Importance of Information Sharing Initiatives TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security researcher discovers a critical vulnerability in a widely used open-source library and wants to disclose it responsibly. The researcher is concerned about legal liability and wants to ensure the vulnerability is fixed before public disclosure. Which approach best balances ethical responsibility and legal safety?

   • AReport the vulnerability to the library maintainers and coordinate a disclosure timeline before publishing details.
   • BPublish the vulnerability immediately to force the maintainers to act quickly.
   • CKeep the vulnerability secret indefinitely to avoid any legal issues.
   • DSell the vulnerability details to a government agency without notifying the maintainers.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   During a large-scale cyber incident affecting multiple organizations in a country, the national CERT, a sector ISAC, and several private companies are all sharing information. The incident response efforts are hampered by inconsistent reporting formats and duplicate alerts. Which action would most improve coordination and efficiency?

   • AHave each organization continue using its own format but share more frequently.
   • BLimit sharing to only the CERT to reduce the number of participants.
   • CAdopt a common sharing framework like STIX/TAXII and establish a central coordination point through the CERT.
   • DCreate a new proprietary format that all organizations must adopt.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A government agency and a private energy company want to share threat intelligence about a series of attacks on critical infrastructure. The energy company is hesitant because it fears the shared data could be used in a public records request. What is the most effective way to facilitate this sharing?

   • AThe government agency should require the energy company to share all raw data without any restrictions.
   • BThe energy company should only share information verbally over the phone to avoid creating a paper trail.
   • CThe government agency should use a public cloud storage service to share the data without access controls.
   • DThe two parties should sign a formal information sharing agreement that defines data handling, protection, and permissible use.
   Reveal Solution Discussion Select an answer first
5. 44application · easy

   A city's municipal government is considering joining a regional information sharing initiative with local utilities and hospitals. The goal is to improve the city's ability to respond to cyber incidents that could affect critical infrastructure. Which benefit is most directly achieved by participating in this initiative?

   • ADirect access to classified government intelligence without any restrictions.
   • BGuaranteed immunity from cyber attacks for all participating organizations.
   • CEnhanced situational awareness of threats targeting critical infrastructure in the region.
   • DAutomatic compliance with all local and federal regulations.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A managed security service provider (MSSP) wants to automate the ingestion of threat intelligence feeds from multiple government and commercial sources into its SIEM platform. The MSSP's analysts need to correlate indicators across all feeds and share enriched data with its customers. Which approach best supports this requirement?

   • AStore all raw feeds in a data lake and have analysts manually search them during investigations.
   • BUse a proprietary API from each vendor and write custom parsers for every feed without a common format.
   • CManually copy indicators from each feed into a spreadsheet and email it to customers weekly.
   • DAdopt STIX/TAXII standards to structure and exchange indicators between the feeds, SIEM, and customer platforms.
   Reveal Solution Discussion Select an answer first