Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A university's security research team is setting up a honeypot to collect data on botnet activity. The honeypot will capture network traffic, including source IP addresses and user-agent strings. The team plans to publish the collected data in a public research dataset. What should the team do to address ethical and legal concerns?

   • APublish the data as-is because it was collected from a honeypot and the data is publicly accessible on the internet.
   • BAnonymize the collected data by removing or generalizing IP addresses and other potential identifiers before publication.
   • CDelay publication for a few months to reduce the risk of identifying individuals.
   • DObtain informed consent from every individual whose IP address appears in the honeypot logs.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which technique is most effective for protecting personally identifiable information (PII) in threat data while preserving its analytical value?

   • AStoring the data on a secure server with restricted access.
   • BAnonymization, such as removing direct identifiers and aggregating data.
   • CEncryption of the entire dataset with a strong algorithm.
   • DDeleting all data older than 30 days.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A company subscribes to a threat intelligence feed that includes indicators of compromise (IOCs) from a vendor. The vendor's license allows internal use but prohibits redistribution. The company wants to share the IOCs with a government agency for a joint investigation. What should the company do?

   • AContact the vendor to obtain permission to share the IOCs with the government agency.
   • BShare the IOCs because it is for a government investigation.
   • CShare only the IOCs that are not covered by the license.
   • DIgnore the license because the government agency needs the data.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A threat intelligence team is considering using a public API that provides access to data about security vulnerabilities. The API's terms of service prohibit automated scraping, but the team wants to collect a large amount of data for analysis. The team's legal counsel has advised that scraping may violate the terms of service and potentially the Computer Fraud and Abuse Act (CFAA). What should the team do?

   • AProceed with scraping because the data is publicly available and the team's purpose is for security research.
   • BContact the API provider to request permission for automated access or use an official bulk data download if available.
   • CLimit the scraping to a small number of requests to avoid detection.
   • DUse a third-party scraping service to avoid direct liability.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   During an incident response, an analyst finds evidence of a crime. The analyst is in a jurisdiction that requires reporting certain crimes to law enforcement. What should the analyst do?

   • AContinue the investigation and report the crime after it is complete.
   • BInform the company's legal counsel and let them decide.
   • CPreserve the evidence and report the finding to the appropriate legal authorities as required by law.
   • DDelete the evidence to protect the company from liability.
   Reveal Solution Discussion Select an answer first