CJIS Security Policy Certification — Questions and Answers

Question 1: Which scenario represents a violation of CJIS Business Continuity requirements during a system outage?

Activating the documented contingency plan within the required timeframe
Coordinating with the State CSO for manual query support
Allowing unauthenticated access to NCIC to maintain operational tempo (Correct answer)
Documenting all manual transactions performed during the outage

Correct answer: Allowing unauthenticated access to NCIC to maintain operational tempo

Allowing unauthenticated access to CJIS systems under any circumstances, including outages, violates mandatory authentication requirements.

Question 2: Under CJIS policy, what is the minimum background check requirement for personnel before accessing CJI?

Employment history verification only
Local criminal history check only
State-level fingerprint background check
FBI CJIS fingerprint-based criminal history check (Correct answer)

Correct answer: FBI CJIS fingerprint-based criminal history check

CJIS policy requires a fingerprint-based criminal history check through the FBI CJIS Division for all personnel granted access to CJI.

Question 3: Which federal law grants the FBI the authority to collect and exchange fingerprint records and criminal history information for noncriminal justice purposes?

The Patriot Act of 2001
The Privacy Act of 1974
The Computer Fraud and Abuse Act of 1986
The Compact Council provisions of the National Crime Prevention and Privacy Compact Act of 1998 (Correct answer)

Correct answer: The Compact Council provisions of the National Crime Prevention and Privacy Compact Act of 1998

The National Crime Prevention and Privacy Compact Act of 1998 established the legal framework for interstate sharing of criminal history records for noncriminal justice background checks.

Question 4: Which of the following is a key difference between a disaster recovery plan (DRP) and a business continuity plan (BCP)?

A BCP is specific to natural disasters; a DRP covers cyberattacks only
A DRP focuses on IT systems recovery; a BCP addresses maintaining all critical business functions (Correct answer)
A DRP and BCP are interchangeable terms under CJIS policy
A DRP is required by CJIS; a BCP is optional for law enforcement agencies

Correct answer: A DRP focuses on IT systems recovery; a BCP addresses maintaining all critical business functions

A DRP specifically addresses restoring IT infrastructure, while a BCP encompasses the broader continuity of all essential agency operations.

Question 5: An agency's audit log shows that a user queried 500 criminal records in one hour outside business hours. The BEST first response is to:

Ignore it since the user has a valid account
Purge the audit log to protect the user's privacy
Flag it as an anomaly, investigate to determine if it constitutes an incident, and document findings (Correct answer)
Immediately terminate the user's employment

Correct answer: Flag it as an anomaly, investigate to determine if it constitutes an incident, and document findings

Anomalous query volume should be flagged and investigated to determine if it constitutes a reportable CJIS security incident before taking further action.

Question 6: Which of the following is a key learning objective of CJIS media protection training?

Broadcasting agency activity on local news channels
Managing public records requests through media outlets
Proper sanitization or destruction of media containing CJI before disposal (Correct answer)
How to post department news on social media platforms

Correct answer: Proper sanitization or destruction of media containing CJI before disposal

CJIS media protection training teaches personnel to sanitize or destroy storage media containing CJI before disposal to prevent unauthorized data recovery.

Question 7: Which CJIS Security Policy requirement mandates that agencies identify and document hardware and software components of systems that store, process, or transmit CJIS data?

Configuration Management and Change Control (Correct answer)
Physical Protection policy
Identification and Authentication policy
Audit and Accountability policy

Correct answer: Configuration Management and Change Control

The Configuration Management and Change Control requirement mandates that agencies maintain an inventory of hardware and software components handling CJIS data.

Question 8: An agency wants to donate old computers previously used to access CJI to a local school. What must occur FIRST before the computers leave agency control?

All storage media in the computers must be sanitized or physically destroyed to remove CJI (Correct answer)
The agency must obtain a donation permit from the state CJIS Systems Agency
The agency must install monitoring software so donated computers can still be audited
The computers must be reformatted using only FBI-approved sanitization software

Correct answer: All storage media in the computers must be sanitized or physically destroyed to remove CJI

Before computers that stored CJI leave agency control for any reason, all storage media must be sanitized using an approved method or physically destroyed to prevent unauthorized access to CJI.

Question 9: Which of the following best describes 'insider threat' awareness as it applies to CJIS training?

Network attacks originating from outside the agency perimeter
Threats exclusively from foreign nation-state actors
Risk posed by current or former employees misusing authorized CJI access (Correct answer)
Physical intrusion by external criminals into agency facilities

Correct answer: Risk posed by current or former employees misusing authorized CJI access

Insider threats involve individuals with legitimate or former access who misuse that access, making them a critical focus area in CJIS security awareness training.

Question 10: What is a 'hot site' in the context of CJIS disaster recovery planning?

A fully equipped alternate site that can assume operations immediately (Correct answer)
A facility with power but no equipment installed
A geographic location with favorable climate for data centers
A site that takes 72 hours or more to become operational

Correct answer: A fully equipped alternate site that can assume operations immediately

A hot site is a fully equipped, continuously operational alternate facility that can take over CJIS functions with minimal delay.

Question 11: A CJIS terminal operator notices their account was used to query the NCIC while they were on vacation. What type of incident does this represent?

Insider threat with authorized credentials
Unauthorized use of credentials—a potential identity compromise incident (Correct answer)
An authorized proxy access under emergency provisions
A routine supervisory access event

Correct answer: Unauthorized use of credentials—a potential identity compromise incident

Use of a terminal operator's credentials without their knowledge constitutes unauthorized access and a credential compromise incident requiring reporting.

Question 12: What is the primary purpose of a forensic image taken during a CJIS incident investigation?

To create a working backup for disaster recovery
To speed up system restoration by having a ready snapshot
To preserve evidence in a forensically sound manner that supports legal or administrative proceedings (Correct answer)
To comply with FISMA annual reporting requirements

Correct answer: To preserve evidence in a forensically sound manner that supports legal or administrative proceedings

Forensic imaging preserves evidence in an unaltered, legally defensible state to support potential criminal prosecution or administrative action.

Question 13: In the context of CJIS certification, what is the most important consideration when implementing training & awareness programs?

Delegating all responsibilities to junior staff
Completing implementation as quickly as possible regardless of quality
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)
Minimizing documentation to save time

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing training & awareness programs, CJIS professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 14: What is the primary purpose of the CJIS Security Addendum that personnel must acknowledge?

To request elevated system privileges
To certify agreement to safeguard CJI and comply with CJIS policy (Correct answer)
To authorize billing for system access
To register personal devices for remote access

Correct answer: To certify agreement to safeguard CJI and comply with CJIS policy

The CJIS Security Addendum is a binding agreement where personnel certify they understand and will comply with CJIS security requirements for protecting CJI.

Question 15: During incident recovery, a CJIS agency restores a terminal from a backup. What must occur BEFORE reconnecting the terminal to CJIS systems?

A new NCIC terminal agreement must be signed
The terminal must be replaced with new hardware
The terminal must be physically relocated to a new room
Verification that the restored system is patched, hardened, and no longer compromised (Correct answer)

Correct answer: Verification that the restored system is patched, hardened, and no longer compromised

Before reconnecting a restored terminal, the agency must verify that it is fully patched, properly hardened, and free of compromise to prevent reintroduction of the threat.

Question 16: According to the CJIS Security Policy, what must occur before disposing of physical media that contains Criminal Justice Information (CJI)?

The media must be stored in a secure vault for 10 years before disposal
The media must be returned to the FBI for disposal
The media must be sanitized using an approved method to render CJI unrecoverable (Correct answer)
The media must be encrypted and then deleted

Correct answer: The media must be sanitized using an approved method to render CJI unrecoverable

CJIS requires that all media containing CJI be sanitized using an approved method—overwriting, degaussing, or physical destruction—before disposal so the data cannot be recovered.

Question 17: What is the CJIS-required minimum number of previous passwords that must be remembered to prevent password reuse?

5 previous passwords
3 previous passwords
There is no password history requirement
10 previous passwords (Correct answer)

Correct answer: 10 previous passwords

CJIS Security Policy requires systems to remember the last 10 passwords to prevent users from reusing recent passwords.

Question 18: Which scenario best describes a 'need-to-know' violation that CJIS training should address?

An officer running a plate check on a stolen vehicle
A detective querying NCIC for a suspect in an active investigation
An officer looking up a neighbor's criminal history out of personal curiosity (Correct answer)
A dispatcher verifying a driver's license status during a traffic stop

Correct answer: An officer looking up a neighbor's criminal history out of personal curiosity

Querying CJI for personal curiosity rather than an official law enforcement purpose violates the 'need-to-know' principle central to CJIS policy.

Question 19: What does a Business Impact Analysis (BIA) primarily identify in the context of CJIS-covered systems?

The number of authorized users per system
The financial cost of upgrading hardware
Critical functions and the effect of their disruption (Correct answer)
Compliance gaps in physical security

Correct answer: Critical functions and the effect of their disruption

A BIA identifies mission-critical functions and quantifies the impact of their disruption to prioritize recovery efforts.

Question 20: Which of the following is an example of a configuration management control required for CJIS-connected systems?

Disabling unused ports, protocols, and services (Correct answer)
Auto-approving all vendor-pushed firmware updates
Allowing users to install personal applications
Granting all users local administrator rights

Correct answer: Disabling unused ports, protocols, and services

Disabling unused ports, protocols, and services reduces the attack surface of CJIS-connected systems, which is a key configuration management control.

Question 21: What is the minimum password length required by the CJIS Security Policy for accounts accessing CJI?

8 characters (Correct answer)
6 characters
10 characters
12 characters

Correct answer: 8 characters

The CJIS Security Policy mandates a minimum password length of 8 characters for accounts that access Criminal Justice Information.

Question 22: Which of the following scenarios would trigger a mandatory report to the FBI CJIS Division under CJIS Security Policy?

A help desk ticket for a forgotten password
A staff member printing CJI for an authorized investigation
Routine maintenance causing a 10-minute NCIC outage
Discovery that CJI was accessed or exfiltrated by an unauthorized party (Correct answer)

Correct answer: Discovery that CJI was accessed or exfiltrated by an unauthorized party

Unauthorized access to or exfiltration of CJI is a confirmed security incident that triggers mandatory reporting to the FBI CJIS Division.

Question 23: A CJIS audit reveals that an agency's network has no intrusion detection capability. Which CJIS control area does this violate?

Network Security (boundary protection and intrusion detection) (Correct answer)
Physical Protection
Personnel Security
Incident Response

Correct answer: Network Security (boundary protection and intrusion detection)

CJIS Network Security policy requires intrusion detection capability to monitor for unauthorized access attempts.

Question 24: Which of the following BEST describes the role of the CJIS Systems Agency Information Security Officer (CJIS ISO) during an incident?

Performing all forensic analysis independently
Notifying the media of the breach
Serving as the primary contact and coordinator for security incidents affecting CJI at the agency level (Correct answer)
Approving new system purchases during the incident

Correct answer: Serving as the primary contact and coordinator for security incidents affecting CJI at the agency level

The CJIS ISO serves as the primary security point of contact and coordinator for incidents affecting CJI within the agency.

Question 25: What role does continuous improvement play in digital evidence management for CJIS certified professionals?

It is optional and only necessary during certification renewal
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)
It applies only to new professionals in their first year
It focuses exclusively on cost reduction

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in digital evidence management, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 26: What is the maximum time an agency has to enter a wanted person record into NCIC after issuance of a warrant?

72 hours
10 business days
48 hours
24 hours (Correct answer)

Correct answer: 24 hours

CJIS policy and the NCIC Compact require agencies to enter wanted person records within 24 hours of warrant issuance.

Question 27: Which of the following best describes the CJIS Security Policy definition of 'media' in the context of media protection?

Any physical item that can store CJI, including digital storage devices and paper documents (Correct answer)
Only digital storage devices such as hard drives, USB drives, and optical discs
Only removable media such as USB drives, CDs, and external hard drives
Only cloud-based storage locations where CJI is backed up

Correct answer: Any physical item that can store CJI, including digital storage devices and paper documents

CJIS defines media broadly to include any physical item capable of storing CJI—both electronic/digital storage and paper or printed records—ensuring comprehensive protection requirements.

Question 28: Which of the following is NOT a required component of a CJIS-compliant incident response plan?

A list of all approved vendors for law enforcement equipment purchases (Correct answer)
Roles and responsibilities for incident response team members
Criteria for determining the severity of a security incident
Procedures for reporting incidents to the FBI CJIS Division

Correct answer: A list of all approved vendors for law enforcement equipment purchases

Vendor purchasing lists are not a component of an incident response plan; the plan focuses on detection, reporting, roles, and severity criteria.

Question 29: Which port is commonly used for HTTPS traffic, which CJIS recommends for secure web-based CJI access?

Port 21
Port 80
Port 443 (Correct answer)
Port 8080

Correct answer: Port 443

HTTPS operates on port 443 and uses TLS encryption, meeting CJIS requirements for secure web-based data transmission.

Question 30: An agency discovers a duplicate record in NCIC for the same wanted person. What is the correct action?

Cancel the older record and consolidate information into one active record (Correct answer)
Leave both records active to ensure the hit is returned
Flag both records for supervisory review without making changes
Contact the FBI CJIS Division to merge the records automatically

Correct answer: Cancel the older record and consolidate information into one active record

Duplicate records must be resolved by canceling the redundant entry to prevent data integrity issues and false multiple-hit returns.

Question 31: When sharing CJI across state lines, which standard governs the encryption requirements for data in transit?

AES-128 minimum standard
FIPS 140-2 validated encryption (Correct answer)
SSL/TLS 1.0 compliant protocols
Agency-defined encryption policies

Correct answer: FIPS 140-2 validated encryption

CJIS policy requires FIPS 140-2 validated encryption for all CJI transmitted across public networks, including interstate transmissions.

Question 32: An agency's MDM solution flags a mobile device as jailbroken. According to CJIS Security Policy best practices, the agency should:

Immediately block the device from accessing CJI and investigate (Correct answer)
Notify the device manufacturer and await their guidance
Allow limited read-only CJI access until the device is inspected
Re-image the device and return it to service after 30 days

Correct answer: Immediately block the device from accessing CJI and investigate

A jailbroken device bypasses security controls and cannot be trusted to protect CJI; CJIS Policy requires that non-compliant devices be denied access until remediated.

Question 33: How can incident response be improved?

Delay training
Ignore updates
No drills
Regular drills and updates (Correct answer)

Correct answer: Regular drills and updates

Incident response capabilities are significantly improved through regular drills and exercises, which allow teams to practice their roles and identify weaknesses in the plan. Continuous updates to the plan, based on lessons learned from drills and evolving threats, ensure its ongoing effectiveness and relevance in a dynamic threat landscape.

Question 34: A law enforcement agency contracts with a private company to manage its records management system containing CJI. What training requirement applies to the contractor's employees?

Training only if they are on-site at the agency
The same CJIS security awareness training as agency personnel (Correct answer)
Training is the contractor's sole responsibility without agency oversight
No training required since they are not sworn officers

Correct answer: The same CJIS security awareness training as agency personnel

Contractor employees with access to CJI must meet the same security awareness training requirements as direct agency employees under CJIS policy.

Question 35: A criminal justice agency discovers that an unauthorized individual accessed the NCIC system. Which is the FIRST step in the incident response process?

Documentation and identification of the incident (Correct answer)
Eradication of the threat
Lessons-learned meeting
Recovery of affected systems

Correct answer: Documentation and identification of the incident

Identification and documentation is the first step in incident response, establishing that an incident occurred before any other action.

Question 36: When must a CJIS incident response plan be updated?

Only when directed by the FBI CJIS Division
Every five years as part of the agency accreditation cycle
At least annually and following any significant change or incident (Correct answer)
After every security event, regardless of severity

Correct answer: At least annually and following any significant change or incident

Incident response plans must be reviewed and updated at least annually and after any significant change to the agency's environment or after an actual incident.

Question 37: Under CJIS policy, which of the following best describes a 'noncriminal justice agency' in the context of CJI access?

A federal agency with law enforcement powers
A private entity or government agency that accesses CJI for non-law-enforcement purposes (Correct answer)
A tribal court handling criminal proceedings
A state corrections department managing inmate records

Correct answer: A private entity or government agency that accesses CJI for non-law-enforcement purposes

A noncriminal justice agency is any entity — public or private — that accesses CJI for purposes other than law enforcement or prosecution.

Question 38: What is a key component of incident documentation?

No documentation
Minimal notes
Detailed records (Correct answer)
Ignore incidents

Correct answer: Detailed records

Detailed records are a key component of incident documentation because they provide a comprehensive and accurate account of the incident, including its timeline, impact, and all actions taken. This thorough documentation is essential for post-incident analysis, legal compliance, and improving future response strategies.

Question 39: In the context of CJIS certification, what is the most important consideration when implementing interagency data sharing protocols?

Minimizing documentation to save time
Completing implementation as quickly as possible regardless of quality
Delegating all responsibilities to junior staff
Ensuring alignment with established standards, stakeholder needs, and best practices (Correct answer)

Correct answer: Ensuring alignment with established standards, stakeholder needs, and best practices

When implementing interagency data sharing protocols, CJIS professionals must ensure alignment with industry standards and stakeholder needs. Hasty implementation without proper planning often leads to compliance issues and suboptimal outcomes.

Question 40: Why is encryption important in CJIS communications?

Protects data security (Correct answer)
Confuses users.
Delays data transmission.
Increases data size.

Correct answer: Protects data security

Encryption protects data from being intercepted or tampered with during transmission.

Question 41: Under CJIS media protection requirements, which of the following accurately describes an 'overwriting' sanitization technique?

Using cryptographic erasure to decrypt a drive's encryption key, making data inaccessible
Writing new data patterns over existing data to make the original data unrecoverable (Correct answer)
Applying a strong magnetic field to disrupt magnetic storage domains
Physically grinding storage platters into fine particles to destroy data

Correct answer: Writing new data patterns over existing data to make the original data unrecoverable

Overwriting replaces stored data with new data patterns (e.g., zeros, ones, or random data) across all addressable locations, preventing recovery of the original CJI through software-based means.

Question 42: Which cryptographic hash function family does CJIS policy (aligned with NIST) consider acceptable for integrity verification?

SHA-1
CRC-32
SHA-2 (e.g., SHA-256) (Correct answer)
MD5

Correct answer: SHA-2 (e.g., SHA-256)

CJIS aligns with NIST standards that require SHA-2 or higher; MD5 and SHA-1 are considered cryptographically weak.

Question 43: Which of the following is an acceptable form of two-factor authentication for entry into a CJIS physically secure location?

Photo ID presented to a guard
PIN plus a security question
Badge plus biometric scan (Correct answer)
Username plus password

Correct answer: Badge plus biometric scan

A badge (something you have) plus a biometric scan (something you are) constitutes valid two-factor authentication for physical access.

Question 44: What awareness training is required for personnel regarding CJI storage on mobile devices such as laptops?

Laptops are exempt from CJIS mobile device requirements
CJI may be stored on any mobile device if password-protected
Mobile devices storing CJI must have full-device encryption enabled (Correct answer)
CJI may be stored temporarily on personal phones if deleted within 24 hours

Correct answer: Mobile devices storing CJI must have full-device encryption enabled

CJIS policy requires that mobile devices — including agency laptops — storing CJI must have full-device encryption enabled using FIPS 140-2 validated modules.

Question 45: Under CJIS Security Policy, how frequently must personnel with access to CJI complete security awareness training?

Every 6 months
Annually (Correct answer)
Only upon initial hire
Every 2 years

Correct answer: Annually

The CJIS Security Policy requires security awareness training to be completed at least every two years, but most agencies implement annual training to align with best practices.

Question 46: What is the role of a 'write blocker' in the digital evidence acquisition process?

It verifies hash values after imaging is complete
It prevents any write commands from reaching the source media during acquisition (Correct answer)
It encrypts the forensic image as it is created
It compresses data during imaging to save storage space

Correct answer: It prevents any write commands from reaching the source media during acquisition

A write blocker intercepts all write commands directed at the source media, ensuring the original evidence remains unmodified during imaging.

Question 47: When a CJIS agency undergoes a triennial compliance audit, what training-related documentation must be available?

Only the training curriculum outline
Future training schedules and planned content
Instructor certifications from state academies only
Completed training records for all personnel with CJI access (Correct answer)

Correct answer: Completed training records for all personnel with CJI access

During audits, agencies must produce completed training records demonstrating that all CJI-authorized personnel have satisfied awareness training requirements.

Question 48: What level of confidentiality is required for CJIS data?

Shared freely within agencies.
Strict confidentiality (Correct answer)
Public access.
Accessible to all law enforcement.

Correct answer: Strict confidentiality

CJIS data must be kept strictly confidential and protected from unauthorized access.

Question 49: Under CJIS Security Policy, what is the MAXIMUM time frame within which a security incident must be reported to the FBI CJIS Division after discovery?

24 hours
72 hours (Correct answer)
48 hours
7 days

Correct answer: 72 hours

CJIS Security Policy requires that confirmed security incidents be reported to the FBI CJIS Division within 72 hours of discovery.

Question 50: Which sanitization method is MOST appropriate for a hard disk drive that contained CJI and will not be reused within the agency?

Deleting all files and emptying the recycle bin
Physical destruction such as shredding or disintegration (Correct answer)
Formatting the drive using the operating system format utility
Overwriting the drive three times with random data

Correct answer: Physical destruction such as shredding or disintegration

Physical destruction—shredding, disintegrating, or otherwise physically destroying the media—is the most assured sanitization method when a drive will not be reused, guaranteeing CJI cannot be recovered.

Question 51: Which training topic addresses the requirement to lock workstations when leaving a CJI terminal unattended?

Access control and session management awareness (Correct answer)
Digital forensics procedures
Records retention scheduling
Network segmentation training

Correct answer: Access control and session management awareness

Access control awareness training covers session management, including the requirement to lock or log off CJI terminals when leaving them unattended to prevent unauthorized access.

CJIS Security Policy Certification

The CJIS Security Policy Certification ensures individuals understand and can apply the FBI's Criminal Justice Information Services (CJIS) Security Policy to protect sensitive criminal justice information.

Questions

60 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds