Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company in California experiences a ransomware attack that also exfiltrates customer personal information. The company wants to share the ransomware indicators with a national threat intelligence platform. What compliance obligation must the company consider before sharing?

   • AThe CCPA/CPRA requirements for notifying affected consumers and the need to avoid sharing personal data unnecessarily.
   • BThe need to obtain written consent from every affected consumer before sharing any data.
   • CThe GDPR requirement to appoint a Data Protection Officer before sharing.
   • DThe requirement to share the full set of exfiltrated data with the platform to help other victims.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   Two companies are entering into a threat intelligence sharing agreement. One company is in the EU and the other in the US. They plan to exchange indicators that may include personal data. What is an essential component of the agreement?

   • AA data protection clause that specifies the legal basis for processing and transfer mechanisms.
   • BA clause that allows either party to use the data for any purpose.
   • CA clause that requires the receiving party to share all future intelligence without restriction.
   • DA clause that specifies the technical format of the data feed.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which component is essential in a data sharing agreement for threat intelligence to define what data is covered and how it may be used?

   • ACompliance clause
   • BScope and purpose clause
   • CLiability waiver
   • DTermination clause
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A US-based organization operating in the healthcare sector wants to share threat intelligence that may include patient data. Which sector-specific law must the organization consider when sharing this data?

   • ASOX
   • BHIPAA
   • CGLBA
   • DFERPA
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An EU-based organization wants to share threat intelligence containing personal data with a partner in a country that has not been deemed adequate by the European Commission. What must the organization do to comply with cross-border data transfer rules?

   • AProceed with the transfer as long as the partner signs a non-disclosure agreement
   • BObtain verbal consent from the data subjects
   • CImplement appropriate safeguards, such as standard contractual clauses
   • DAnonymize the data before transfer
   Reveal Solution Discussion Select an answer first