CCE Medical Device Cybersecurity and Information Security 2

Question 1

What is the primary cybersecurity concern when medical devices run legacy operating systems such as Windows XP?

Accepted Answer

Lack of manufacturer support and availability of security patches

Answer

Higher power consumption leading to increased operating costs

Answer

Reduced processing speed affecting device performance

Answer

Incompatibility with modern display technology

Question 2

Which IEC standard specifically addresses risk management for IT networks that incorporate medical devices?

Accepted Answer

IEC 80001-1 (Risk management of IT networks incorporating medical devices)

Answer

IEC 62304 (Medical device software lifecycle)

Answer

IEC 62443 (Industrial automation security)

Answer

ISO 14971 (Medical device risk management)

Question 3

What does the security principle of 'defense in depth' mean in the context of medical device cybersecurity?

Accepted Answer

Implementing multiple overlapping layers of security controls to protect medical devices

Answer

Using a single, highly capable firewall to protect all clinical network devices

Answer

Encrypting only the most sensitive patient data stored on devices

Answer

Restricting all physical access to server rooms containing device data

Question 4

What is a 'zero-day vulnerability' in the context of medical device security?

Accepted Answer

A security flaw unknown to the vendor with no available patch

Answer

A vulnerability discovered on the first day of device deployment in a facility

Answer

A device that has never been connected to a network

Answer

A vulnerability that only affects devices older than one year

Question 5

Which organization maintains the Common Vulnerability Scoring System (CVSS) used to rate cybersecurity vulnerability severity?

Accepted Answer

FIRST (Forum of Incident Response and Security Teams)

Answer

Food and Drug Administration (FDA)

Answer

National Institute of Standards and Technology (NIST)

Answer

International Electrotechnical Commission (IEC)

Question 6

What is the recommended initial action when a critical cybersecurity vulnerability is discovered in an active clinical medical device?

Accepted Answer

Follow the facility's incident response plan and notify the manufacturer and FDA as appropriate

Answer

Immediately disconnect all affected devices from the network regardless of patient impact

Answer

Continue normal operations and wait until the device warranty expires to replace it

Answer

Replace all affected devices immediately without consulting the manufacturer

Question 7

What type of cyberattack involves intercepting and potentially altering communications between a medical device and its connected network?

Accepted Answer

Man-in-the-Middle (MitM) attack on device communications

Answer

Denial of Service (DoS) attack targeting device availability

Answer

SQL injection attack on the device database

Answer

Phishing attack targeting clinical staff credentials