CJIS Information Security & Access Control 4

Question 1

Under CJIS policy, which entity is ultimately responsible for ensuring that a private sector contractor complies with CJIS security requirements?

Accepted Answer

The criminal justice agency that contracted the vendor

Answer

The criminal justice agency that enters into a contract with a private vendor retains ultimate responsibility for the vendor's compliance with CJIS security requirements.

Question 2

What is the required minimum password length for accounts that access CJI according to CJIS Security Policy?

Accepted Answer

8 characters

Answer

CJIS Security Policy sets the minimum password length at 8 characters when MFA is used, with longer passwords encouraged.

Question 3

A dispatch center stores CJI on a cloud platform. What must the cloud service provider (CSP) do before the agency can use the service?

Accepted Answer

Complete a FedRAMP authorization or equivalent CJIS-approved assessment

Answer

CJIS requires that CSPs handling CJI complete an approved security assessment, with FedRAMP Moderate authorization being the recognized pathway.

Question 4

Which CJIS control governs how agencies must handle and destroy physical media (hard drives, USB drives) that contain CJI?

Accepted Answer

Media Protection

Answer

The Media Protection policy area requires agencies to sanitize or destroy physical media containing CJI using NIST SP 800-88 guidelines before disposal.

Question 5

An officer accesses a subject's NCIC record out of personal curiosity unrelated to a case. Which CJIS principle does this violate?

Accepted Answer

Need to know

Answer

Accessing CJI without an official law enforcement purpose violates the 'need to know' principle, which restricts access to authorized, duty-related queries only.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Information Security & Access Control 4