Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A healthcare organization is required by law to report a data breach to regulators, and also wants to share the threat intelligence with a peer organization. The data includes patient records that were exposed. What is the most appropriate course of action?

   • AShare the full patient records with the peer to help them defend against the same attack.
   • BNotify the peer before the regulator to ensure they are protected.
   • CNotify the regulator with the required details, and share only anonymized indicators with the peer.
   • DDo not share any information because of patient confidentiality laws.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a threat intelligence data sharing agreement, which clause is most important for addressing legal responsibility if shared data is mishandled by the receiving party?

   • AAudit clause
   • BData classification clause
   • CNotification clause
   • DLiability and indemnification clause
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   Two organizations are drafting a threat intelligence sharing agreement. One organization is concerned about being held liable if shared indicators cause a false positive that disrupts the other's operations. Which clause should be included to address this concern?

   • AA clause requiring the receiving party to verify all indicators before acting.
   • BA clause that the receiving party indemnifies the sharing party for any losses.
   • CA clause that the sharing is provided 'as-is' without any warranty.
   • DA limitation of liability clause that caps damages and excludes indirect or consequential losses.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is drafting a threat intelligence sharing agreement with a partner. The company wants to ensure that if the partner suffers a data breach involving the shared data, the company is notified promptly. Which clause is most important?

   • AA breach notification clause that requires the partner to notify the company within a specified timeframe.
   • BA clause that requires the partner to use the data only for internal purposes.
   • CA clause that allows the company to audit the partner's security controls.
   • DA clause that specifies the format of the threat intelligence data.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement best describes the difference between anonymization and pseudonymization in the context of threat intelligence sharing?

   • AAnonymization requires consent, while pseudonymization does not
   • BAnonymization is irreversible and removes the ability to re-identify individuals, while pseudonymization allows re-identification with additional information
   • CAnonymization is only used for IP addresses, while pseudonymization is used for email addresses
   • DAnonymization is reversible with a key, while pseudonymization is irreversible
   Reveal Solution Discussion Select an answer first