Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A national CERT is building a threat intelligence sharing platform for critical infrastructure operators. The platform will collect IP addresses and domain names from member organizations. Some members are subject to GDPR and local data protection laws. The CERT wants to allow members to search for indicators without exposing the raw values to other members. Which approach best balances privacy and intelligence value?

   • AStore indicators in plaintext but restrict access to a trusted few analysts.
   • BShare only aggregated statistics, such as the number of attacks per sector, and not individual indicators.
   • CUse a keyed-hash message authentication code (HMAC) with a secret key shared only among members, and allow exact-match queries on the hashes.
   • DUse a plain SHA-256 hash of the indicators and publish them openly.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence platform automatically collects data from various sources, including some that contain personal information. The platform's default settings share all collected data with all subscribers. What should the platform administrator do to align with privacy principles?

   • AShare the data only with subscribers who sign a non-disclosure agreement.
   • BKeep the default settings because subscribers expect full data.
   • CDisable all sharing until the legal team reviews every request.
   • DConfigure the platform to minimize personal data collection and apply pseudonymization before sharing.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global financial institution is subject to both GDPR and CCPA. It wants to share threat intelligence with a partner in a country that is not GDPR-adequate. The data includes IP addresses and transaction IDs that could be linked to customers. What is the most appropriate action?

   • ARefuse to share because GDPR and CCPA conflict and cannot both be satisfied.
   • BShare only the IP addresses and omit the transaction IDs.
   • CAnonymize the transaction IDs and use Standard Contractual Clauses for the transfer.
   • DShare the data without any safeguards because CCPA allows sharing for security purposes.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A threat intelligence team is collecting indicators of compromise (IOCs) that include IP addresses and email addresses. To comply with the privacy principle of data minimization, what should the team do?

   • ACollect only the IOCs necessary to achieve the specific threat intelligence purpose
   • BCollect all available IOCs to ensure comprehensive coverage
   • CAnonymize all IOCs before collection
   • DObtain consent from every individual whose data appears in the IOCs
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A threat intelligence analyst needs to share a list of IP addresses that may be linked to individual users. To reduce privacy risk while preserving the ability to correlate the data with other sources, which technique is most appropriate?

   • AEncryption at rest
   • BPseudonymization
   • CAnonymization
   • DTokenization
   Reveal Solution Discussion Select an answer first