CJIS Incident Response & System Auditing 2

Question 1

Under CJIS Security Policy, what is the MAXIMUM time frame within which a security incident must be reported to the FBI CJIS Division after discovery?

Accepted Answer

72 hours

Answer

CJIS Security Policy requires that confirmed security incidents be reported to the FBI CJIS Division within 72 hours of discovery.

Question 2

Which action is MOST critical during the containment phase of a CJIS-related security incident?

Accepted Answer

Isolating affected systems to prevent further unauthorized access to CJI

Answer

Isolating affected systems prevents further unauthorized access to Criminal Justice Information during the containment phase.

Question 3

A CJIS audit log must capture which of the following elements at minimum?

Accepted Answer

User ID, date/time, type of event, and success or failure of event

Answer

CJIS audit logs must at minimum capture user ID, date/time stamp, type of event, and whether the event succeeded or failed.

Question 4

During a post-incident review of a CJIS breach, investigators find that audit logs were overwritten before analysis. What CJIS requirement was violated?

Accepted Answer

Audit log retention requirements

Answer

CJIS Security Policy requires audit logs to be retained for a minimum period so they are available for post-incident forensic analysis.

Question 5

Which entity is primarily responsible for coordinating incident response when CJI stored by a local agency is compromised?

Accepted Answer

The local agency's CSO in coordination with the SIB and FBI CJIS Division

Answer

The local agency's CJIS Systems Officer coordinates with the State Identification Bureau and FBI CJIS Division during a CJI compromise.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Incident Response & System Auditing 2