Importance of Information Sharing Initiatives TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the principle of responsible disclosure in cybersecurity?

   • AReporting vulnerabilities only to the public without notifying the vendor
   • BNotifying the affected vendor first and allowing time for a fix before public release
   • CSelling vulnerability information to the highest bidder
   • DKeeping vulnerabilities secret indefinitely to avoid exploitation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational corporation wants to share threat intelligence with its partners in different countries. The legal team is concerned about cross-border data transfer regulations. Which practice best addresses these legal concerns?

   • AAnonymize or pseudonymize data before sharing and ensure compliance with applicable data protection laws.
   • BShare all data without any modifications to ensure completeness.
   • COnly share data with partners in the same country to avoid all legal issues.
   • DIgnore legal concerns because threat intelligence is not subject to data protection laws.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common challenge in information sharing initiatives?

   • ALack of standardized threat intelligence formats
   • BExcessive sharing of false positives
   • CToo much automation in threat detection
   • DConcerns about data sensitivity and potential legal liability
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a stakeholder commonly involved in cybersecurity information sharing?

   • AHardware Manufacturer
   • BSearch Engine Provider
   • CTelecommunications Regulator
   • DComputer Emergency Response Team (CERT)
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A multinational corporation's security team wants to share threat intelligence with partners in the EU and the US. The team is concerned about GDPR compliance and wants to ensure that personal data is not included in the shared intelligence. The team also wants to use a standardized format for the shared data. What is the most appropriate approach?

   • AUse a proprietary format that is not subject to GDPR.
   • BAnonymize or pseudonymize any personal data before sharing and use STIX/TAXII for the standardized format.
   • CShare all data, including any personal data, because the partners are in the same company.
   • DAvoid sharing any threat intelligence with EU partners to avoid GDPR issues entirely.
   Reveal Solution Discussion Select an answer first