CHISSP Healthcare IT Network Security & Access Control

Question 1

Which network segmentation strategy is most commonly recommended to isolate medical devices from general hospital IT systems?

Accepted Answer

VLAN-based segmentation with strict ACLs

Answer

VLAN-based segmentation with strict access control lists allows medical devices to be logically isolated while still permitting controlled, monitored communication with clinical systems.

Question 2

A hospital's EHR system must enforce the 'minimum necessary' access principle. Which access control model best supports this requirement?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC assigns access rights based on clinical roles, ensuring each user only accesses information necessary for their specific job function, directly supporting the HIPAA minimum necessary standard.

Question 3

Under NIST guidelines, what is the primary purpose of implementing 802.1X port-based authentication on a healthcare network?

Accepted Answer

To ensure only authenticated devices connect to network segments

Answer

802.1X port-based authentication prevents unauthorized devices from connecting to the network by requiring successful authentication before granting network access.

Question 4

A healthcare organization wants to reduce the attack surface of its patient portal. Which principle should guide the configuration of the web application firewall?

Accepted Answer

Deny all traffic by default and allow only required application functions

Answer

A default-deny (whitelisting) approach minimizes attack surface by blocking all traffic except explicitly permitted application functions, reducing exposure to unknown threats.

Question 5

Which authentication mechanism provides the strongest security for remote access to a healthcare organization's clinical systems?

Accepted Answer

Multi-factor authentication combining something you know and something you have

Answer

Multi-factor authentication requiring two different credential types (e.g., password plus a hardware token) significantly reduces the risk of unauthorized access even if one factor is compromised.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP Healthcare IT Network Security & Access Control