Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company suffers a data breach that exposes customer personal data. The incident response team is collecting evidence. Which legal obligation is most critical to address immediately?

   • ANotify the relevant data protection authority and affected individuals within the required timeframe.
   • BPreserve all evidence for potential litigation.
   • CContact the media to inform the public.
   • DDelete all logs to prevent further exposure.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intelligence analyst at a multinational company needs to share a dataset of observed malicious IP addresses and associated timestamps with a partner organization in the EU. The dataset includes the internal IP addresses of affected company employees. What is the most appropriate action before sharing?

   • ATransfer the data without review because the partner is in the EU and GDPR applies equally to both parties.
   • BEncrypt the dataset and send it via email to the partner to ensure confidentiality during transit.
   • CShare the full dataset because IP addresses are not considered personal data under GDPR.
   • DAnonymize the internal IP addresses and confirm the partner's data handling practices align with GDPR requirements.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When faced with an ethical dilemma in threat data collection, what is the first step in an ethical decision-making process?

   • AImmediately choose the option that provides the most threat intelligence value.
   • BDocument the decision without considering alternatives.
   • CIdentify the ethical issue and the stakeholders affected.
   • DConsult with legal counsel to determine if the action is lawful.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During incident response, what is a primary legal obligation regarding evidence preservation?

   • APreserving the integrity and chain of custody of digital evidence for potential legal proceedings.
   • BEncrypting all evidence and storing it on personal devices.
   • CSharing all evidence with the public to ensure transparency.
   • DDeleting all logs to protect the organization's reputation.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an incident response, a security analyst discovers that a data breach has exposed customer personal data. The company operates in multiple jurisdictions, including the European Union and California. The analyst is about to overwrite the compromised server to restore operations. What should the analyst do first?

   • APreserve the evidence by taking a forensic image of the server before any remediation actions.
   • BConsult with the legal team to determine if the breach notification deadline has passed.
   • COverwrite the server as quickly as possible to prevent further data loss.
   • DNotify the affected customers immediately before doing anything else.
   Reveal Solution Discussion Select an answer first