Legal and Privacy Implications of Sharing Threat Intelligence TIE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company in the EU wants to share threat intelligence with a US-based partner. The data includes IP addresses and user agent strings that could be linked to individuals. The company has not yet signed Standard Contractual Clauses with the partner. What is the most appropriate action?

   • AAnonymize the data so it no longer identifies individuals, then share it.
   • BShare the data after obtaining verbal consent from the partner's CEO.
   • CDelay sharing until SCCs are signed, even if the data is anonymized.
   • DShare the data without SCCs because the US has a data protection framework.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A security analyst in the EU is preparing to share threat intelligence that includes personal data of a suspected attacker. Which legal framework directly imposes obligations on the processing and transfer of such personal data during threat intelligence sharing?

   • ACCPA
   • BGDPR
   • CPCI DSS
   • DHIPAA
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is negotiating a threat intelligence sharing agreement with a competitor. The company wants to ensure that the shared data is not used for purposes other than security. Which clause is most important?

   • AA purpose limitation clause that restricts use to cybersecurity defense.
   • BA clause that requires the receiving party to attribute the source.
   • CA clause that allows the sharing party to audit the recipient's systems.
   • DA clause that specifies the frequency of data updates.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A threat intelligence platform aggregates indicators from multiple sources. One source includes a list of IP addresses that are also used by a known privacy advocacy group. The platform wants to share this list with its subscribers. What is the most appropriate action to balance privacy and intelligence value?

   • AAnonymize the IP addresses by generalizing them to a broader range or applying a keyed hash, and include a warning about potential privacy impact.
   • BShare the IP addresses as-is because they are public information.
   • CRemove all IP addresses associated with the privacy advocacy group from the list.
   • DShare the list only with subscribers who sign a confidentiality agreement.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A U.S.-based healthcare organization wants to share malware indicators with a national health-sector ISAC. The indicators include IP addresses and file hashes, but some IP addresses were observed in connection with patient-facing systems. The organization's legal team is concerned about GDPR because some patients are EU residents. What should the organization do before sharing?

   • AAnonymize or pseudonymize the IP addresses that could be linked to EU patients, and include a data-sharing agreement with the ISAC.
   • BRefuse to share any data because GDPR prohibits all cross-border sharing of threat intelligence.
   • CShare the IP addresses and hashes as-is because they are technical indicators, not personal data.
   • DShare only file hashes and omit IP addresses entirely to avoid any GDPR concerns.
   Reveal Solution Discussion Select an answer first