CJIS Media Protection & Sanitization 2

Question 1

What encryption standard must removable media meet when used to transport CJI outside of a physically secure location, per the CJIS Security Policy?

Accepted Answer

FIPS 140-2 or FIPS 140-3 validated encryption using AES-256

Answer

AES-128 encryption validated under FIPS 140-2

Answer

RSA-2048 public key encryption for file-level protection

Answer

Triple DES (3DES) encryption with a 112-bit key

Question 2

Which of the following best describes the CJIS Security Policy definition of 'media' in the context of media protection?

Accepted Answer

Any physical item that can store CJI, including digital storage devices and paper documents

Answer

Only digital storage devices such as hard drives, USB drives, and optical discs

Answer

Only removable media such as USB drives, CDs, and external hard drives

Answer

Only cloud-based storage locations where CJI is backed up

Question 3

When CJI media must be transported from one agency location to another, what is the primary CJIS requirement?

Accepted Answer

The media must be protected from unauthorized access throughout transport using encryption or physical controls

Answer

Transport must only occur via U.S. Postal Service Certified Mail

Answer

Transport must be approved in writing by the FBI's CJIS Division before departure

Answer

The media must be physically escorted by at least two sworn law enforcement officers

Question 4

An agency wants to donate old computers previously used to access CJI to a local school. What must occur FIRST before the computers leave agency control?

Accepted Answer

All storage media in the computers must be sanitized or physically destroyed to remove CJI

Answer

The agency must obtain a donation permit from the state CJIS Systems Agency

Answer

The agency must install monitoring software so donated computers can still be audited

Answer

The computers must be reformatted using only FBI-approved sanitization software

Question 5

What is the CJIS Security Policy requirement for media containing CJI that is sent to a third-party vendor for repair?

Accepted Answer

CJI must be removed or sanitized from the media before it is sent to the vendor, or the vendor must operate under an appropriate agreement with security controls

Answer

The vendor must be on the FBI's approved vendor list and sign an NDA

Answer

The media can be sent only if the vendor is located within the United States

Answer

The agency must notify the FBI's CJIS Division of any media sent to third parties

Question 6

Under CJIS media protection requirements, which of the following accurately describes an 'overwriting' sanitization technique?

Accepted Answer

Writing new data patterns over existing data to make the original data unrecoverable

Answer

Physically grinding storage platters into fine particles to destroy data

Answer

Using cryptographic erasure to decrypt a drive's encryption key, making data inaccessible

Answer

Applying a strong magnetic field to disrupt magnetic storage domains

Question 7

How does the CJIS Security Policy address the disposal of optical media (CDs/DVDs) that contain CJI?

Accepted Answer

Optical media must be physically destroyed since it cannot be overwritten or degaussed

Answer

Optical media must be degaussed before disposal

Answer

Optical media can be reused after reformatting using approved software

Answer

Optical media containing CJI must be stored indefinitely and never disposed of