Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In the context of threat intelligence, the ethical principle of 'data minimization' means:

   • AStoring data for the shortest possible time, regardless of its relevance to the investigation.
   • BEncrypting all collected data to prevent unauthorized access.
   • CCollecting only the data that is necessary for the stated purpose of the threat analysis.
   • DSharing data only with trusted partners to reduce exposure.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational company's threat intelligence team has collected threat data from its operations in multiple countries, including the EU, the US, and a country with no data protection laws. The team wants to centralize this data in a cloud platform hosted in the US. The data includes personal data of EU employees. What is the most appropriate approach to comply with GDPR?

   • AAnonymize all EU personal data before transferring to the US to avoid GDPR obligations.
   • BUse a combination of data localization for EU data and SCCs for any necessary transfers, while ensuring the cloud provider offers appropriate safeguards.
   • CTransfer all data to the US because the company is headquartered in the US and US law applies.
   • DStore all data in the EU and do not transfer any data to the US.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security vendor scrapes public social media profiles to gather threat intelligence about potential attackers. The data includes personal information of individuals who are not involved in any threat activity. The vendor plans to sell this data to clients. What is the primary ethical and legal concern?

   • AThe vendor should anonymize the data before selling it.
   • BThe vendor should obtain a license from the social media platform to sell the data.
   • CThe data is publicly available, so there is no concern.
   • DThe collection may violate privacy laws and the terms of service of the social media platforms.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A global company collects threat data from its offices in multiple countries. The data is stored in a centralized repository in the United States. The company needs to share this data with a subsidiary in a country with strict data localization laws. What is the best approach?

   • AUse a standard contractual clause to legitimize the transfer.
   • BAnonymize the data before transfer to avoid localization laws.
   • CAssess the data localization requirements and, if necessary, store and process the data locally in that country.
   • DTransfer the data to the subsidiary because the company is global.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to incorporate a commercial threat intelligence feed into their SIEM. The feed license prohibits redistribution of raw indicators. The team plans to share derived detection rules with industry peers. What should they do?

   • AAsk the vendor for permission to redistribute the feed to peers.
   • BIgnore the license because threat intelligence is meant to be shared for the common good.
   • CShare the raw indicators with peers because detection rules are useless without them.
   • DReview the license terms to confirm that derived rules are permitted, and share only those rules without raw indicators.
   Reveal Solution Discussion Select an answer first