Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When sharing threat intelligence, an analyst discovers that the data includes personal information of innocent individuals who are not related to the threat. What is the most ethical action?

   • AShare the data but warn the recipient not to use it
   • BShare the full data because it is part of the threat intelligence
   • CRemove or minimize the unrelated personal information before sharing
   • DIgnore the personal information because it is not relevant to the threat
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A cybersecurity analyst is preparing a threat report to share with a peer organization. The report includes a screenshot of a phishing email that contains the recipient's full name, email address, and a link to a credential-harvesting site. The analyst wants to share the URL and the email's subject line but not the recipient's identity. What is the most appropriate action?

   • AAsk the recipient for written consent before sharing any part of the email.
   • BShare the screenshot as-is because the recipient is an employee and not a data subject.
   • CShare only the URL and omit the subject line to reduce the risk of re-identification.
   • DRedact the recipient's name and email address from the screenshot, and share the URL and subject line.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security vendor discovers a zero-day vulnerability in a widely used email client. The vendor has a sample email that triggered the vulnerability and contains the personal email address of a user. The vendor wants to share the sample with a closed group of security researchers to develop a detection signature. What is the most ethical and privacy-respecting approach?

   • ARedact the user's email address and any other personal identifiers from the sample before sharing.
   • BShare the sample as-is because the researchers are trusted and will not misuse it.
   • CDelay sharing until the vendor can obtain the user's consent.
   • DShare the sample only with researchers who sign a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An organization shares threat intelligence with a partner for the purpose of blocking malicious domains. Later, the partner uses the same data to profile individual users. Which privacy principle is most directly violated?

   • AIntegrity and confidentiality
   • BData minimization
   • CStorage limitation
   • DPurpose limitation
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A multinational corporation with offices in the EU and the US wants to share threat intelligence with a government agency in a third country that has not been deemed adequate by the EU. The data includes IP addresses and domain names, but also a few usernames from internal systems. What is the most compliant approach?

   • AShare the data without any safeguards because the agency is a government entity.
   • BShare the data after obtaining verbal approval from the EU data protection authority.
   • CAnonymize the usernames and rely on Standard Contractual Clauses for the transfer.
   • DRefuse to share any data because the third country lacks adequacy.
   Reveal Solution Discussion Select an answer first