CJIS Mobile Device & Cloud Security 3

Question 1

A cloud provider storing CJI experiences a data breach. Under CJIS Security Policy, the criminal justice agency must:

Accepted Answer

Notify the FBI CJIS Division and affected individuals per policy timelines

Answer

CJIS Policy requires agencies to report security incidents involving CJI to the FBI CJIS Division and comply with applicable breach notification requirements.

Question 2

Which control does CJIS Policy require to prevent unauthorized apps from accessing CJI on mobile devices?

Accepted Answer

Whitelisting approved applications through MDM policy

Answer

CJIS Policy supports application whitelisting via MDM to ensure only approved applications can run on devices that access or store CJI.

Question 3

Under CJIS Security Policy, which personnel must complete CJIS Security Awareness Training before accessing CJI through a cloud system?

Accepted Answer

All personnel and contractors with access to CJI, regardless of role

Answer

CJIS Policy requires all personnel — including contractors and cloud provider staff with unescorted access to CJI — to complete security awareness training within six months of assignment.

Question 4

What is the CJIS requirement for authenticating users who access CJI from mobile devices over a public network?

Accepted Answer

Advanced Authentication (AA) such as multi-factor authentication is required

Answer

CJIS Policy requires Advanced Authentication (AA), typically multi-factor authentication, for accessing CJI over a public network from any device including mobile.

Question 5

An agency's MDM solution flags a mobile device as jailbroken. According to CJIS Security Policy best practices, the agency should:

Accepted Answer

Immediately block the device from accessing CJI and investigate

Answer

A jailbroken device bypasses security controls and cannot be trusted to protect CJI; CJIS Policy requires that non-compliant devices be denied access until remediated.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Mobile Device & Cloud Security 3