A company gathers personal data about people, mostly from public records, and sells or licenses it to third parties. What is such a company called?Wikipedia, "Data broker". DSST outline area I (21%), e. Corporate uses of personal data
A person in the European Union asks a social network to delete the personal data it holds on them. Which right in the GDPR are they using?General Data Protection Regulation, Article 17. DSST outline area I (21%), c. Sharing with online communities and social networking services
A retailer collects only the personal data it needs for a stated purpose and nothing more. Which GDPR principle is it following?General Data Protection Regulation, Article 5. DSST outline area I (21%), e. Corporate uses of personal data
A web server gives a visitor's browser a small piece of state information to store and send back on later visits. What is it called?NIST Computer Security Resource Center glossary, "cookie". DSST outline area I (21%), a. Privacy and security in cyberspace
Show all 61 questions (57 more)
Cyberspace and privacy, continued
An intruder reads a company's customer records but changes nothing and blocks no one. Which security property has been breached?NIST Computer Security Resource Center glossary, "confidentiality". DSST outline area I (21%), a. Privacy and security in cyberspace
In an 1890 essay that opened the modern debate on privacy law, Samuel Warren and Louis Brandeis summed up the right to privacy as what?Stanford Encyclopedia of Philosophy, "Privacy". DSST outline area I (21%), a. Privacy and security in cyberspace
In Carpenter v. United States (2018), what did the Supreme Court decide about the location records that a phone company keeps from its cell towers?Carpenter v. United States (2018), at Cornell Legal Information Institute. DSST outline area I (21%), d. Government surveillance
In Katz v. United States (1967), FBI agents recorded a man's calls with a device fixed to the outside of a public telephone booth. What did the Court say?Katz v. United States, 389 U.S. 347 (1967), at Cornell Legal Information Institute. DSST outline area I (21%), d. Government surveillance
People often write things online that they would never say face to face, partly because they can stay anonymous. What is this called?Wikipedia, "Online disinhibition effect". DSST outline area I (21%), b. Individual conduct in cyberspace
People say they care about privacy, yet they disclose personal details freely on social networks. What is this gap between attitude and behavior called?Stanford Encyclopedia of Philosophy, "Privacy and Information Technology". DSST outline area I (21%), c. Sharing with online communities and social networking services
"The right of the people to be secure in their persons, houses, papers, and effects" opens which amendment, the starting point for limits on government surveillance?National Archives, "The Bill of Rights: A Transcription". DSST outline area I (21%), d. Government surveillance
Someone posts a stranger's home address and phone number online, without consent, so that others will harass the person. What is this act called?Wikipedia, "Doxing". DSST outline area I (21%), b. Individual conduct in cyberspace
Under the California Consumer Privacy Act, what may a consumer tell a business that sells personal information?California Department of Justice, "California Consumer Privacy Act (CCPA)". DSST outline area I (21%), e. Corporate uses of personal data
Domestic and international security 13
A company hires assessors to try, under agreed constraints, to defeat the security features of its own systems. What is this called?NIST Computer Security Resource Center glossary, "penetration testing". DSST outline area II (21%), c. Hacking and counter-hacking
A defender sets up a server that looks valuable but exists only to draw intruders in. What is such a decoy called?NIST Computer Security Resource Center glossary, "honeypot". DSST outline area II (21%), c. Hacking and counter-hacking
A group defaces a ministry's website to protest a policy. Hacking used as civil disobedience to push a political agenda is called what?Wikipedia, "Hacktivism". DSST outline area II (21%), c. Hacking and counter-hacking
Beginning in April 2007, attacks hit the websites of Estonia's parliament, banks, ministries and newspapers. Which kind of attack had the most effect on the public?Wikipedia, "2007 cyberattacks on Estonia". DSST outline area II (21%), d. Information warfare
By a common definition, what separates cyberterrorism from other attacks on computers?Wikipedia, "Cyberterrorism". DSST outline area II (21%), e. Cyberterrorism
The federal Wiretap Act of 1968 covered conversations on telephone lines. Which 1986 law updated it to protect email and data stored electronically?Bureau of Justice Assistance, "Electronic Communications Privacy Act of 1986 (ECPA)". DSST outline area II (21%), a. Domestic and international regulations
The Foreign Intelligence Surveillance Act of 1978 set up a special body to oversee requests for surveillance warrants. What is it?Wikipedia, "Foreign Intelligence Surveillance Act". DSST outline area II (21%), b. Collection and use of personal data: national security
Stuxnet, a computer worm uncovered in 2010, is a landmark in information warfare. What set it apart?Wikipedia, "Stuxnet". DSST outline area II (21%), d. Information warfare
U.S. policy names 16 sectors, among them energy, water and communications, whose loss would have a debilitating effect on the country. What are they called?Cybersecurity and Infrastructure Security Agency, "Critical Infrastructure Sectors". DSST outline area II (21%), e. Cyberterrorism
The USA FREEDOM Act of 2015 changed how the National Security Agency handles Americans' phone records. What changed?Wikipedia, "Patriot Act". DSST outline area II (21%), b. Collection and use of personal data: national security
Which 2001 treaty, drawn up by the Council of Europe, was the first international treaty to address Internet and computer crime?Wikipedia, "Budapest Convention on Cybercrime". DSST outline area II (21%), a. Domestic and international regulations
Which federal statute defines computer fraud as accessing a protected computer without authorization or exceeding authorization?Cornell Legal Information Institute, Wex, "computer and internet fraud". DSST outline area II (21%), a. Domestic and international regulations
Which law, passed on October 26, 2001, soon after the September 11 attacks, widened law enforcement and intelligence authorities?Cornell Legal Information Institute, Wex, "USA PATRIOT Act". DSST outline area II (21%), b. Collection and use of personal data: national security
Legal issues in cyberspace 13
A 17-year-old enrolls at a community college. Under FERPA, who now holds the rights over that student's education records?U.S. Department of Education, Protecting Student Privacy, "What is FERPA?". DSST outline area III (21%), b. Privacy legislation and industry self-regulation
A message dressed up as a bank's notice asks the reader to type an account number into a linked page. Which technique is this?NIST Computer Security Resource Center glossary, "phishing". DSST outline area III (21%), e. Cybercrimes
A privately owned social network deletes a user's post. Why is that generally not a violation of the First Amendment?Cornell Legal Information Institute, Wex, "state action requirement". DSST outline area III (21%), a. Free speech issues
A programmer invents a new method of sorting data and writes a program that uses it. What does copyright in the program leave unprotected?U.S. Copyright Office, "What Does Copyright Protect?". DSST outline area III (21%), c. Intellectual property
A startup wants to protect the name and logo that identify its app. Which form of intellectual property fits?U.S. Patent and Trademark Office, "Trademark, patent, or copyright". DSST outline area III (21%), c. Intellectual property
A user posts a false statement about a neighbor on a large online forum. Under 47 U.S.C. 230, how is the forum's operator treated?47 U.S.C. 230, at Cornell Legal Information Institute. DSST outline area III (21%), a. Free speech issues
The Children's Online Privacy Protection Act makes a website get verifiable parental consent before it collects personal information from a child. How does the act define a child?15 U.S.C. 6501, at Cornell Legal Information Institute. DSST outline area III (21%), b. Privacy legislation and industry self-regulation
The Clipper chip, promoted by the U.S. government from 1993, encrypted voice and data messages. Why was it controversial?Wikipedia, "Clipper chip". DSST outline area III (21%), d. Lawful access and encryption
In Reno v. ACLU (1997) the Supreme Court reviewed the Communications Decency Act's bans on "indecent" and "patently offensive" material online. What did it hold?Reno v. American Civil Liberties Union, 521 U.S. 844 (1997), at Cornell Legal Information Institute. DSST outline area III (21%), a. Free speech issues
Malware encrypts the files on a city's computers, and the attackers demand payment before they will decrypt them. What is this called?Cybersecurity and Infrastructure Security Agency, "Ransomware 101". DSST outline area III (21%), e. Cybercrimes
Under the Stored Communications Act, part of the ECPA, what legal process does the government need to obtain information from a service provider?Bureau of Justice Assistance, "Electronic Communications Privacy Act of 1986 (ECPA)". DSST outline area III (21%), d. Lawful access and encryption
What does the notice-and-takedown system of the Digital Millennium Copyright Act let a copyright owner do?U.S. Copyright Office, "The Digital Millennium Copyright Act". DSST outline area III (21%), c. Intellectual property
Which of these is one of the four factors that Section 107 of the Copyright Act lists for judging fair use?U.S. Copyright Office, "Fair Use". DSST outline area III (21%), c. Intellectual property
Technological innovation and ethics 10
A screening program trained on a company's past hiring decisions gives lower scores to applicants from one group, again and again. What is this called?Wikipedia, "Algorithmic bias". DSST outline area IV (17%), c. Robotics and artificial intelligence
The Genetic Information Nondiscrimination Act of 2008 bars discrimination based on genetic information in which two areas?National Human Genome Research Institute, "Genetic Discrimination". DSST outline area IV (17%), a. Biotechnologies
In 2016 the Mirai malware took over hundreds of thousands of Internet of Things devices and used them in denial-of-service attacks. What weakness did it use?Cybersecurity and Infrastructure Security Agency, alert "Heightened DDoS Threat Posed by Mirai and Other Botnets". DSST outline area IV (17%), b. Internet of Things
In Isaac Asimov's Three Laws of Robotics, what does the First Law say?Wikipedia, "Three Laws of Robotics". DSST outline area IV (17%), c. Robotics and artificial intelligence
SAE International's scale of driving automation runs from 0 to 5. What does Level 5 stand for?Wikipedia, "Self-driving car". DSST outline area IV (17%), d. Autonomous vehicles
Students in low-income homes often lack reliable internet and digital devices. What is this inequity in access to digital technology called?Wikipedia, "Digital divide". DSST outline area IV (17%), e. Social justice issues
What does Section 508 of the Rehabilitation Act require of federal agencies?Section508.gov, "IT Accessibility Laws and Policies". DSST outline area IV (17%), e. Social justice issues
Which term names the network of devices, such as sensors, controllers and household appliances, that connect and exchange data over the internet?NIST Computer Security Resource Center glossary, "internet of things". DSST outline area IV (17%), b. Internet of Things
Which thought experiment is most often used to discuss how a self-driving car should choose between two harms it cannot avoid?Stanford Encyclopedia of Philosophy, "Ethics of Artificial Intelligence and Robotics". DSST outline area IV (17%), d. Autonomous vehicles
Why does most of the ethical debate about human genome editing center on the germline?National Human Genome Research Institute, "What are the Ethical Concerns of Genome Editing?". DSST outline area IV (17%), a. Biotechnologies
Professional ethics 12
A company discovers that its customers' personal data has been stolen. What does Article 33 of the GDPR require it to do?General Data Protection Regulation, Article 33. DSST outline area V (20%), a. Moral obligations, legal liability and accountability of corporations
A defective product injures its buyer. Under strict products liability, what must the buyer prove about the maker's state of mind?Cornell Legal Information Institute, Wex, "strict liability". DSST outline area V (20%), a. Moral obligations, legal liability and accountability of corporations
A feed shows each user mostly posts that match what the user has already clicked on. What is the resulting state of intellectual isolation called?Wikipedia, "Filter bubble". DSST outline area V (20%), d. Social media: positive reinforcement and dissemination of unfounded information
An engineer learns that her employer's software endangers its users, and managers refuse to act. An employee who reports such wrongdoing to regulators or the media is called what?Cornell Legal Information Institute, Wex, "whistleblower". DSST outline area V (20%), b. Moral responsibilities of IT professionals
An Internet service provider deliberately slows the traffic of one video service. What is this practice called in the net neutrality debate?Cornell Legal Information Institute, Wex, "net neutrality". DSST outline area V (20%), e. Net neutrality
Critics warn that social networking services encourage "echo chambers". What is the worry?Stanford Encyclopedia of Philosophy, "Social Networking and Ethics". DSST outline area V (20%), d. Social media: positive reinforcement and dissemination of unfounded information
In June 2013 news organizations published classified memos leaked by Edward Snowden. What did the published memos describe?Wikipedia, "USA Freedom Act". DSST outline area V (20%), c. The role of the press
In New York Times v. United States (1971) the government asked the courts to stop two newspapers from publishing classified documents. What is such an order against publication called?Cornell Legal Information Institute, Wex, "prior restraint". DSST outline area V (20%), c. The role of the press
In the net neutrality debate, why does it matter whether broadband is classified under Title II of the Communications Act?Cornell Legal Information Institute, Wex, "net neutrality". DSST outline area V (20%), e. Net neutrality
The Software Engineering Code of Ethics lists eight principles. What does the first, headed PUBLIC, require?IEEE Computer Society, "Software Engineering Code of Ethics". DSST outline area V (20%), b. Moral responsibilities of IT professionals
The Therac-25 accidents of 1985 to 1987 are a standard case study in computer ethics. What went wrong?Wikipedia, "Therac-25". DSST outline area V (20%), b. Moral responsibilities of IT professionals
Which theory of business ethics has managers account for employees, suppliers, local communities and creditors, and not only for owners?Wikipedia, "Stakeholder theory". DSST outline area V (20%), a. Moral obligations, legal liability and accountability of corporations
How this list was compiled: Our own questions, written to the exam content outline in the DSST fact sheet for Ethics in Technology (Prometric, Rev 06/2018, https://getcollegecredit.com/wp-content/uploads/2022/09/EthicsInTechnology.pdf, read 2026-10-13): Cyberspace and Privacy 21%, Domestic and International Security 21%, Legal Issues in Cyberspace 21%, Technological Innovation and Ethics 17%, Professional Ethics 20%. This bank holds 61: 13, 13, 13, 10 and 12, the same shares to the nearest question. Every fact was read on 2026-10-13 on the public page named under its question: the U.S. Code and Supreme Court opinions at Cornell's Legal Information Institute and its Wex encyclopedia, the NIST glossary, CISA, the U.S. Copyright Office, the USPTO, the National Human Genome Research Institute, the text of the GDPR, the Stanford Encyclopedia of Philosophy and Wikipedia. Licence: Questions, choices and explanations are original work of this site.
How it works
This DSST Ethics in Technology practice test has 61 questions of our own across the fact sheet's five areas. It is unofficial and not affiliated with, endorsed by or sponsored by Prometric, the owner of the DSST exams.
Read the full guide
What the exam covers
The fact sheet (Rev 06/2018) lists five areas: cyberspace and privacy 21%, domestic and international security 21%, legal issues in cyberspace 21%, technological innovation and ethics 17%, and professional ethics 20%. The bank holds 13, 13, 13, 10 and 12.
Laws and cases behind the outline
The outline names topics, not statutes. The questions use the law each topic rests on: the Fourth Amendment with Katz and Carpenter, the ECPA, FISA and the Patriot Act, Section 230 and Reno v. ACLU, COPPA, FERPA, the DMCA, GINA and the GDPR. Each explanation links the text it was read in.
Ask who a rule binds. The First and Fourth Amendments restrain government; Section 230 and the DMCA's notice-and-takedown protect online services.
Pair each privacy law with its subject: COPPA with children under 13, FERPA with education records, GINA with genetic information.
Professional ethics, 20%, reaches past codes of conduct to the press, social media and net neutrality.
Questions and answers
How many questions are on the DSST Ethics in Technology exam?
The fact sheet says the exam has 100 questions and a 2 hour limit, and that some are unscored pretest questions. The timed exam on this page keeps that pace: 50 questions, 60 minutes.
What is a passing score on the DSST Ethics in Technology exam?
Prometric publishes no pass percent. Its fact sheet prints the American Council on Education's recommendation of 3 semester hours at the lower baccalaureate level for a minimum score of 400. Your college sets its own rule.
Are these questions from the real exam?
No. Each of the 61 was written here from a line of the outline and a public source. None comes from the exam or from the sample questions of the fact sheet, and a result on this page predicts nothing.