Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A US-based financial services company wants to share a threat intelligence report containing IP addresses and malware hashes with a partner in the EU. The report includes a few email addresses of internal users who were targeted. Under GDPR, what must the company do before sharing?

   • AObtain explicit consent from each user whose email address appears in the report.
   • BAnonymize the email addresses so individuals cannot be identified, then share the report.
   • CDelete the entire report because GDPR prohibits sharing any data that includes personal information.
   • DShare the report as-is because threat intelligence is exempt from GDPR.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company in the EU experiences a data breach and wants to share the indicators of compromise with a global threat intelligence community. The indicators include IP addresses and domain names, but also a few email addresses of employees. What is the most appropriate action?

   • AAnonymize the email addresses before sharing the indicators.
   • BShare the email addresses because they are necessary for the community to defend against the attack.
   • CDo not share any indicators because of GDPR breach notification requirements.
   • DShare the indicators only after receiving approval from the data protection authority.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A European company experiences a data breach that also reveals a new malware variant. The company wants to share the malware sample with a global threat intelligence platform. The sample may contain personal data from the breached system. What must the company do before sharing?

   • AEnsure the sharing is covered by a lawful basis and, if personal data is included, apply pseudonymization or anonymization.
   • BOnly share the sample if the breach notification to the supervisory authority has been completed.
   • CShare the sample immediately because malware samples are not personal data.
   • DObtain consent from every individual whose data might be in the sample.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A multinational company is about to sign a threat intelligence sharing agreement with a partner in a different country. The agreement will include indicators of compromise (IOCs) that may contain personal data. Which clause is most important to include to ensure the sharing complies with cross-border data transfer rules?

   • AA clause that the receiving party will not share the data with third parties.
   • BA clause stating that the receiving party will delete the data after 30 days.
   • CA clause limiting the sharing to file hashes only.
   • DA clause specifying the legal basis for the transfer, such as standard contractual clauses or an adequacy decision.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is preparing to share a threat intelligence report that includes a list of usernames that were compromised in a phishing campaign. The usernames are corporate email addresses. The analyst wants to share the campaign details with other organizations without exposing the email addresses. What is the best approach?

   • AShare the email addresses because they are corporate, not personal.
   • BReplace the email addresses with a hash or a token that preserves the ability to match across reports.
   • CShare only the domain names of the email addresses.
   • DShare the email addresses but mark the report as confidential.
   Reveal Solution Discussion Select an answer first