Free C)HISSP Practice Questions

Question 1

Ransomware is spreading from nursing-station workstations on a ward network. Infusion pumps on the same network are still delivering prescribed treatment. Disconnecting the entire ward would remove central alarm monitoring before alternative monitoring could be arranged. IT can isolate the affected workstations without interrupting the pumps. How should the incident commander begin containment?

Accepted Answer

Isolate the affected workstations and coordinate downtime procedures with nursing staff.

Answer

Block the ward's internet access while retaining its internal connections to support ongoing treatment.

Answer

Disconnect the entire ward network immediately, then arrange replacement monitoring at each bedside.

Answer

Keep the affected workstations connected until investigators have captured complete memory images.

Question 2

A verified cardiologist at another practice requests a patient's recent electrocardiogram and medication history for ongoing treatment. No special confidentiality law or agreed restriction applies. Which response accurately applies HIPAA to the request?

Accepted Answer

Send the requested records securely for treatment without requiring the patient's authorization.

Answer

Require the patient's written authorization because the treating cardiologist works for a separate organization.

Answer

Require a minimum-necessary review because the treatment exemption applies only within the same organization.

Answer

Require a business associate agreement with the treating cardiologist.

Question 3

A cloud company will retain a hospital's encrypted patient-record backups for seven years. The hospital alone controls the decryption keys, and the company cannot read the records. The company argues that it therefore needs no business associate agreement. Under HIPAA, how should this relationship be classified?

Accepted Answer

A business associate relationship, because the company maintains electronic PHI for the hospital.

Answer

A covered entity relationship, because the company independently stores records used to support healthcare.

Answer

A relationship outside HIPAA, because withholding the decryption keys makes the retained information de-identified.

Answer

A conduit relationship, because the company cannot decrypt the hospital's retained records.

Question 4

A vulnerability review identifies a CVSS v3.1 base score of 9.8 on a network-isolated research workstation containing no patient data, and a score of 7.5 on an internet-facing patient portal. A current threat advisory confirms exploitation of the portal flaw at other organizations. Neither local system shows evidence of compromise, and both patches are equally straightforward to deploy. Which prioritization is justified?

Accepted Answer

Patch the portal first; its exposure and the exploitation evidence outweigh the difference in base scores.

Answer

Patch the portal first; a base score of 7.5 indicates a 75 percent probability of successful exploitation.

Answer

Patch the workstation first; a Critical base severity must take precedence over a High base severity.

Answer

Defer both patches until Environmental scores are calculated; base scores cannot support a remediation decision.

Question 5

An electronic health record recovery exercise produces this log:
Outage begins: 10:00.
Service restored and clinically validated: 11:10.
Latest recoverable committed transaction: 09:40; nothing later is recoverable.

The approved recovery time objective is two hours and the recovery point objective is 15 minutes. What should the exercise report recommend?

Accepted Answer

Improve recoverable data currency; the recovery time objective was met, but the recovery point objective was missed.

Answer

Shorten service restoration time; the recovery time objective was missed, but the recovery point objective was met.

Answer

Retain both arrangements; restoration time and recovered data currency met their objectives.

Answer

Improve both recovery arrangements; the elapsed restoration time and the age of the recovered data exceeded their objectives.

Question 6

A clinician enters a password and a six-digit authenticator-app code into a convincing imitation of the hospital login page. The attacker immediately relays both to the real site and obtains a valid session. Which authentication change specifically defeats this real-time credential-relay mechanism?

Accepted Answer

Replace manually entered codes with FIDO2 security keys using WebAuthn.

Answer

Reduce each authenticator-app code's validity period from 60 seconds to 30 seconds.

Answer

Use hardware tokens with manually entered one-time codes.

Answer

Send the one-time codes to a registered mobile number by text message.

Question 7

For an approved health-services research project, a hospital prepares a dataset that retains full admission and discharge dates and five-digit ZIP codes. Every direct identifier prohibited in a HIPAA limited data set has been removed. The researchers need the retained fields for their analysis. Which release arrangement preserves those fields without misclassifying the data?

Accepted Answer

Release it as a limited data set under a data use agreement; it remains PHI.

Answer

Release it under a data use agreement permitting the researchers to reidentify participants for follow-up.

Answer

Release it under Safe Harbor without a data use agreement.

Answer

Require individual authorizations; full dates and five-digit ZIP codes are prohibited in every limited data set.

Question 8

"The opinion is unmodified, so the whole service is covered," says a procurement manager reviewing a prospective billing vendor's SOC 2 Type 2 report. The report, however, expressly excludes controls at the subcontractor storing the patient-data backups. What additional due diligence addresses the actual gap?

Accepted Answer

Assess the backup subcontractor's relevant controls and the billing vendor's oversight of that subcontractor.

Answer

Obtain a SOC 2 Type 1 report with the same scope.

Answer

Reject the vendor solely because excluding a subcontractor makes an otherwise unmodified report unusable.

Answer

Accept the report for the entire service because an unmodified opinion extends to the vendor's subcontractors.

Question 9

After two hospitals merge their laboratory feeds, results begin appearing in the wrong patient charts. Each hospital historically assigned medical record numbers independently, but the receiving system matches records using the number alone. The affected feed has been paused. Which correction addresses the identification defect before processing resumes?

Accepted Answer

Match each local record number within its issuing facility's namespace before mapping to the enterprise patient record.

Answer

Assign enterprise identifiers to newly registered patients while continuing number-only matching for all existing patient records.

Answer

Automatically merge records with the same local number whenever the patients also share a date of birth.

Answer

Append the patient's surname to each local record number and use that pair as the permanent enterprise matching key.

Question 10

A hospital estimates that a particular archive outage costs $240,000 per occurrence and occurs, on average, once every four years. A resilience service costing $25,000 annually would reduce the frequency to once every 12 years without changing the loss per occurrence. Mandatory safeguards and patient-safety requirements are satisfied with or without the service. Considering only the stated annualized financial effects, which recommendation follows?

Accepted Answer

Purchase the service; its expected net financial benefit is $15,000 per year.

Answer

Decline the service; its expected net financial effect is a $5,000 annual loss.

Answer

Purchase the service; its expected net financial benefit is $35,000 per year.

Answer

Purchase the service; its expected net financial benefit is $40,000 per year.

Free C)HISSP Practice Questions

Domain 1: Intro to the Healthcare Industry

Question 1

Question 2

Domain 2: Regulatory Environment

Question 3

Question 4

Domain 3: Healthcare Privacy & Security Policies

Question 5

Domain 4: Information Governance & Risk Management

Question 6

Question 7

Domain 5: Information Governance & Risk Assessment

Question 8

Domain 6: Third-Party Risk Management

Question 9

Question 10

That's 10 of 1,030