Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a key requirement of the California Consumer Privacy Act (CCPA) that affects threat intelligence data collection?

   • AIt requires all data to be stored within the state of California.
   • BIt applies only to businesses with more than 500 employees.
   • CIt requires organizations to obtain explicit opt-in consent before collecting any personal data.
   • DIt grants California residents the right to know what personal data is collected about them and to request its deletion.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of classifying threat data into categories such as 'public', 'internal', and 'restricted'?

   • ATo comply with data retention policies.
   • BTo reduce the storage cost of the data.
   • CTo determine the appropriate level of protection and access controls for the data.
   • DTo make the data easier to search and retrieve.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which legal obligation is triggered when a data breach involves personal data and is likely to result in a risk to individuals' rights and freedoms?

   • AWaiting until the investigation is complete before any notification.
   • BPublishing the breach details on the organization's website.
   • CNotifying the relevant supervisory authority within the required timeframe.
   • DContacting law enforcement before notifying the supervisory authority.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A threat intelligence team uses a public dataset of malware hashes that also contains file names that include usernames and email addresses. The team wants to use this data to enrich their detection. What is the best practice?

   • AStrip or hash the file names to remove personal information before using the data.
   • BUse the data as-is because it is publicly available.
   • CAvoid using the dataset altogether.
   • DObtain consent from the individuals whose names appear in the file names.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   A threat intelligence team in the United States plans to share threat data that includes personal information of individuals located in Germany. Which compliance requirement must they address?

   • AThey can share the data freely because it is for threat intelligence purposes.
   • BThey must comply with the GDPR because the data includes personal data of EU residents.
   • CThey must obtain a warrant from a German court before sharing the data.
   • DThey only need to comply with US federal laws because the team is based in the US.
   Reveal Solution Discussion Select an answer first