Coding
This one-word coding practice means checking for unexpected or dangerous input before processing it.
Validation
This type of risk is unique to systems that handle sensitive health data.
Confidentiality Risk
A user clicks a fake hospital login link. What attack is this?
Phishing
You remove admin rights from employee laptops to limit damage from accidental installs. What’s this strategy?
Principle of Least Privilege
Which is a preventative control: encryption or firewall?
Firewall
Your codebase uses hardcoded API keys that got leaked. What mitigation should you implement going forward?
Environment variables
This term means healthcare errors are reviewed to prevent future ones.
Audit(ed)
You open a PDF from an unknown sender, and it silently installs spyware. What type of file is that?
Trojan
What policy helps ensure employees follow security protocols, such as using strong passwords?
Security Awareness Training
Which is more likely to occur: a software bug or a hardware failure?
A Software Bug
Integrating automated security scans into the SDLC is part of which modern development approach?
DevSecOps
Rules and procedures limiting visibility to patient information are an example of this control type.
Access Control
An attacker exploits a web app by injecting malicious SQL commands. What vulnerability is this?
SQL Injection
This cryptographic mechanism uses a pair of keys: one public, one private, to secure communication.
Asymmetric
When evaluating risks, which is more subjective: qualitative or quantitative?
Qualitative
In Python, to avoid hardcoding, you store the risk threshold in a reusable format. What is this technique called?
Parameterization
This type of risk happens if consistent are not followed during development for health apps.
Coding Standard Noncompliance
Attackers hijack DNS records to redirect users to fake sites. What’s this attack called?
DNS Spoofing
You notice your app’s response times spike under load, risking timeouts. What risk mitigation could help keep service reliable?
Rate limiting / Throttling
Which is more proactive when configuring risk controls: penetration testing or anomaly detection?
Anomaly Detection
In Bash, what command would you use to schedule a daily security check script?
cron or crontab
Which framework provides guidelines for managing and reducing cybersecurity risks in healthcare organizations?
NIST
Attackers gain persistent access by installing code that activates every time the system boots. What malware is this?
Rootkit
You want to assess which business functions to prioritize in a disaster. What document should you create?
Business Impact Analysis (BIA)
Which is more likely to ensure traceability in risk documentation: a centralized risk register or versioned artifacts?
Versioned Artifacts