Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security analyst is responding to a ransomware incident that has encrypted critical servers. The analyst has identified the ransomware family and has a decryption tool that can recover the files without paying the ransom. However, the analyst also discovered that the ransomware exfiltrated sensitive customer data. The company's legal counsel has advised that breach notification is required. What should the analyst do?

   • AUse the decryption tool to restore the systems, preserve evidence of the exfiltration, and then coordinate with legal counsel to notify affected parties and regulators.
   • BImmediately notify all affected customers and regulators before attempting any recovery.
   • CRestore the systems using the decryption tool and keep the incident confidential to avoid reputational damage.
   • DPay the ransom to ensure the data is not leaked, and then notify the authorities.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company in Canada wants to share threat intelligence data with a partner in the United States. The data includes personal information of Canadian customers. What should the company do to ensure compliance?

   • AAnonymize the data before transfer to avoid PIPEDA.
   • BObtain consent from each customer before sharing.
   • CTransfer the data freely because the US is a trusted ally.
   • DEnsure the transfer complies with Canada's PIPEDA and any applicable cross-border transfer mechanisms.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which legal framework is specifically designed to protect the personal data of individuals residing in the European Union and imposes obligations on organizations that collect or process such data?

   • APayment Card Industry Data Security Standard (PCI DSS)
   • BHealth Insurance Portability and Accountability Act (HIPAA)
   • CCalifornia Consumer Privacy Act (CCPA)
   • DGeneral Data Protection Regulation (GDPR)
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company in the UK collects threat data from a partner in Japan. The data includes personal data of Japanese citizens. The company plans to store the data in the UK. Which legal framework is most relevant to the transfer?

   • ANo legal framework applies because it is a business-to-business transfer.
   • BOnly Japanese law, because the data is about Japanese citizens.
   • CCCPA, because the company has a global presence.
   • DGDPR, because the UK has adequacy arrangements with Japan for data transfers.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company based in California collects threat data from global sources and stores it in a data center in the EU. The data includes IP addresses of users from California. Which legal frameworks are most relevant to this data collection and storage?

   • AOnly CCPA, because the company is based in California.
   • BOnly GDPR, because the data is stored in the EU.
   • CNo specific framework applies because threat data is exempt from privacy laws.
   • DCCPA and GDPR, because the data involves California residents and is stored in the EU.
   Reveal Solution Discussion Select an answer first