CHISSP Healthcare IT Network Security & Access Control 2 — Questions and Answers
Question 1: A healthcare network administrator needs to monitor traffic between a biomedical device network and the clinical LAN. Which tool is MOST appropriate?
- Intrusion Detection System (IDS) placed inline between segments
- Network-based IDS (NIDS) with a span/mirror port on the inter-segment switch (Correct answer)
- Host-based antivirus on each medical device
- A proxy server handling all inter-segment HTTP traffic
Correct answer: Network-based IDS (NIDS) with a span/mirror port on the inter-segment switch
A NIDS with a span port passively monitors traffic between segments without impacting device performance or availability, which is critical for time-sensitive biomedical devices.
Question 2: Which of the following is a key security concern unique to legacy medical devices that cannot be patched or updated?
- They require more bandwidth than modern devices
- They often run outdated operating systems with unmitigated vulnerabilities (Correct answer)
- They do not support HL7 FHIR communication standards
- They are incompatible with DHCP-assigned addressing
Correct answer: They often run outdated operating systems with unmitigated vulnerabilities
Many legacy medical devices run end-of-life operating systems (e.g., Windows XP) that cannot receive security patches, leaving known vulnerabilities permanently unmitigated.
Question 3: What is the recommended compensating control for a medical device running an unsupported operating system that cannot be updated?
- Decommission the device immediately
- Isolate the device in a dedicated VLAN with strict firewall rules and enhanced monitoring (Correct answer)
- Disable all networking on the device
- Encrypt all data stored on the device's hard drive
Correct answer: Isolate the device in a dedicated VLAN with strict firewall rules and enhanced monitoring
Network isolation with strict ACLs and enhanced monitoring compensates for an unpatched device by limiting its exposure and increasing visibility into any anomalous activity.
Question 4: A hospital's Active Directory environment has a privileged account used by multiple IT administrators. Which practice violates least-privilege principles?
- Requiring MFA for all administrator accounts
- Using a shared 'Domain Admin' account for routine administrative tasks (Correct answer)
- Implementing just-in-time (JIT) access for privileged operations
- Auditing all privileged account activity
Correct answer: Using a shared 'Domain Admin' account for routine administrative tasks
Sharing a single Domain Admin account eliminates individual accountability, grants excessive privileges for routine tasks, and violates both least-privilege and non-repudiation principles.
Question 5: Which technology allows a healthcare organization to verify the integrity of network devices and endpoints before granting them access to clinical resources?
- Network Access Control (NAC) (Correct answer)
- Content Delivery Network (CDN)
- Dynamic Host Configuration Protocol (DHCP) reservations
- Network Address Translation (NAT)
Correct answer: Network Access Control (NAC)
NAC evaluates device health — patch status, antivirus, configuration compliance — before permitting connection, preventing non-compliant endpoints from accessing sensitive clinical resources.
Question 6: In healthcare IT security, what does 'defense in depth' primarily refer to?
- Using the deepest available encryption key lengths
- Layering multiple independent security controls so a failure in one does not compromise the entire system (Correct answer)
- Deploying a single comprehensive security platform to avoid complexity
- Prioritizing perimeter security above all other controls
Correct answer: Layering multiple independent security controls so a failure in one does not compromise the entire system
Defense in depth layers multiple independent controls (firewalls, IDS, access control, encryption, monitoring) so that an attacker must defeat every layer, reducing the likelihood of a successful breach.
Question 7: A nurse's workstation automatically logs out after 3 minutes of inactivity. Which security principle does this automatic timeout BEST enforce?
- Data integrity
- Non-repudiation
- Session management and unauthorized access prevention (Correct answer)
- Audit logging and accountability
Correct answer: Session management and unauthorized access prevention
Automatic session timeout prevents unauthorized individuals from accessing a logged-in workstation left unattended, directly addressing the risk of session hijacking and unauthorized access.
CHISSP Healthcare IT Network Security & Access Control 2
A healthcare network administrator needs to monitor traffic between a biomedical device network and the clinical LAN.
Which tool is MOST appropriate?