Importance of Information Sharing Initiatives TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A large enterprise is considering participating in a threat intelligence sharing initiative. The enterprise's legal team is concerned about the potential for the shared data to be used against the company in a lawsuit. The security team wants to share to improve its defenses. What is the best way to balance these concerns?

   • AParticipate in the initiative but only share data with government agencies, not private companies.
   • BShare all data without any restrictions to maximize the benefit to the community.
   • CRefuse to participate in any sharing initiative to avoid all legal risks.
   • DShare only non-sensitive, aggregated data that cannot be traced back to the company.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which legal consideration is most relevant when sharing threat intelligence that may contain personal data?

   • ACopyright law
   • BExport control regulations
   • CAntitrust law
   • DPrivacy regulations such as GDPR
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A financial institution wants to join an ISAC but is concerned about the legal liability of sharing threat intelligence that might inadvertently contain personal customer information. The institution's legal counsel suggests using a 'safe harbor' provision. What is the primary purpose of such a provision in an information sharing agreement?

   • ATo require the institution to share all data with government agencies.
   • BTo protect the institution from legal liability if it shares information in good faith for cybersecurity purposes.
   • CTo ensure the institution is not held responsible for any data breaches.
   • DTo allow the institution to share any data without restrictions.
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A security vendor wants to provide its customers with real-time threat intelligence feeds. The vendor has a large customer base with varying technical capabilities. Some customers use SIEMs that support STIX/TAXII, while others only have email access. The vendor wants to maximize the reach of its intelligence while maintaining automation where possible. What is the most effective strategy?

   • AProvide only a STIX/TAXII feed to encourage customers to adopt automation.
   • BUse a proprietary API that only the vendor's own tools can consume.
   • CProvide only email alerts to ensure all customers receive the same information.
   • DOffer both a STIX/TAXII feed for automated ingestion and a TLP:CLEAR email summary for customers without automation.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A national government is establishing a new information sharing initiative to improve the country's cyber defense. The initiative will involve government agencies, critical infrastructure operators, and private companies. What is the most critical factor for the success of this initiative?

   • ARequiring all participants to be government agencies.
   • BEnsuring that all participants use the same technology platform.
   • CMandating that all participants share all data without any restrictions.
   • DBuilding trust among participants through clear rules, legal protections, and demonstrated value.
   Reveal Solution Discussion Select an answer first