Legal and Ethical Considerations for Threat Data Collection TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A threat intelligence team subscribes to a commercial threat intelligence feed that provides indicators of compromise (IOCs) under a license that permits internal use only. The team wants to enrich these IOCs with data from an open-source intelligence (OSINT) source and then redistribute the combined dataset to a partner organization. What should the team do?

   • AAssume that combining the commercial feed with OSINT data creates a new dataset that is free from the original license restrictions.
   • BShare the combined dataset with the partner but remove any logos or trademarks from the commercial feed.
   • CReview the license agreement of the commercial feed to determine if redistribution is permitted, and if not, seek permission from the vendor or use only the OSINT data for sharing.
   • DRedistribute the combined dataset because the partner is also a subscriber to the same commercial feed.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A threat intelligence team is collecting data from multiple sources, including social media, public forums, and dark web monitoring services. The team is based in a country with strict data protection laws, and the data includes personal information of individuals. What should the team do to ensure compliance with data protection regulations?

   • ACollect the data without any assessment because the data is from public sources.
   • BStore the data in a secure location and restrict access to authorized personnel only.
   • CImplement a data protection impact assessment (DPIA) to identify and mitigate privacy risks before starting the collection.
   • DAnonymize the data after collection to comply with data protection laws.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of the EU-US Data Privacy Framework (DPF) in the context of cross-border threat data transfers?

   • AIt allows unrestricted transfer of all data between the EU and the US.
   • BIt requires all threat data to be stored in the EU.
   • CIt provides a mechanism for US companies to transfer personal data from the EU in compliance with GDPR.
   • DIt only applies to government agencies, not private companies.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which access control measure is most appropriate for handling highly sensitive threat intelligence data?

   • AOpen access for all employees to encourage collaboration.
   • BStoring the data on a public cloud server for easy access.
   • CRole-based access control (RBAC) that grants access only to analysts with a specific need-to-know.
   • DPassword protection on the file containing the data.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security analyst is asked to collect threat data from a competitor's public website to gain a competitive advantage. The data includes customer reviews and employee names. The analyst's manager says it is for security research. What should the analyst do?

   • ACollect the data because it is publicly available.
   • BRefuse to collect the data because it is not related to threat intelligence and may violate ethical principles.
   • CCollect the data but anonymize the employee names.
   • DAsk the competitor for permission to collect the data.
   Reveal Solution Discussion Select an answer first