· Each answer must include at least one citation of an authoritative source. A single Reference List should be included at the end of the exam.

· Each answer must include at least one citation of an authoritative source. A single Reference List should be included at the end of the exam.

· There are six (6) questions. Choose 5 to answer. Each response is worth 20 points. Each response is limited to 300 words. Points may be deducted for exceeding the word limit. The following criteria will be used for grading: relevance and correctness, completeness, clarity and logical flow, spelling, grammar, and proper citations/Reference List.

· Be sure to “sign” and include the Certification statement.

· If you have a question about the exam, contact me by email (mary.carroll@faculty.umgc.edu).

EXAM QUESTIONS:

1. Bring Your Own Device (BYOD) and Acceptable Use

BYOD means that devices employees own are being used for work. Discuss how an organization can/should manage the use of personal devices. What are the most important restrictions the organization can impose? Why are these limits important? How can they be established and enforced?

2. The Privacy Act and Data Brokers

The Privacy Act controls the federal government protection of certain data in its systems of records. Explain how or if that Act applies to data the government accesses from commercial data brokers. Are there any restrictions on government use of commercial data broker data?

3. Ransomware and Data Integrity

Government agencies are warning hospitals and health care providers of the imminent cybercrime threat of ransomware. Ransomware attacks present challenges to data integrity. What key actions could/should an organization do before ransomware attacks? Why?

4. Encryption and Law Enforcement

Explain the conflict between law enforcement and end-to-end encryption. What is the current status?

5. Computer Fraud and Abuse Act (CFAA)

This key cybersecurity law makes it a federal crime to intentionally access a computer without authorization or exceeding authorized access. Explain the issue(s) presented by the CFAA term, “authorization,” using an example(s), and how it could be improved/corrected.

6. Section 230 of the Communications Decency Act

What was the purpose of this section when enacted? What is the main issue now? Please explain.