Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cloud service provider that operates in multiple countries wants to share threat intelligence with a global consortium. The provider's legal team notes that some member countries have data localization laws. What should the provider do to ensure compliance?

   • AShare only non-personal threat data to avoid all localization issues.
   • BSign a single global data-sharing agreement that overrides local laws.
   • CRefuse to share with any country that has data localization laws.
   • DReview the data localization requirements of each country and structure the sharing to comply, possibly by using regional sharing hubs.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A multinational company operates in the EU and in a country with no data protection law. It wants to share threat intelligence with a local partner in that country. The data includes IP addresses and device identifiers that may be linked to individuals. What is the most compliant approach?

   • ARefuse to share because the destination country lacks adequate data protection.
   • BAnonymize the data so it no longer constitutes personal data, then share it.
   • CShare the data under the partner's local law, which has no restrictions.
   • DObtain consent from each individual before sharing.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security researcher wants to publish a blog post about a new malware campaign. The post includes screenshots that show the email addresses of victims. What is the ethical approach?

   • APublish the screenshots as-is because they are evidence of the attack.
   • BRedact the email addresses in the screenshots before publishing.
   • CUse fake email addresses in the screenshots without indicating they are fake.
   • DPublish the screenshots but only on a password-protected site.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation with offices in the EU and Asia wants to share threat intelligence with a global ISAC. The ISAC stores data in the United States. The corporation's legal team is concerned about GDPR and local data transfer restrictions. The corporation wants to share indicators that may include personal data. What is the most compliant approach?

   • AShare only non-personal data, such as file hashes, to avoid transfer restrictions.
   • BObtain consent from every individual whose data might be included.
   • CUse standard contractual clauses (SCCs) or another approved transfer mechanism, and pseudonymize personal data before sharing.
   • DShare the data directly because threat intelligence sharing is exempt from GDPR.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security researcher discovers a vulnerability in a popular consumer router. The researcher wants to share the exploit details with a public mailing list to warn users. However, the exploit code includes a hardcoded MAC address of a specific user's router. What is the most ethical and privacy-respecting action?

   • ARemove the MAC address from the exploit code before publishing.
   • BDelay publication until the router vendor releases a patch.
   • CPublish only the vulnerability description and not the exploit code.
   • DPublish the exploit code as-is because MAC addresses are not personal data.
   Reveal Solution Discussion Select an answer first