Cyber Security and Viruses PYQs – Computer, SSC & Railway

Answer: Option 2 — VPNs establish encrypted tunnels over public networks to secure data transmission, enable remote access, and mask users' IP addresses, but may pose risks such as data logging by VPN providers and vulnerabilities from weak encryption protocols.
A VPN is virtual — it runs an encrypted tunnel over the public internet, not a private leased line — and it is not a guarantee of anonymity.
The website sees the VPN server's IP, but the VPN provider can still see and log the user's traffic, and an outdated protocol can be broken.
Revision note — Virtual Private Networks
• A VPN client encrypts data before it leaves the device and sends it to a VPN server, which decrypts it and forwards it; this is called tunnelling.
• Two main uses: remote-access VPN (an employee reaching the office network from home) and site-to-site VPN (linking two office networks over the internet).
• Common protocols: OpenVPN, WireGuard, IPsec and IKEv2; the older PPTP is considered insecure and L2TP needs IPsec for encryption.
• Benefits: protection on public Wi-Fi, hiding the user's IP address and location, and bypassing geo-blocking; it does not stop malware or phishing.
• Risks: logging by the provider, DNS leaks, and free VPNs that sell browsing data.
• In April 2022 India's CERT-In directed VPN providers to keep user records for five years; several foreign providers withdrew their Indian servers in protest.
• CERT-In (Indian Computer Emergency Response Team, set up 2004) works under MeitY and is the national nodal agency for cyber incidents.
Do not mix these up
• VPN vs proxy server — a proxy only relays requests and usually does not encrypt them; a VPN encrypts all traffic from the device.
• VPN vs Tor — Tor bounces traffic through volunteer relays for anonymity; a VPN sends it through one provider's server, which must be trusted.

Answer: Option 1 – Behavioral monitoring and targeted advertising directed at children.
• Under the DPDP Act 2023 / 2025 Rules,behavioural tracking and targeted advertising aimed at childrenis explicitly prohibited.

Correct Answer: 2023 — Option (d)
The Ministry of Electronics and Information Technology (MeitY) unveiled draft rules on January 3, 2025 to implement the Digital Personal Data Protection (DPDP) Act, 2023. Key facts about the DPDP Act, 2023: Passage: The Digital Personal Data Protection Bill was passed by the Lok Sabha on August 7, 2023, and by the Rajya Sabha on August 9, 2023; Presidential assent: President Droupadi Murmu gave her assent on August 11, 2023, making it the Digital Personal Data Protection Act, 2023; Objective: To provide for the processing of digital personal data in a manner that protects individuals' right to the protection of their personal data while ensuring lawful processing; Key provisions: Rights of data principals (individuals), obligations of data fiduciaries (organizations processing data), establishment of the Data Protection Board of India, penalties for violations; Draft rules: On January 3, 2025, MeitY released the draft Digital Personal Data Protection Rules for public consultation to implement the DPDP Act, 2023; Significance: This is India's first comprehensive data protection law.
Option (a) 2001 — Incorrect: The IT Act, 2000 (Information Technology Act) was India's first cyber law, which was amended in 2008; there was no DPDP Act in 2001 — the Digital Personal Data Protection Act was enacted in 2023.
Option (b) 2011 — Incorrect: There was no Digital Personal Data Protection Act in 2011; in 2011, India introduced the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules under the IT Act, 2000 — not the DPDP Act.
Option (c) 2024 — Incorrect: While the draft rules were released in January 2025 and the year 2024 was close to the events, the DPDP Act was passed and enacted in 2023 (not 2024); MeitY released the draft rules on January 3, 2025 to implement the 2023 Act.

DPDP Act, 2023 - Parental Consent Provision
Key Point:Section 9 of the Digital Personal Data Protection Act, 2023
The Act mandatesverifiable parental consentbefore processing personal data of children (below 18 years).
Data Fiduciary's Obligation:
Must obtain consent from parent/legal guardian before collecting, storing, or processing child's data.
This protects children from unauthorized data usage and ensures parental control over their digital footprint.
Answer: Option 2 → To permit processing of a child's personal data by data fiduciaries

Topic: IT Laws & Child Safety
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Key provisions:
- Mandates intermediaries to remove unlawful content
- Special focus on child safety and harmful content
- Requires due diligence and grievance redressal
- Applies to social media platforms and digital intermediaries
Other options are non-existent laws as of December 2025.
Answer: Option 1 → Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021

MeitY (Ministry of Electronics and Information Technology) was the primary
ministry implementing online child safety initiatives.
Key Facts:
• IT (Intermediary Guidelines) Rules 2021 mandate removal of harmful content.
• POCSO Act 2012 covers child protection online and offline.
• NCPCR monitors child rights implementation across platforms.
Answer: Option 4 → Ministry of Electronics and Information Technology (MeitY)

Correct Answer: Option 3 – CSB does NOT mandate antivirus installation on all citizens' personal devices (INCORRECT statement)
The Cyber Surakshit Bharat (CSB) initiative was launched by the Ministry of Electronics and Information Technology (MeitY) in 2018. Its actual objectives:
• Building cybersecurity awareness among government officials, particularly Chief Information Security Officers (CISOs) and IT personnel.
• Capacity building through training workshops, bootcamps, and awareness programs.
• Promoting cybersecurity best practices within government ministries and departments.
• Helping secure government networks and digital infrastructure.
Statement in Option 3 is INCORRECT: CSB does NOT mandate the installation of specific government-approved antivirus software on all personal devices used by citizens. The program is focused on government officials and government networks — not on mandating software on citizens' personal devices.
Why other options are correct statements (and hence wrong answers to this question):
Option 1: Correct — CSB does focus on capacity building of government officials.
Option 2: Correct — CSB does aim to secure government networks.
Option 4: Correct — CSB is implemented under MeitY.

The correct answer is (b) Hyderabad.
The National Cyber Forensic Laboratory (Evidence) was inaugurated in Hyderabad in May 2022 to provide forensic support for cybercrime evidence across the country. The lab assists law enforcement agencies with scientific examination of digital evidence.
(a) Mumbai: Not the location of this specific laboratory.
(c) New Delhi: The Ministry of Home Affairs has cyber forensic capabilities in Delhi, but this specific NCFL (Evidence) was inaugurated in Hyderabad.
(d) Bengaluru: Not the location of this specific laboratory.

As of March 2025, Tamil Nadu was the state that had NOT established a Cyber Forensic-cum-Training Laboratory under the CCPWC scheme, unlike most other states that had already set up such labs.
(a) Incorrect: Kerala had established a CCPWC Cyber Forensic Lab under the scheme by this period.
(b) Incorrect: Rajasthan had established its CCPWC lab, making it part of the 30 covered states.
(c) Incorrect: Haryana had also established a lab under the CCPWC scheme.

Identity theft under the BNS 2023 covers acts where a person dishonestly uses another's personal data (Aadhaar, PAN, etc.) to create fake identities and commit fraud (Section 318 etc.).
The other options are not identity theft offences.