CRM Information Security & Privacy 2

Question 1

Which principle of information security ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality

Answer

Confidentiality is the CIA triad principle that restricts information access to authorized parties only.

Question 2

A records manager discovers that an employee copied sensitive client records to a personal USB drive. This is BEST classified as a:

Accepted Answer

Data breach through insider threat

Answer

Unauthorized copying of sensitive records by an employee constitutes an insider threat data breach.

Question 3

Under HIPAA, which of the following is considered Protected Health Information (PHI)?

Accepted Answer

A patient's name combined with their diagnosis

Answer

PHI includes any individually identifiable health information, such as a patient's name linked to their medical condition.

Question 4

What is the primary purpose of a data classification policy in records management?

Accepted Answer

To categorize information by sensitivity and apply appropriate controls

Answer

Data classification policies categorize records by sensitivity level so that appropriate security controls can be applied to each category.

Question 5

Which encryption standard is currently recommended by NIST for protecting sensitive federal records at rest?

Accepted Answer

AES-256 (Advanced Encryption Standard)

Answer

NIST recommends AES-256 as the current standard for strong encryption of sensitive data at rest.

(CRM) Certified Records Manager Practice Test