Building Public and Private Sharing Channels TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A private threat intel sharing community is experiencing a decline in participation because members are concerned about the quality of shared indicators and the risk of sharing false positives. What governance change would most directly address these concerns?

   • AIncrease the number of members to get more data
   • BImplement a peer-review process for submitted indicators before they are published
   • CSwitch to a public platform to attract more contributors
   • DRemove all sharing restrictions to encourage participation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital network wants to share threat intelligence with other hospitals in its region to improve collective defense. The intelligence includes sensitive patient data that must be protected. What is the most appropriate sharing channel?

   • AA private, regional health information sharing and analysis organization (H-ISAC)
   • BAn open-source intelligence feed
   • CA public social media post
   • DA general-purpose public forum
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is building a threat intel sharing channel with partners. They need to share indicators that include IP addresses that may be used by legitimate customers. The legal team is concerned about privacy regulations. What is the best way to handle this?

   • AAnonymize or pseudonymize the IP addresses before sharing
   • BShare the IP addresses as-is because they are not personal data
   • CShare the IP addresses only with partners in the same country
   • DRefuse to share any IP addresses
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation is building a private threat intelligence sharing channel with partners in different countries. The legal team warns that data residency laws in some countries restrict the transfer of certain intelligence across borders. The security team wants to maximize the value of shared intelligence. What is the best approach?

   • AUse a single global private feed and rely on encryption to satisfy all legal requirements
   • BAvoid sharing any intelligence with partners outside the home country
   • CShare all intelligence publicly to avoid legal restrictions
   • DCreate regional private feeds that comply with local data residency requirements
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a public threat intelligence sharing platform?

   • AAn internal SIEM repository
   • BA closed mailing list for a specific industry group
   • CA freely accessible open-source intelligence feed
   • DA vendor-specific threat feed requiring a paid subscription
   Reveal Solution Discussion Select an answer first