CJIS Incident Response & System Auditing 3

Question 1

Under CJIS Security Policy, audit logs must be retained for a minimum of how long?

Accepted Answer

1 year

Answer

CJIS Security Policy mandates that audit logs be retained for a minimum of one year to support investigations and reviews.

Question 2

Which of the following BEST describes the role of the CJIS Systems Agency Information Security Officer (CJIS ISO) during an incident?

Accepted Answer

Serving as the primary contact and coordinator for security incidents affecting CJI at the agency level

Answer

The CJIS ISO serves as the primary security point of contact and coordinator for incidents affecting CJI within the agency.

Question 3

An agency detects repeated failed login attempts on the CJIS terminal at 3 AM. Under incident response procedures, this FIRST qualifies as:

Accepted Answer

A security event requiring evaluation to determine if it is an incident

Answer

Repeated failed logins are a security event; further evaluation is required to determine whether it constitutes a reportable incident.

Question 4

Which phase of incident response focuses on removing the root cause of the compromise from affected CJIS systems?

Accepted Answer

Eradication

Answer

The eradication phase involves removing malware, closing vulnerabilities, or eliminating any other root cause of the incident.

Question 5

A CJIS-compliant audit system must protect audit logs from which of the following?

Accepted Answer

Unauthorized modification, deletion, or access

Answer

CJIS requires that audit logs be protected from unauthorized modification, deletion, or access to preserve their integrity as evidence.

(CJIS) Criminal Justice Information Services Certified Practice Test