Question 1
The U.S. Vulnerabilities Equities Process (VEP) is best described as: A A statutory requirement under CFAA for companies to disclose discovered vulnerabilities within 90 days B A federal regulatory program administered by CISA requiring all critical infrastructure to disclose vulnerabilities C An interagency policy process (not a statutory requirement) for deciding whether the government should disclose discovered vulnerabilities to vendors or retain them for offensive/intelligence use D A criminal statute prohibiting the sale of zero-day vulnerabilities to foreign governments
Question 3
CISA Binding Operational Directive 20-01 requires what from federal civilian executive branch agencies? A Mandatory incident reporting within 72 hours of detecting a significant cybersecurity event B Development and publication of a Vulnerability Disclosure Policy (VDP) covering all internet-accessible systems C Implementation of multi-factor authentication on all federal systems within 60 days D Quarterly security audits and public disclosure of findings
Question 4
DOJ's 2022 CFAA charging policy announced that prosecutors should not charge which category of conduct? A All security research conducted by U.S. citizens B Any access to publicly available data, even without authorization C Good-faith security research conducted in a manner designed to avoid harm and used to promote security D Penetration testing conducted by federally licensed security firms
Question 5
OFAC's civil penalty standard for making a ransomware payment to a designated group is: A Specific intent — the victim must have knowingly paid a designated group to be liable B Negligence — the victim must have failed to take reasonable steps to identify the group C Strict liability — intent is not required; the payment itself is the violation D Recklessness — the victim must have disregarded a substantial and unjustifiable risk
Question 6
What is the primary cybersecurity concern about government-mandated "lawful access" mechanisms (sometimes called backdoors) in encryption systems, as identified by the security research community? A Backdoors increase the cost of encryption implementation for companies B Backdoors are technically incompatible with strong security — an access mechanism usable by law enforcement is also a vulnerability exploitable by adversaries C Backdoors would violate First Amendment rights D Backdoors would require Congressional authorization that has never been provided
Question 7
The Apple-UK Technical Capability Notice dispute (2025-2026) illustrates which tension in the encryption debate? A The conflict between U.S. and UK law enforcement agencies over jurisdiction B The collision between government investigatory powers (UK's IPA technical capability notices), platform security design, and global user impact — including disputes about secret legal orders that cannot be transparently challenged C Apple's refusal to cooperate with any government surveillance D A dispute about whether UK law applies to U.S. technology companies
Question 8
Under the CLOUD Act, U.S. service providers must comply with valid U.S. legal process for data stored abroad. The Act also creates what mechanism to reduce international legal conflicts? A A unified international warrant system replacing MLAT requests B Executive agreements between the U.S. and foreign governments allowing direct law enforcement access to data held by each other's providers — bypassing MLAT for covered request types C A mandatory 24-hour disclosure window for all cross-border evidence requests D A treaty requiring U.S. providers to store data locally in each country where they operate
Question 9
A security researcher discovers a critical vulnerability in a major bank's mobile app. The bank has no published VDP and has not authorized any security research. Under the post-Van Buren + DOJ good-faith research policy framework, what is the researcher's most legally protected course of action? A Immediately publish the vulnerability publicly to maximize the pressure on the bank to fix it B Sell the vulnerability to a government broker through legitimate channels C Contact the bank's security team directly with a clear disclosure, avoid accessing more of the system than needed to document the vulnerability, give reasonable time to remediate, and document everything — while acknowledging residual CFAA civil exposure exists absent formal authorization D Report the vulnerability directly to the FBI to protect against CFAA prosecution