UPSC Prelims Practice Questions — Beyond Kudankulam’s fence, a cybersecurity challenge

Q1. With reference to the protection of cyber infrastructure under the Information Technology Act, 2000, consider the following statements: Which of the statements given above is/are correct?

  1. A computer resource gets the legal protection of a 'protected system' only after the appropriate government declares it to be one by notification; serving a sensitive sector is not enough by itself.
  2. The national nodal agency for protecting Critical Information Infrastructure is also the statutory body that issues binding directions on reporting cyber incidents across all sectors.
  3. Directions on reporting cyber incidents issued under the Act can bind data centres and other private service providers, as well as government organisations.
  • A. 1 and 3 only
  • B. 1 and 2 only
  • C. 1, 2 and 3
  • D. 2 and 3 only

Q2. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Under the Information Technology Act, 2000, a privately owned computer resource, such as one run by a bank or a telecom service provider, can be declared a protected system.
  2. The Information Technology Act, 2000 provides for a government organisation to be designated as the national nodal agency for protecting Critical Information Infrastructure.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q3. Consider the following assertion: Security measures built around a critical plant's own perimeter cannot, by themselves, protect that plant's sensitive data. Which of the statements given above support/supports the assertion?

  1. The 2026 Kudankulam files leaked from a server at an EPC contractor's third-party data centre, not from the plant's own systems.
  2. EPC contractors and their vendors lawfully hold design and inspection documents of the projects they build.
  3. In 2019, the plant's critical internal network was kept isolated from its internet-connected administrative network.
  4. The operator stated that the leaked material related to conventional Balance of Plant facilities rather than to nuclear safety systems.
  • A. 2 and 4 only
  • B. 1 and 2 only
  • C. 1, 3 and 4 only
  • D. 1, 2 and 3 only

Q4. With reference to India's legal framework for civil nuclear power after the enactment of the SHANTI Act, 2025, consider the following statements: Which of the statements given above is/are NOT correct?

  1. A company incorporated in India, including a private one, can be licensed to build, own or operate a nuclear power plant, a role the Atomic Energy Act, 1962 reserved only for government entities or government companies.
  2. The Atomic Energy Regulatory Board, originally constituted by executive notification, now has statutory recognition.
  3. An operator is liable for nuclear damage only if the victim proves negligence on the operator's part.
  • A. 1 and 3 only
  • B. 2 only
  • C. 3 only
  • D. 1 only

Q5. Consider the following facts about India's nuclear power sector before December 2025: NPCIL, a public sector enterprise under the Department of Atomic Energy (DAE), was responsible for siting, design, construction, commissioning and operation of power reactors. The Atomic Energy Regulatory Board had been constituted in 1983 through a notification issued under the Atomic Energy Act, 1962, and the DAE was responsible for safety through the Board as well as for operation through NPCIL. Private firms worked as EPC contractors on reactor units. Which of the following inferences can be drawn from the above?

  1. The arrangement exposed safety regulation to a possible conflict of interest, because one department oversaw both the regulator and the operator.
  2. A private firm carrying out EPC work on reactor units thereby became the operator liable for nuclear damage from those units.
  3. Because the regulator was created by executive notification, its safety directions carried no legal force over the operator.
  • A. 1 and 3 only
  • B. 1 and 2 only
  • C. 2 and 3 only
  • D. 1 only

Q6. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Under the SHANTI Act, 2025, an operator that has paid compensation for nuclear damage can no longer claim recourse against a supplier merely on the ground that the supplier's equipment was defective.
  2. Under the SHANTI Act, 2025, liability for nuclear damage is channelled primarily to the central government rather than to the operator.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q7. With reference to civil liability for nuclear damage in India, consider the following statements: Which of the statements given above is/are correct?

  1. Under the Civil Liability for Nuclear Damage Act, 2010, the operator's right of recourse against a supplier of defective equipment was an enabling provision that the operator was not obliged to exercise.
  2. In place of the 2010 Act's single maximum liability for larger reactors, the SHANTI Act, 2025 sets tiered liability limits that vary with the type and capacity of the installation.
  3. Under both the 2010 Act and the 2025 law, the operator's liability for nuclear damage is strict, arising without proof of fault.
  • A. 2 and 3 only
  • B. 1 and 3 only
  • C. 1, 2 and 3
  • D. 1 and 2 only

Q8. Consider the following facts: In July 2026, files relating to the Kudankulam project, spanning roughly 2016 to 2025, appeared on a dark web portal. They came from a server hosted for an EPC contractor by a third-party data centre. The plant operator stated that the material related to conventional Balance of Plant common service facilities and not to nuclear safety or security systems. Which of the following inferences can be drawn from the above?

  1. Sensitive project data can be exposed without any intrusion into the plant's own networks.
  2. The plant's reactor control systems must have been compromised for the files to be extracted.
  3. Since the material concerned non-nuclear facilities, the leak can be judged to have no value to an adversary.
  4. Long retention of project records by a contractor enlarges the volume of data exposed when that contractor's systems are breached.
  • A. 3 and 4 only
  • B. 1 and 2 only
  • C. 1, 3 and 4 only
  • D. 1 and 4 only