya Sakshya Adhiniyam, 2023 replaced the Indian Evidence Act, 1872 and includes provisions on electronic records.
What does Section 63 of the Bharatiya Sakshya Adhiniyam address?
A Intermediary safe harbour
B Cyber incident reporting
C Electronic-record admissibility
D Digital certificate licensing
Answer: C. Electronic-record admissibility. Section 63 sets conditions for admissibility of computer outputs and electronic records in evidence.
When an electronic record is tendered under Section 63, what must accompany it in each instance of submission for admission?
A A software licence
B A police complaint
C A printed network map
D A prescribed certificate
Answer: D. A prescribed certificate. Section 63(4) requires a certificate with the electronic record each time it is submitted for admission, with the specified particulars and signatures.
Under Section 61 of the Bharatiya Sakshya Adhiniyam, electronic-record admissibility remains subject to which provision?
A Section 63
B Section 43
C Section 69A
D Section 79
Answer: A. Section 63. Section 61 recognizes electronic or digital records as having legal effect, validity, and enforceability as other documents, subject to Section 63.
During a forensic review, what is a cryptographic hash mainly used to check?
A User identity alone
B Data integrity
C Network speed
D Legal ownership
Answer: B. Data integrity. Matching hash values can help establish that a digital file has not changed between checks; context and proper forensic procedures still matter.
What does a digital-evidence chain of custody document?
A A suspect’s browsing history
B A website privacy policy
C Evidence handling history
D A computer’s warranty
Answer: C. Evidence handling history. A chain-of-custody record tracks who collected, handled, transferred, and stored evidence and when.
Under CERT-In’s 2022 Directions, covered cyber incidents must generally be reported within what time after notice?
A Within one day
B Within seven days
C Within one month
D Within six hours
Answer: D. Within six hours. CERT-In’s published FAQ states that covered cyber incidents must be reported within six hours of noticing the incident or being brought to notice.
If an organization lacks every incident detail by the CERT-In reporting deadline, what should it do?
A Submit available details first
B Wait for a full report
C Delete incomplete evidence
D Report only after recovery
Answer: A. Submit available details first. CERT-In’s FAQ says entities may provide the information available at the time and submit additional information later within a reasonable time.
For how long must covered entities securely maintain ICT-system logs under CERT-In’s 2022 Directions?
A Rolling 30 days
B Rolling 180 days
C Rolling 90 days
D Rolling two years
Answer: B. Rolling 180 days. The Directions require covered entities to enable ICT-system logs and securely maintain them for a rolling period of 180 days within Indian jurisdiction.
Which function is assigned to CERT-In under Section 70B?
A Decide criminal guilt
B Issue civil court decrees
C Coordinate incident response
D License every internet user
Answer: C. Coordinate incident response. CERT-In’s statutory functions include coordinating cyber incident response, issuing alerts and advisories, and supporting incident handling.
What should covered organizations designate to communicate with CERT-In?
A A public social account
B A private complainant
C A payment intermediary
D A CERT-In point of contact
Answer: D. A CERT-In point of contact. The 2022 Directions require covered entities to designate a Point of Contact to interface with CERT-In.
When can the IT Act apply to an offence committed outside India under Section 75?
A Indian computer resource involved
B Foreign website has Indian users
C Victim travels abroad
D Payment uses foreign currency
Answer: A. Indian computer resource involved. Section 75 extends the Act to specified conduct outside India when the act or conduct involves a computer, computer system, or network located in India.
After detecting ransomware on a work device, which immediate step can help contain spread while preserving useful evidence?
A Wipe every device
B Isolate affected systems
C Publish credentials online
D Disable all log retention
Answer: B. Isolate affected systems. Isolating affected systems can limit further spread. Preserve relevant logs and evidence, follow the incident-response plan, and report as legally required.