A tech worker's computer acts abnormally shortly after the worker starts their shift. The computer is up-to-date on all relevant patches and updates. The installed antivirus software has not identified any malicious code. During the investigation, the worker discovers that an attacker compromised the system, even though the worker did not engage in any behavior that could have introduced a virus or other external malicious software into the computer.Which method of attack was used to compromise the worker's machine?
Answer(s): D
A zero-day exploit is a cyberattack that takes advantage of an unknown vulnerability in software, firmware, or hardware before a patch is available.Key characteristics of a zero-day exploit:The system was up-to-date on all patches and updates, meaning no known vulnerabilities should have been present.The antivirus did not detect any malicious code, which suggests that the attack exploited an unknown flaw.The worker did not engage in any behavior that introduced malware, ruling out traditional malware delivery methods.Since zero-day exploits target vulnerabilities that have not yet been discovered or fixed, the attack likely bypassed existing security defenses.Why Not the Other Options?A . Blended Threat: A combination of multiple attack methods (e.g., worms, Trojans, and phishing), but the scenario suggests a single point of failure.B . Trojan Horse: Requires the worker to unknowingly install malicious software, which was not the case here.C . Spear Phishing: Involves a targeted deceptive email, but there is no indication that the worker clicked on a fraudulent link or downloaded a malicious file.Thus, the correct answer is D. Zero-day exploit as it best explains the system compromise despite all security measures being up to date.Reference in Ethics in Technology:Schneier, B. (2015). Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World.Mitre ATT&CK Framework - Zero-day Exploits.OWASP Top Ten Security Risks (2023).
I A recruiter for a cybersecurity company is screening candidates for an engineering role by researching the candidates' public social media profiles. The recruiter notes content on one candidate's profile that automatically allows the recruiter to dismiss the candidate.Which type of content allows the recruiter to legally take this action?
Employers have the right to reject candidates based on public social media content that suggests illegal activity or violates company policies.Why is drug use a valid reason for dismissal?Illegal drug use may violate company policies and raise concerns about reliability, safety, and professionalism.Many industries, especially cybersecurity and government-related jobs, require security clearances, which prohibit drug use.(U.S. )employment laws allow employers to consider illegal drug use when making hiring decisions, provided they do not discriminate based on protected characteristics.Why Not the Other Options?A . Posts indicating pregnancy Pregnancy is a protected characteristic under Title VII of the Civil Rights Act (Pregnancy Discrimination Act) and cannot be used to reject a candidate.B . Self-identified gender Gender identity is protected under anti-discrimination laws (e.g., U.S.EEOC guidelines).C . Age discrepancy in photos Employers must avoid age discrimination under the Age Discrimination in Employment Act (ADEA).Thus, the correct answer is D. Photos depicting use of drugs, as it may legally justify disqualification based on company policies and workplace safety requirements.Reference in Ethics in Technology:(U.S. )Equal Employment Opportunity Commission (EEOC) Guidelines.(U.S. )Title VII of the Civil Rights Act (1964).Age Discrimination in Employment Act (ADEA) (1967).
A credit reporting agency collects personally identifiable information (Pll) from customers. The agency appoints a data protection officer (DPO), who is responsible for overseeing the agency's data protection strategy and enforcing data compliance requirements.Which legislation should the DPO use as the basis for governing the collection and disclosure of Pll?
Answer(s): C
The Gramm-Leach-Bliley Act (GLBA) governs the collection, protection, and disclosure of personally identifiable financial information (PII) by financial institutions, including credit reporting agencies.Why GLBA applies to this case:Credit reporting agencies handle sensitive consumer financial data, making them subject to GLBA regulations.The Financial Privacy Rule under GLBA dictates how financial institutions must collect and disclosePII.The Safeguards Rule requires companies to appoint a Data Protection Officer (DPO) to oversee data security practices.Why Not the Other Options?A . Securities Exchange Act Governs stock trading and financial disclosures, not PII protection.B . Sarbanes-Oxley Act (SOX) Focuses on corporate financial reporting and accounting fraud, not data privacy.D . Bank Secrecy Act (BSA) Primarily deals with money laundering and financial crime detection, not consumer data protection.Thus, the correct answer is C. Gramm-Leach-Bliley Act (GLBA) as it regulates the collection and protection of financial PII.Reference in Ethics in Technology:Gramm-Leach-Bliley Act (1999), 15 U.S.C. §§ 6801-6809.Federal Trade Commission (FTC) Guide on GLBA Compliance.Solove, D. J. (2020). The Privacy Law Fundamentals.
An underage actor is admitted to a local hospital. A nurse from another department wants to know what the patient's ailment is. The nurse accesses the patient's medical record and is subsequently flagged for unauthorized access.Which law has the nurse violated?
Answer(s): B
The Health Insurance Portability and Accountability Act (HIPAA) protects the privacy of patient health records and restricts unauthorized access to Protected Health Information (PHI).Why HIPAA applies to this case:The nurse accessed the patient's medical records without authorization, violating the HIPAA Privacy Rule.HIPAA mandates that only authorized healthcare professionals involved in patient care can access medical records.Unauthorized access is considered a HIPAA violation, which can result in penalties and disciplinary action.Why Not the Other Options?A . Electronic Communications Privacy Act (ECPA) Protects electronic communications from government surveillance but does not apply to medical records.C . Gramm-Leach-Bliley Act (GLBA) Regulates financial data privacy, not medical information.D . Children's Online Privacy Protection Act (COPPA) Protects children's data on websites and apps but does not cover hospital records.Thus, the correct answer is B. Health Insurance Portability and Accountability Act (HIPAA) as it enforces strict privacy rules for patient medical records.Reference in Ethics in Technology:Health Insurance Portability and Accountability Act (HIPAA) (1996), 45 CFR Parts 160 and 164.(U.S. )Department of Health & Human Services (HHS) HIPAA Guidelines.Solove, D. J. (2019). Understanding Privacy.
To gather data for improved customer profiles, a social media platform uses microphone data from its users in the United States. Which (U.S. )Constitulional amendment does this action violate?
The Fourth Amendment to the (U.S. )Constitution protects individuals from unreasonable searches and seizures by the government or entities acting in ways that violate privacy rights. When a social media platform collects microphone data without explicit consent, it potentially infringes on users' reasonable expectation of privacy, raising Fourth Amendment concerns.While the Fourth Amendment traditionally applies to government actions, legal debates have emerged over whether private companies collecting excessive personal data should be subject to similar scrutiny under privacy laws and regulations such as the Electronic Communications Privacy Act (ECPA) and the Stored Communications Act (SCA).Relevant Ethical Reference in Technology:Fourth Amendment & Digital Privacy (Carpenter v. United States, 2018) The (U.S. )Supreme Court ruled that warrantless collection of personal digital data can violate the Fourth Amendment.Ethical Data Collection & Consent (GDPR, CCPA) Using microphone data without user consent is ethically and legally questionable.Big Tech & Surveillance Ethics Ethical concerns arise when tech companies engage in excessive data collection without transparency.Deontological Ethics (Duty to Respect Privacy) Data collection should prioritize user rights over profit-driven surveillance.Thus, the correct answer is B. Fourth Amendment, as the company's actions raise concerns about unlawful data collection and digital privacy violations.
Post your Comments and Discuss WGU Ethics-In-Technology exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Ethics-In-Technology content, but please register or login to continue.