Importance of Information Sharing Initiatives TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does information sharing improve incident response coordination during a widespread cyber incident?

   • AIt automatically patches all affected systems across organizations
   • BIt ensures that all organizations use the same incident response team
   • CIt allows organizations to share indicators and response strategies in real time
   • DIt eliminates the need for communication with law enforcement
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security operations center (SOC) wants to automate the exchange of threat intelligence with a partner organization. The SOC uses a SIEM that supports STIX/TAXII. The partner uses a different platform that also supports STIX/TAXII. What is the primary advantage of using STIX/TAXII in this scenario?

   • AIt provides a standardized format and transport mechanism, enabling interoperability between the two different platforms.
   • BIt automatically encrypts all shared data, eliminating the need for additional security controls.
   • CIt ensures that the partner's platform is compatible with the SIEM without any additional configuration.
   • DIt allows the SOC to share data with any organization, regardless of their platform.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare organization wants to share ransomware indicators with a national CERT. The organization's legal team is concerned about patient data exposure under HIPAA. Which approach addresses the legal concern while still enabling effective sharing?

   • AShare indicators with TLP:CLEAR so that all healthcare providers can benefit.
   • BShare only technical indicators (hashes, IPs) and use a TLP:AMBER designation to limit distribution.
   • CShare full incident reports including patient records to provide complete context.
   • DRefuse to share any data because HIPAA prohibits all information sharing.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company's SOC team receives a threat advisory from its sector-specific ISAC about a new ransomware campaign targeting industrial control systems. The advisory includes indicators of compromise (IOCs) and recommended mitigations. What is the most immediate action the SOC team should take?

   • AAcknowledge receipt of the advisory and file it for future reference.
   • BImmediately shut down all industrial control systems to prevent any potential infection.
   • CForward the advisory to the company's legal team for review before taking any technical action.
   • DSearch the company's network logs for the provided IOCs and apply the recommended mitigations if any are found.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security researcher discovers a critical vulnerability in a widely used open-source library. The researcher wants to share this finding with the vendor and the broader security community. What is the most ethical and legally sound approach?

   • ASell the vulnerability details to a government agency without informing the vendor.
   • BPrivately disclose the vulnerability to the vendor and allow a reasonable time for a fix before public release.
   • CKeep the vulnerability secret indefinitely to avoid any legal liability.
   • DImmediately publish the full exploit code on a public forum to force the vendor to act quickly.
   Reveal Solution Discussion Select an answer first