Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During incident response, a forensic analyst collects a memory dump that contains chat messages and credentials of employees. The organization is subject to GDPR. What is the best practice for handling this sensitive data?

   • AAnonymize the chat messages and credentials before storing the dump.
   • BDelete the memory dump immediately to avoid GDPR violations.
   • CStore the memory dump in an encrypted, access-controlled repository and limit access to the incident response team.
   • DShare the memory dump with all security staff for transparency.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of applying data anonymization techniques to threat intelligence data?

   • ATo ensure the data is encrypted during transmission.
   • BTo make the data compliant with export control regulations.
   • CTo prevent the identification of individuals whose data may be included in the threat data.
   • DTo reduce the size of the dataset for faster processing.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A threat intelligence platform provides a feed of indicators of compromise (IOCs) under a Creative Commons Attribution license. What does this license allow you to do?

   • AUse the IOCs only for non-commercial purposes.
   • BUse the IOCs freely, provided you give appropriate credit to the original source.
   • CUse the IOCs without any conditions or restrictions.
   • DModify the IOCs and claim them as your own without attribution.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center (SOC) is collecting threat data from various sources, including email headers from phishing attacks. The email headers contain the email addresses of the victims and the attackers. The SOC wants to use this data to improve detection rules. What should the SOC do to adhere to ethical principles?

   • AStore all email headers, including full email addresses, to ensure comprehensive threat intelligence.
   • BCollect only the attacker's email addresses and discard the victim's email addresses.
   • CMinimize the data collected by extracting only the technical indicators, such as sender IP addresses and subject lines, and avoid storing full email addresses unless necessary.
   • DShare the email headers with other organizations without removing personal data to help the broader community.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A threat intelligence analyst at a security vendor has access to a dark web forum where cybercriminals discuss upcoming attacks. The analyst can monitor the forum without participating, but to gain deeper access, they would need to create an account and post messages that encourage criminals to reveal more details. The analyst's goal is to gather actionable intelligence to protect clients. What is the most ethical course of action?

   • ACreate the account but only observe without posting, to gain access to more threads.
   • BReport the forum to law enforcement and cease all monitoring.
   • CContinue passive monitoring only, avoiding any actions that could be seen as entrapment or facilitation of illegal activity.
   • DCreate the account and post messages to extract more information, because the end goal of protecting clients justifies the means.
   Reveal Solution Discussion Select an answer first