Domain 3 – Privacy and Security in Healthcare

Question 1

The pillars of information security consist of :

A. Confidentiality, Integrity, and Availability.
B. Privacy, Integrity, and Availability.
C. Confidentiality, Privacy, and Availability.
D. Confidentiality, Integrity, and Privacy.

Answer 1

A. Confidentiality, Integrity, and Availability.

Question 2

A patient wants to ensure the email they received from their primary care specialist is actually from the person they expect and not an impostor. Which concept will BEST ensure the sender of the email is actually the primary care specialist?

A. Availability
B. Confidentiality
C. Digital Signatures
D. Hashing

Answer 2

C. Digital Signatures

Question 3

During the subject’s purported identity is validated by one or more credentials from the three main categories of factors: something the subject knows (password or passphrase), something the subject has (smartcard, token, or certificate), or something the subject is (a biometric such as a fingerprint or retina scan).

A. Identification
B. Accountability
C. Access Control
D. Authentication

Answer 3

D. Authentication

Question 4

HIPAA provides safe harbor against a breach if .
A. The data was collected more than five years ago.
B. The data was breached by a third party doing work on behalf of the original provider.
C. The organization didn’t understand information security and privacy.
D. The information was properly encrypted.

Answer 4

D. The information was properly encrypted.

Question 5

Public Key Infrastructure or PKI is a form of .

A. Asymmetric encryption.
B. Symmetric encryption.
C. Hashing functions.
D. Digital signatures.

Answer 5

A. Asymmetric encryption.

Question 6

Complete the following with the BEST answer: Sharing of login credentials

A. Should be encouraged because it greatly reduced administrative burdens.
B. Should be used only for workstations where the users know and trust each other very well.
C. Should be discouraged but tolerated as employee moral must be preserved.
D. Should be discouraged because non-repudiation will be violated.

Answer 6

D. Should be discouraged because non-repudiation will be violated.

Question 7

______________are the points at which assets are susceptible to an exploit or attack and are often attributed to unintended design flaws in the implementation of a hardware device, software application, or a system.

A. Threats
B. Vulnerabilities
C. Likelihoods
D. Risks

Answer 7

B. Vulnerabilities

Question 8

Separation of duties is BEST used in situations where:

A. There must be a high level of certainty about who performed an action.
B. Systems must be available for several days no matter the circumstances.
C. An individual must not have access to modify a record without permission.
D. A process requires checks and balances that force collusion.

Answer 8

D. A process requires checks and balances that force collusion.

Question 9

An organization works mostly with older patients and wants to perform research on their patient population. The organization is subject to HIPAA, and an HCISPP has informed them they will need to remove all date information for patients older than 89 years of age. What is the BEST reason the organization must do this?

A. HIPAA provided an arbitrary age to limit the population of studies.
B. After the age of 89, there are considerably fewer people alive to match information to, and therefore an attacker can easily guess the individual.
C. The organization believes the HCISPP is an “expert” and therefore is relying on them for an expert determination.
D. Research on patients over 89 years of age is covered by legislation other than HIPAA.

Answer 9

B. After the age of 89, there are considerably fewer people alive to match information to, and therefore an attacker can easily guess the individual.

Question 10

Least privilege is a form of .

A. Minimum necessary.
B. Non-repudiation.
C. Rotation of duties.
D. Mandatory vacations.

Answer 10

A. Minimum necessary.

Question 11

All of the following are basic components of a security policy EXCEPT the

A. Definition of the issue and statement of relevant terms.

B. Statement of roles and responsibilities

C. Statement of applicability and compliance requirements.

D. Statement of performance of characteristics and requirements.

Answer 11

D. Statement of performance of characteristics and requirements.

Question 12

Which one of the following is an important characteristic of an information security policy?

A. Identifies major functional areas of information.

B. Quantifies the effect of the loss of the information.

C. Requires the identification of information owners.

D. Lists applications that support the business function.

Answer 12

A. Identifies major functional areas of information.

Question 13

Which of the following would be the first step in establishing an information security program?

A.) Adoption of a corporate information security policy statement

B.) Development and implementation of an information security standards manual

C.) Development of a security awareness-training program

D.) Purchase of security access control software

Answer 13

A.) Adoption of a corporate information security policy statement

Question 14

What is the function of a corporate information security policy?

A. Issue corporate standard to be used when addressing specific security problems.

B. Issue guidelines in selecting equipment, configuration, design, and secure operations.

C. Define the specific assets to be protected and identify the specific tasks which must be completed to secure them.

D. Define the main security objectives which must be achieved and the security framework to meet business objectives.

Answer 14

D. Define the main security objectives which must be achieved and the security framework to meet business objectives.

Question 15

Why must senior management endorse a security policy?

A. So that they will accept ownership for security within the organization.

B. So that employees will follow the policy directives.

C. So that external bodies will recognize the organizations commitment to security.

D. So that they can be held legally accountable.

Answer 15

A. So that they will accept ownership for security within the organization.

Question 16

When developing an information security policy, what is the FIRST step that should be taken?

A. Obtain copies of mandatory regulations.
B. Gain management approval.
C. Seek acceptance from other departments.
D. Ensure policy is compliant with current working practices.

Answer 16

B. Gain management approval.

Question 17

Which one of the following should NOT be contained within a computer policy?

A. Definition of management expectations.
B. Responsibilities of individuals and groups for protected information.
C. Statement of senior executive support.
D. Definition of legal and regulatory controls.

Answer 17

B. Responsibilities of individuals and groups for protected information.

Question 18

Which one of the following statements describes management controls that are instituted to implement a security policy?

A. They prevent users from accessing any control function.
B. They eliminate the need for most auditing functions.
C. They may be administrative, procedural, or technical.
D. They are generally inexpensive to implement.

Answer 18

C. They may be administrative, procedural, or technical.

Question 19

Which must bear the primary responsibility for determining the level of protection needed for information systems resources?

A.) IS security specialists
B.) Senior Management
C.) Seniors security analysts
D.) system auditors

Answer 19

B.) Senior Management

Question 20

Which of the following choices is NOT part of a security policy?

A.) definition of overall steps of information security and the importance of security
B.) statement of management intend, supporting the goals and principles of information security
C.) definition of general and specific responsibilities for information security management
D.) description of specific technologies used in the field of information security

Answer 20

D.) description of specific technologies used in the field of information security

Question 21

Which of the following embodies all the detailed actions that personnel are required to follow?

A.) Standards
B.) Guidelines
C.) Procedures
D.) Baselines

Answer 21

C.) Procedures

Question 22

Security is a process that is:

A. Continuous
B. Indicative
C. Examined
D. Abnormal

Answer 22

A. Continuous

Question 23

What are the three fundamental principles of security?

A.) Accountability, confidentiality, and integrity
B.) Confidentiality, integrity, and availability
C.) Integrity, availability, and accountability
D.) Availability, accountability, and confidentiality

Answer 23

B.) Confidentiality, integrity, and availability

Question 24

Making sure that the data is accessible when and where it is needed is which of the following?

A.) Confidentiality
B.) integrity
C.) acceptability
D.) availability

Answer 24

D.) availability

Question 25

Most computer attacks result in violation of which of the following security properties?

A. Availability
B. Confidentiality
C. Integrity and control
D. All of the choices.

Answer 25

D. All of the choices.

Question 26

An area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of Availability can be defined as:

A.) Netware availability
B.) Network availability
C.) Network acceptability
D.) Network accountability

Answer 26

B.) Network availability

Question 27

Which one of the following is the MOST crucial link in the computer security chain?

A. Access controls
B. People
C. Management
D. Awareness programs

Answer 27

C. Management