CJIS Media Protection & Sanitization 2

Question 1

What encryption standard must removable media meet when used to transport CJI outside of a physically secure location, per the CJIS Security Policy?

Accepted Answer

FIPS 140-2 or FIPS 140-3 validated encryption using AES-256

Answer

The CJIS Security Policy requires CJI transported on removable media to be encrypted using FIPS 140-2 (or 140-3) validated modules with AES-256 to ensure data confidentiality.

Question 2

Which of the following best describes the CJIS Security Policy definition of 'media' in the context of media protection?

Accepted Answer

Any physical item that can store CJI, including digital storage devices and paper documents

Answer

CJIS defines media broadly to include any physical item capable of storing CJI—both electronic/digital storage and paper or printed records—ensuring comprehensive protection requirements.

Question 3

When CJI media must be transported from one agency location to another, what is the primary CJIS requirement?

Accepted Answer

The media must be protected from unauthorized access throughout transport using encryption or physical controls

Answer

CJIS requires that CJI media be protected from unauthorized access during transport, typically through encryption, locked containers, or other controls ensuring confidentiality and integrity.

Question 4

An agency wants to donate old computers previously used to access CJI to a local school. What must occur FIRST before the computers leave agency control?

Accepted Answer

All storage media in the computers must be sanitized or physically destroyed to remove CJI

Answer

Before computers that stored CJI leave agency control for any reason, all storage media must be sanitized using an approved method or physically destroyed to prevent unauthorized access to CJI.

Question 5

What is the CJIS Security Policy requirement for media containing CJI that is sent to a third-party vendor for repair?

Accepted Answer

CJI must be removed or sanitized from the media before it is sent to the vendor, or the vendor must operate under an appropriate agreement with security controls

Answer

CJIS requires that CJI be removed or sanitized before media goes to a third-party vendor, or the vendor must be bound by appropriate agreements and security controls to protect the CJI.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Media Protection & Sanitization 2