CJIS Information Security & Access Control 2

Question 1

Under CJIS policy, what is the minimum encryption standard required for data-in-transit over public networks?

Accepted Answer

Advanced Encryption Standard (AES) 256-bit

Answer

CJIS Security Policy requires AES 256-bit encryption for CJI transmitted over public networks.

Question 2

Which type of access control model assigns permissions based on an individual's job function within the organization?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC grants access rights based on predefined roles corresponding to job functions, which CJIS recommends as the baseline model.

Question 3

A law enforcement officer attempts to log into the RMS after five failed password attempts. What should the system do according to CJIS policy?

Accepted Answer

Lock the account and require administrator reset

Answer

CJIS policy requires accounts to be locked after no more than five consecutive failed login attempts, requiring administrator intervention to unlock.

Question 4

What does the principle of 'need to know' mean in the context of CJIS information access?

Accepted Answer

Access is granted only when required for official law enforcement duties

Answer

'Need to know' limits CJI access to individuals who require it to perform their official, authorized duties.

Question 5

Which CJIS security area governs the physical protection of locations where CJI is processed or stored?

Accepted Answer

Physical Protection

Answer

The Physical Protection policy area establishes controls for securing facilities and equipment that process or store CJI.

(CJIS) Criminal Justice Information Services Certified Practice Test