DIS Network Security & Protocols 3 — Questions and Answers
Question 1: Which firewall rule configuration would BEST protect a PACS server while allowing authorized radiology workstations to retrieve images?
- Allow inbound DICOM traffic only from whitelisted radiology workstation IPs (Correct answer)
- Allow all inbound traffic on port 104 from any source
- Block all outbound traffic from the PACS server
- Allow inbound traffic only on port 80 and 443
Correct answer: Allow inbound DICOM traffic only from whitelisted radiology workstation IPs
Whitelisting specific IP addresses of authorized workstations ensures only approved devices can initiate DICOM connections to the PACS server.
Question 2: A DIS technician discovers the imaging network has an open Telnet service on a modality workstation. What is the recommended remediation?
- Disable Telnet and replace with SSH for remote management (Correct answer)
- Change the Telnet password to something more complex
- Enable a firewall rule to restrict Telnet to specific hours
- Monitor Telnet sessions with an IDS
Correct answer: Disable Telnet and replace with SSH for remote management
Telnet transmits data including credentials in plaintext; SSH provides encrypted, authenticated remote management as its secure replacement.
Question 3: What is the purpose of network intrusion detection system (NIDS) placement on a medical imaging network?
- To monitor network traffic for suspicious patterns that may indicate an attack (Correct answer)
- To encrypt DICOM data before transmission
- To assign IP addresses to imaging modalities
- To compress image files before storage
Correct answer: To monitor network traffic for suspicious patterns that may indicate an attack
A NIDS passively monitors network traffic and generates alerts when it detects patterns matching known attack signatures or anomalies.
Question 4: Which authentication method provides the STRONGEST security for remote access to a PACS administrator console?
- Multi-factor authentication (MFA) combining password and hardware token (Correct answer)
- Complex single password of at least 12 characters
- IP address restriction only
- LDAP authentication over port 389
Correct answer: Multi-factor authentication (MFA) combining password and hardware token
MFA requires multiple verification factors, so even if a password is compromised, unauthorized access is still prevented by the second factor.
Question 5: An imaging facility wants to ensure that only authenticated NTP servers synchronize time on DICOM devices. Which protocol version addresses this?
- NTPv4 with symmetric key or autokey authentication (Correct answer)
- NTPv1 with broadcast mode
- SNTP without authentication
- PTP (IEEE 1588) without security extensions
Correct answer: NTPv4 with symmetric key or autokey authentication
NTPv4 supports symmetric key and autokey authentication mechanisms that verify the identity of time servers before accepting synchronization.
Question 6: What is the security implication of allowing unrestricted outbound internet access from a PACS server?
- Malware could exfiltrate PHI or receive command-and-control instructions (Correct answer)
- It improves image retrieval performance
- It enables automatic DICOM software updates
- It allows radiologists to access cloud storage directly
Correct answer: Malware could exfiltrate PHI or receive command-and-control instructions
Unrestricted outbound access gives malware on a compromised PACS server a channel to send PHI to external attackers or receive instructions.
Question 7: Which log source would BEST help a DIS specialist detect brute-force login attempts against a PACS server?
- Authentication logs showing repeated failed login attempts from a single IP (Correct answer)
- DICOM transfer logs showing image retrieval timestamps
- Network bandwidth utilization graphs
- Storage capacity logs from the archive
Correct answer: Authentication logs showing repeated failed login attempts from a single IP
Authentication logs capture failed login events; a high frequency of failures from one source is a classic indicator of brute-force activity.
DIS Network Security & Protocols 3
Which firewall rule configuration would BEST protect a PACS server while allowing authorized radiology workstations to retrieve images?