Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A threat intelligence analyst is working with a dataset that contains sensitive information about a nation-state actor's tactics, techniques, and procedures (TTPs). The dataset is classified as top secret and is stored in a secure repository. The analyst needs to share a subset of this data with a partner organization that has a lower security clearance. What should the analyst do?

   • AShare the entire dataset because the partner is trusted and has signed a non-disclosure agreement.
   • BDeclassify the entire dataset to make it easier to share with the partner.
   • CReview the data classification and sharing policies, and share only the subset that is approved for the partner's clearance level.
   • DShare the dataset through a secure encrypted channel to protect it during transmission.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In the context of threat intelligence, what does 'informed consent' require?

   • AProviding individuals with clear information about how their data will be collected, used, and shared, and obtaining their agreement.
   • BObtaining permission from the organization's legal department before collecting any data.
   • CInforming law enforcement agencies about all data collection activities.
   • DEnsuring that data is collected only from public sources.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence platform collects and stores indicators of compromise (IOCs) that include IP addresses and domain names. The platform also stores metadata about the analysts who submitted the IOCs, including their names and email addresses. The platform is subject to GDPR. What should the platform do to protect the personal data of the analysts?

   • ADelete the analyst metadata entirely to eliminate any privacy concerns.
   • BEncrypt the entire database to protect the analyst metadata.
   • CApply pseudonymization to the analyst metadata, such as replacing names with unique identifiers, and restrict access to the mapping table.
   • DPublish the analyst metadata to the threat intelligence community to promote transparency.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A non-profit organization wants to collect threat data from volunteers who run honeypots. The volunteers will provide network logs that may contain personal data. What is the most appropriate way to ensure informed consent?

   • AAssume consent because the volunteers are participating voluntarily.
   • BCollect the data without informing volunteers to avoid bias.
   • COnly collect data from volunteers who sign a non-disclosure agreement.
   • DProvide a clear consent form explaining what data will be collected, how it will be used, and the volunteers' rights.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence analyst is considering using a vulnerability disclosure from a hacker who claims to have found a zero-day in a widely used software product. The hacker is willing to share the details only if the analyst's company pays a fee and does not disclose the vulnerability to the software vendor. The analyst's goal is to protect the company's network. What should the analyst do?

   • APay the fee and use the vulnerability information to protect the company's network, but do not disclose it to the vendor.
   • BPay the fee and share the vulnerability with the vendor, but do not report the hacker to authorities.
   • CDecline the offer and report the hacker's activity to the software vendor and relevant authorities, as the vulnerability should be disclosed responsibly.
   • DIgnore the offer because the vulnerability may not be real, and continue with regular threat intelligence activities.
   Reveal Solution Discussion Select an answer first