Building Public and Private Sharing Channels TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A managed security service provider (MSSP) wants to share threat intelligence with its clients, but clients have different clearance levels and contractual data-handling requirements. What should the MSSP implement to ensure controlled sharing?

   • APublic posting of all intelligence to maximize transparency
   • BEncrypted email distribution to all clients on a mailing list
   • CTiered private feeds with access controls based on client contracts and sensitivity labels
   • DA single private feed accessible to all clients with a non-disclosure agreement
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization is setting up a private threat intelligence sharing platform for its subsidiaries. The policy must ensure that intelligence is not leaked to competitors. What control is most important to implement?

   • AEncryption of data at rest and in transit
   • BRegular password changes for all users
   • CRole-based access control and audit logging
   • DA public relations campaign to promote the platform
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A regional bank's threat intelligence team has identified a new phishing kit targeting its customers. The team wants to warn other financial institutions quickly without exposing the bank's internal indicators or customer data. What is the most appropriate sharing approach?

   • ASend the raw phishing kit to a private sector information sharing and analysis center (ISAC) without any context
   • BPublish a sanitized TTP description and a few hashes on a public OSINT feed
   • CShare the intelligence only within the bank's internal incident response team
   • DPost the full phishing kit and all captured credentials to a public malware repository
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence analyst wants to share a newly discovered malware hash with the widest possible audience to help other organizations block it. The hash is not associated with any sensitive victim information. What is the most appropriate action?

   • AKeep the hash secret until a formal report is published
   • BPublish the hash on a public threat intelligence feed or platform
   • CPost the hash on the company's internal wiki only
   • DShare the hash only with a closed community of trusted partners
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) needs to receive real-time alerts about emerging threats from external sources. The SOC has a high tolerance for false positives but cannot afford to miss critical indicators. Which sharing channel is most appropriate?

   • AA public OSINT feed with automated ingestion
   • BA private, curated feed with manual review
   • CA closed community that shares only confirmed, high-confidence intelligence
   • DA monthly email digest of threat reports
   Reveal Solution Discussion Select an answer first