Building Trust Within Intelligence Communities TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A new threat-intelligence sharing platform is being launched for a group of healthcare organizations. The platform will allow members to share indicators of compromise (IOCs) and anonymized patient-impact data. The founding members want to ensure that only legitimate healthcare entities can join and that shared data is not misused. Which combination of mechanisms should they implement?

   • AA formal vetting process that verifies organizational identity and requires a signed data-sharing agreement, plus a reputation system that tracks member contributions.
   • BA one-time membership fee and a requirement to submit at least one IOC per month.
   • CA peer-review process where existing members vote on new applicants, with no formal agreement required.
   • DA public registration form with email verification and a code of conduct.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government CERT is establishing a new threat-sharing community with private-sector partners. To encourage participation, the CERT wants to ensure that shared data is not misused and that contributors receive credit for their work. Which combination of mechanisms would best address these goals?

   • AImplement a vetting process for new members and use a reputation system that tracks contributions.
   • BRely on informal relationships and verbal agreements to govern data use.
   • CPublish all submissions publicly and require attribution to the submitting organization.
   • DAllow anonymous submissions and do not track who contributed what.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multinational corporation is considering joining a cross-sector threat-intelligence sharing group. The group includes direct competitors. The corporation's legal team is concerned about antitrust implications and the potential for shared data to be used against the company. The security team wants to participate because the group has a strong track record of actionable intelligence. What is the most important factor for the corporation to consider when deciding whether to join?

   • AThe technical sophistication of the group's sharing platform.
   • BThe group's formal governance structure, including its data-handling policies and antitrust guidelines.
   • CThe geographic distribution of the group's members.
   • DThe number of members in the group, because larger groups provide more intelligence.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A national CERT has been sharing threat intelligence with a group of private-sector partners for two years. Recently, several partners have complained that the CERT's reports are occasionally late and sometimes lack context about the source of the data. The CERT wants to restore confidence and maintain the community's willingness to share. What should the CERT do first?

   • AReduce the frequency of reports to avoid being late, and stop including source details to protect privacy.
   • BAsk partners to sign a new agreement that lowers their expectations for timeliness and detail.
   • CIssue a public apology and promise to improve timeliness without changing internal processes.
   • DPublish a service-level commitment that includes delivery timelines and a standard format for source attribution, then report on compliance quarterly.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A new analyst joins a threat intelligence team that participates in a sharing community. The analyst notices that some members are hesitant to share indicators that could reveal their own network vulnerabilities. What is the primary reason for this hesitation?

   • AFear that the information could be used against them or expose weaknesses.
   • BLack of understanding of the threat intelligence format.
   • CUnwillingness to spend time on documentation.
   • DLack of technical capability to share indicators.
   Reveal Solution Discussion Select an answer first