CJIS Information Security & Access Control 3

Question 1

Which CJIS policy area specifically addresses requirements for logging and auditing access to CJI systems?

Accepted Answer

Audit and Accountability

Answer

The Audit and Accountability policy area requires agencies to create, protect, and retain audit logs of CJI access for review and investigation.

Question 2

When a CJIS-authorized user's employment is terminated, within what timeframe must their access be revoked?

Accepted Answer

Immediately upon separation

Answer

CJIS policy requires that access to CJI systems be terminated immediately when an employee leaves, is transferred, or changes roles eliminating the need for access.

Question 3

What is the purpose of a CJIS Security Addendum?

Accepted Answer

To contractually bind private entities to CJIS security requirements

Answer

The CJIS Security Addendum is a required contractual agreement that holds private sector companies to the same security standards as criminal justice agencies when handling CJI.

Question 4

Multi-factor authentication (MFA) under CJIS policy requires which combination of factors?

Accepted Answer

Something you know plus something you have or are

Answer

CJIS MFA requires at least two distinct factor types: knowledge (password/PIN), possession (token/smart card), or inherence (biometric).

Question 5

An agency discovers that a mobile device containing CJI has been lost. What is the FIRST action required under CJIS incident response procedures?

Accepted Answer

Remotely wipe the device and report the incident to the CSO

Answer

CJIS requires immediate remote wipe of the lost device and prompt notification to the agency's CJIS Systems Officer (CSO) as the first response steps.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Information Security & Access Control 3