Importance of Information Sharing Initiatives TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A small e-commerce company is considering joining a local cybersecurity information sharing group. The company's IT manager is skeptical about the value, arguing that the company is too small to benefit from sharing. Which outcome best demonstrates the value of joining such an initiative?

   • AThe company gains access to a curated list of known malicious IPs that it can block at its firewall.
   • BThe company is guaranteed to be immune from all future cyber attacks.
   • CThe company is required to share its customer database with other members.
   • DThe company's IT manager receives a certification for participating.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare organization wants to join a regional health information sharing and analysis organization (H-ISAC) to share threat intelligence. The organization's legal team is concerned about sharing data that could be linked to specific patients. What is the most effective way to address this concern while still participating in the initiative?

   • AShare only aggregated, anonymized indicators and use Traffic Light Protocol (TLP) markings to control distribution.
   • BAsk the H-ISAC to sign a waiver that exempts the organization from all privacy regulations.
   • CRefuse to share any data that originates from the organization's internal network.
   • DShare raw network logs with patient identifiers included so other members can fully understand the threat.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During a multi-organization cyber incident, a national CERT shares a set of malicious IP addresses and domains with all affected organizations. A private company's incident response team uses this information to block the indicators at its perimeter firewall. What is the most significant benefit of this action?

   • AIt guarantees that the company's network will not be compromised by any future attacks.
   • BIt eliminates the need for the company to perform its own forensic analysis.
   • CIt automatically shares the company's internal logs with the CERT for further analysis.
   • DIt reduces the company's incident response time by enabling immediate defensive action based on shared intelligence.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   During a large-scale ransomware incident affecting multiple organizations, a national CERT provides a set of IOCs to all affected parties. One organization's incident response team finds that its own forensic analysis has identified additional IOCs not in the CERT's list. What is the most effective action for this organization to take?

   • AShare the additional IOCs with the CERT and other affected organizations to improve the collective response.
   • BKeep the additional IOCs private to maintain a competitive advantage over other organizations.
   • CWait until the incident is fully resolved before sharing any additional IOCs.
   • DOnly share the additional IOCs with organizations that are willing to pay for the information.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A national CERT issues an advisory about a new malware campaign targeting the energy sector. A regional energy company receives the advisory and wants to ensure its sister companies in other regions also benefit. What is the most appropriate action under typical TLP guidelines?

   • ACheck the TLP designation on the advisory and share it only with the sister companies if the designation permits.
   • BForward the advisory to all sister companies immediately because they are part of the same parent organization.
   • CDelete the advisory after reading it to prevent any accidental sharing.
   • DPublish the advisory on the company's public website to maximize awareness.
   Reveal Solution Discussion Select an answer first