CHISSP CHISSP Healthcare Information Security & Risk Management 3

Question 1

Which security control type BEST describes a healthcare organization's Acceptable Use Policy (AUP) for EHR access?

Accepted Answer

Preventive administrative control

Answer

Detective technical control

Answer

Corrective physical control

Answer

Deterrent technical control

Question 2

When assessing third-party vendor risk in healthcare, what document legally binds a business associate to HIPAA security requirements?

Accepted Answer

Business Associate Agreement (BAA)

Answer

Memorandum of Understanding (MOU)

Answer

Service Level Agreement (SLA)

Answer

Non-Disclosure Agreement (NDA)

Question 3

A healthcare CISO must prioritize remediation across 50 vulnerabilities. Which methodology provides the MOST systematic approach?

Accepted Answer

Risk-based prioritization using CVSS scores combined with asset criticality

Answer

Remediating all vulnerabilities in alphabetical order by CVE ID

Answer

Patching only vulnerabilities reported in HHS breach data

Answer

Addressing vulnerabilities based on vendor patch release date

Question 4

What is the MINIMUM content required in a HIPAA-compliant security incident response plan?

Accepted Answer

Procedures to identify, respond to, and document security incidents involving ePHI

Answer

A list of every possible cyberattack and its remediation steps

Answer

Contact information for all healthcare regulators in the US

Answer

A quarterly schedule for penetration testing activities

Question 5

Which quantitative risk metric expresses the expected monetary loss from a threat occurring ONCE in a given year?

Accepted Answer

Annualized Loss Expectancy (ALE)

Answer

Single Loss Expectancy (SLE)

Answer

Annualized Rate of Occurrence (ARO)

Answer

Exposure Factor (EF)

Question 6

In healthcare information security, which principle ensures that users are granted only the minimum access necessary to perform their job functions?

Accepted Answer

Principle of least privilege

Answer

Separation of duties

Answer

Need-to-know basis

Answer

Role-based access control