Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which ethical decision-making framework is commonly used to evaluate the consequences of a threat data collection action?

   • AUtilitarianism, which focuses on the greatest good for the greatest number.
   • BVirtue ethics, which focuses on the character of the decision-maker.
   • CDeontology, which focuses on adherence to moral rules regardless of outcomes.
   • DContractualism, which focuses on agreements between parties.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence analyst is handling a dataset that contains sensitive information about a zero-day vulnerability affecting a critical infrastructure provider. The dataset includes technical details and the names of the affected systems. The analyst needs to share this data with a small group of trusted partners. What should the analyst do to protect the sensitive data?

   • AClassify the data as confidential, restrict access to authorized personnel, and use encrypted channels for sharing.
   • BShare the data via email to the partners because they are trusted and need the information quickly.
   • CPost the data to a public threat sharing platform to get broader community support.
   • DRemove the names of the affected systems but keep the technical details, then share it with the partners.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat intelligence analyst receives a tip about a potential data breach. The tip includes a list of customer email addresses and passwords. What should the analyst do first?

   • AShare the data with other analysts to assess the threat.
   • BVerify the legitimacy of the tip and protect the sensitive data by storing it securely.
   • CContact the affected customers immediately.
   • DDelete the data to avoid handling personal information.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence analyst is building a new threat feed by combining data from multiple sources: a commercial feed with a restrictive license, an open-source feed with a Creative Commons Attribution (CC BY) license, and internal data from the company's own sensors. The analyst wants to redistribute the combined feed to customers. What should the analyst do?

   • ARedistribute the combined feed but remove any attribution to the commercial feed to avoid license issues.
   • BReview the licenses of all sources, and if the commercial feed's license prohibits redistribution, either exclude it from the combined feed or obtain permission from the vendor.
   • CRedistribute the combined feed because the open-source data is licensed under CC BY, which allows sharing and adaptation.
   • DRedistribute the combined feed because the analyst's company owns the internal data and can override the other licenses.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common legal restriction on transferring threat data across international borders?

   • AAll threat data must be encrypted before transfer.
   • BData protection laws may require that personal data be transferred only to countries with adequate privacy protections.
   • COnly government agencies can transfer data internationally.
   • DCross-border transfers are prohibited for all types of data.
   Reveal Solution Discussion Select an answer first