Sharing Intelligence GCTI Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is a proactive defense action an organization can take using shared threat intelligence?

   • AWaiting for an attack to occur before analyzing the intelligence
   • BDeleting all shared intelligence to avoid false positives
   • CBlocking known malicious IP addresses and domains at the perimeter
   • DPublishing the intelligence on a public website
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is considering joining an ISAC but is worried about sharing sensitive network data. What is the best way to mitigate this concern while still participating?

   • AOnly share data after a mandatory 30-day delay.
   • BRefuse to share any data and only consume intelligence.
   • CParticipate in the ISAC's anonymized sharing programs and use traffic light protocol (TLP) markings to control distribution.
   • DShare all data without restrictions to build trust quickly.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A threat intelligence platform (TIP) needs to exchange indicators with a partner's TIP. Both platforms support STIX/TAXII. What is the most appropriate method to automate this exchange?

   • AEmail STIX JSON files to the partner on a weekly basis.
   • BExport indicators as PDF reports and share via a file share.
   • CConfigure a TAXII 2.1 collection on each side and use the TAXII client to push/pull STIX bundles.
   • DUse a shared spreadsheet to manually update indicators.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team receives a STIX bundle from a partner containing a new malware family's behavior patterns. The team wants to use this information to improve their endpoint detection rules. What is the best way to apply this intelligence?

   • AIgnore the behavior patterns because they are not indicators of compromise.
   • BShare the bundle with other organizations before using it.
   • CCreate new detection rules based on the behavior patterns and test them in a staging environment.
   • DStore the STIX bundle in a threat intel repository for future reference.
   Reveal Solution Discussion Select an answer first
6. 45expert · medium

   Two companies in different countries want to share threat intelligence. Company A is subject to GDPR, while Company B is not. They plan to use a MISP instance hosted in a third country. What is the most important legal consideration before sharing?

   • AEnsure that Company B signs a non-disclosure agreement with Company A.
   • BEnsure that the data transfer complies with GDPR requirements, such as appropriate safeguards or adequacy decisions.
   • CEnsure that both companies use the same TLP marking for all shared data.
   • DEnsure that the MISP instance is encrypted at rest.
   Reveal Solution Discussion Select an answer first