Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence team collects malware samples that contain embedded credentials and personal information of victims. They need to share the samples with a research partner. What is the best practice?

   • AEncrypt the samples and share the decryption key separately.
   • BSanitize the samples by removing or redacting personal information before sharing.
   • COnly share the samples with partners who sign a non-disclosure agreement.
   • DShare the samples as-is because they are needed for research.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst discovers that a threat intelligence platform has been collecting and storing full network traffic, including personal communications of employees, without their knowledge. The data is used to detect insider threats. The company has no policy on this. What should the analyst do?

   • AContinue collecting because the data is valuable for security.
   • BStop the collection, inform management of the privacy risks, and recommend a formal policy with employee notification.
   • CReport the collection to law enforcement.
   • DAnonymize the data and continue collecting without informing employees.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which practice best demonstrates transparency in threat data collection?

   • ACollecting data from public sources without any notice.
   • BUsing encryption to protect the data during collection.
   • CSharing collected data only with vetted partners.
   • DPublishing a privacy notice that explains the types of data collected and the purposes of collection.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat intelligence analyst at a security operations center (SOC) has collected a packet capture (PCAP) from a network intrusion that includes the IP addresses, usernames, and email addresses of internal employees. The analyst needs to share this PCAP with a trusted external threat sharing community to help others detect the same attack. However, the company's privacy policy requires that personal data be protected. What should the analyst do before sharing the PCAP?

   • AOnly share the IP addresses and omit usernames and email addresses, because IP addresses are not personal data.
   • BShare the PCAP as-is because the external community is trusted and has signed a non-disclosure agreement.
   • CEncrypt the PCAP with a strong password and share the password separately with the community.
   • DRemove or mask all personally identifiable information (PII) from the PCAP, such as usernames and email addresses, while preserving the technical indicators.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When storing threat data that includes personal information, which of the following is a compliance requirement under GDPR?

   • AOrganizations must implement appropriate technical and organizational measures to protect the data.
   • BData must be stored only on servers located within the European Union.
   • COrganizations must delete all threat data after 30 days.
   • DOrganizations must obtain consent from every individual whose data is included.
   Reveal Solution Discussion Select an answer first