Building Trust Within Intelligence Communities TIE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A national cybersecurity agency is building a threat intelligence sharing platform for critical infrastructure operators. The operators are willing to share, but they are concerned about exposing their internal vulnerabilities to competitors and about legal liability if shared data is breached. The agency wants to maximize participation while minimizing risk. Which approach best balances these concerns?

   • AUse an anonymization layer that strips identifying details and aggregate data before sharing with the community.
   • BLimit participation to a small group of trusted operators to reduce risk.
   • CShare data only in real-time with no storage to minimize breach risk.
   • DCreate a secure portal with strict access controls and require all participants to sign a liability waiver.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat-intelligence sharing group has a formal agreement that requires members to report incidents within 24 hours. A member organization has repeatedly failed to meet this deadline, citing internal approval processes. The group's coordinator wants to maintain trust without alienating the member. What is the most effective approach?

   • AChange the formal agreement to remove the 24-hour deadline entirely.
   • BEnforce the 24-hour deadline strictly and issue a formal warning to the member.
   • CPublicly call out the member for failing to meet the deadline.
   • DWork with the member to understand the approval bottleneck and consider adjusting the deadline or providing a streamlined reporting template.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence platform allows members to rate the quality of submitted indicators. A new analyst notices that one member consistently submits indicators that are accurate but often arrive after the threat has already been mitigated. How should the analyst interpret this member's rating?

   • AThe member is credible because the indicators are accurate, but reliability is low because timeliness is poor.
   • BThe member is unreliable because accuracy is less important than speed in intelligence sharing.
   • CThe member should be rated highly because accuracy is the only factor that matters for trust.
   • DThe member's rating should be suspended until they improve their submission speed.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat intelligence sharing community has been operating for a year. Recently, a member organization discovered that one of its shared indicators was used in a way that violated the community's data-handling policy. The community manager wants to maintain trust among members. What should the manager do first?

   • APrivately contact the violating member to understand what happened and remind them of the policy.
   • BImmediately expel the violating member to show that rules are enforced.
   • CSend a community-wide email naming the violating member and detailing the incident.
   • DIgnore the incident to avoid conflict and keep the community running smoothly.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat-intelligence sharing group is composed of members from different countries with varying legal frameworks. Some members are subject to strict data-protection regulations that restrict the transfer of personal data across borders. The group wants to share intelligence that may include personal data. What is the most effective way to enable sharing while respecting these legal constraints?

   • AExclude members from countries with strict data-protection regulations.
   • BAllow members to share personal data freely, relying on the group's informal trust to prevent misuse.
   • CHave each member sign a waiver that releases the group from liability for data-protection violations.
   • DRequire all members to anonymize personal data before sharing it, and establish a formal agreement that specifies the anonymization standards.
   Reveal Solution Discussion Select an answer first