DIS Cybersecurity & Risk 2 — Questions and Answers
Question 1: A digital imaging lab stores patient X-rays on a server accessible via the internet. Which control BEST reduces the risk of unauthorized access?
- Using only password authentication
- Implementing multi-factor authentication (MFA) (Correct answer)
- Disabling remote access entirely
- Storing images in unencrypted format for speed
Correct answer: Implementing multi-factor authentication (MFA)
MFA adds a second verification layer, significantly reducing the risk of credential-based unauthorized access to sensitive imaging data.
Question 2: Which type of malware specifically encrypts imaging files and demands payment for the decryption key?
- Spyware
- Adware
- Ransomware (Correct answer)
- Rootkit
Correct answer: Ransomware
Ransomware encrypts victim files and demands ransom payment in exchange for decryption keys, making it especially damaging to imaging archives.
Question 3: An imaging technician receives an email asking them to verify their PACS login credentials via a link. This is MOST likely an example of:
- A legitimate IT security audit
- A phishing attack (Correct answer)
- A brute-force attack
- A denial-of-service attack
Correct answer: A phishing attack
Phishing attacks use deceptive emails with fraudulent links to trick users into revealing login credentials or sensitive information.
Question 4: In risk management, what does the term 'residual risk' mean?
- Risk that has been completely eliminated
- Risk remaining after controls have been applied (Correct answer)
- The initial risk before any assessment
- Risk transferred to a third party
Correct answer: Risk remaining after controls have been applied
Residual risk is the level of risk that remains after security controls and countermeasures have been implemented.
Question 5: Which protocol provides encrypted transmission of DICOM images over a network?
- FTP
- HTTP
- TLS/SSL (Correct answer)
- Telnet
Correct answer: TLS/SSL
TLS/SSL encrypts data in transit, protecting DICOM image data from interception during network transmission.
Question 6: A hospital imaging department conducts a Business Impact Analysis (BIA). What is the PRIMARY purpose of this activity?
- To identify which employees need cybersecurity training
- To determine the financial and operational impact of system downtime (Correct answer)
- To select the best antivirus software
- To audit network firewall rules
Correct answer: To determine the financial and operational impact of system downtime
A BIA identifies critical functions and quantifies the impact of disruptions, informing disaster recovery and business continuity planning.
Question 7: Which security principle ensures that imaging system users can only access data necessary for their specific job role?
- Defense in depth
- Principle of least privilege (Correct answer)
- Non-repudiation
- Separation of duties
Correct answer: Principle of least privilege
The principle of least privilege restricts user access rights to only what is required for their specific job function, minimizing exposure.
DIS Cybersecurity & Risk 2
A digital imaging lab stores patient X-rays on a server accessible via the internet.
Which control BEST reduces the risk of unauthorized access?