CHISSP Healthcare IT Network Security & Access Control 3

Question 1

A healthcare organization implements a Zero Trust Architecture (ZTA) for its clinical network. What is the foundational principle of this approach?

Accepted Answer

Never trust, always verify — authenticate and authorize every request regardless of network location

Answer

Zero Trust assumes no user or device is inherently trusted, requiring continuous verification of identity and authorization for every resource request regardless of network location.

Question 2

Which protocol is specifically designed to provide centralized authentication, authorization, and accounting for network access in healthcare environments?

Accepted Answer

RADIUS (Remote Authentication Dial-In User Service)

Answer

RADIUS provides centralized AAA services for network access, enabling healthcare organizations to manage and audit who accesses the network, when, and with what privileges from a single point.

Question 3

A CHISSP professional is reviewing firewall rules for a hospital network. Which rule represents a critical security misconfiguration?

Accepted Answer

Allow any-to-any traffic with logging enabled

Answer

An 'allow any-to-any' rule eliminates the security value of a firewall by permitting all traffic regardless of source, destination, or protocol, creating an open pathway for attackers.

Question 4

What is the primary security benefit of implementing certificate-based authentication for healthcare system integrations using HL7 or FHIR APIs?

Accepted Answer

It provides strong mutual authentication, ensuring both parties are who they claim to be

Answer

Certificate-based authentication enables mutual TLS (mTLS), where both the client and server authenticate each other using digital certificates, preventing man-in-the-middle attacks and impersonation.

Question 5

A hospital's security team wants to detect lateral movement by an attacker who has already compromised an internal workstation. Which tool is MOST effective for this purpose?

Accepted Answer

Security Information and Event Management (SIEM) system with behavioral analytics

Answer

A SIEM with behavioral analytics correlates logs across the network to detect anomalous internal traffic patterns indicative of lateral movement, which perimeter tools cannot see.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP Healthcare IT Network Security & Access Control 3