CJIS CJIS Configuration Management & System Protection 2

Question 1

Under CJIS Security Policy, which principle guides limiting the software installed on CJIS-connected systems to only what is necessary?

Accepted Answer

Least functionality

Answer

The principle of least functionality requires that systems be configured to provide only essential capabilities, reducing the attack surface on CJIS-connected systems.

Question 2

How frequently does the CJIS Security Policy require agencies to perform vulnerability scans on systems processing CJIS data?

Accepted Answer

Periodically as defined by the agency's risk assessment

Answer

CJIS policy requires periodic vulnerability scanning with frequency informed by the agency's risk assessment and any significant system changes.

Question 3

What is a 'security impact analysis' in the context of CJIS configuration management?

Accepted Answer

An assessment of the security effects of proposed changes before they are implemented

Answer

A security impact analysis evaluates how a proposed change could affect the security posture of a CJIS system before the change is approved and deployed.

Question 4

Which of the following is an example of a configuration management control required for CJIS-connected systems?

Accepted Answer

Disabling unused ports, protocols, and services

Answer

Disabling unused ports, protocols, and services reduces the attack surface of CJIS-connected systems, which is a key configuration management control.

Question 5

Under CJIS policy, patch management requires that critical security patches be applied within what general timeframe?

Accepted Answer

As quickly as practical, but no more than within the agency's defined patching window

Answer

CJIS policy requires timely patching consistent with the agency's risk-based patching schedule, ensuring critical vulnerabilities are addressed without undue delay.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS CJIS Configuration Management & System Protection 2