CHISSP CHISSP Healthcare Information Security & Risk Management 2

Question 1

Which asset classification level typically applies to electronic Protected Health Information (ePHI) in a US healthcare organization?

Accepted Answer

Restricted / Highly Confidential

Answer

Internal Use Only

Answer

Public

Answer

Sensitive but Unclassified

Question 2

A security analyst discovers that a business associate is storing ePHI without encryption on portable media. Which HIPAA safeguard has been violated?

Accepted Answer

Technical safeguards — encryption and decryption standard

Answer

Administrative safeguards — workforce training

Answer

Physical safeguards — workstation use policy

Answer

Organizational safeguards — business associate agreement

Question 3

In a healthcare threat model, which threat actor is statistically responsible for the MOST healthcare data breaches according to HHS breach reports?

Accepted Answer

Insider threats (workforce members)

Answer

Nation-state advanced persistent threats

Answer

Script kiddies using commodity malware

Answer

Competitors conducting corporate espionage

Question 4

What is the PRIMARY goal of a Business Impact Analysis (BIA) in a healthcare information security program?

Accepted Answer

Identify critical systems and quantify the operational impact of their disruption

Answer

Document regulatory fines for non-compliance scenarios

Answer

Map network topology for firewall configuration

Answer

Determine encryption key rotation schedules

Question 5

Which concept describes the maximum tolerable period that a healthcare system can be offline before unacceptable patient care harm occurs?

Accepted Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Mean Time to Repair (MTTR)

Question 6

A penetration test on a hospital network reveals that IoT medical devices run unpatched firmware. Which risk mitigation strategy is MOST feasible given FDA regulatory constraints?

Accepted Answer

Network segmentation isolating medical devices on a dedicated VLAN

Answer

Immediately applying vendor patches to all devices

Answer

Replacing all IoT devices with air-gapped alternatives

Answer

Disabling network connectivity on all medical devices