mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A hospital chain collects and stores electronic…
A hospital chain collects and stores electronic health records (EHR) for millions of patients. The EHR system is hosted in a private cloud and accessed by doctors, nurses, and administrative staff from various locations. Recently, an internal audit found that several employees shared their login credentials with colleagues to expedite workflows. The hospital must comply with HIPAA and state privacy laws. The security officer wants to implement a solution that minimizes the risk of unauthorized access due to shared credentials while still allowing efficient access for patient care. Which of the following is the BEST approach?
⚠ Common exam trap
Watch out — candidates often choose biometric authentication (C) thinking it eliminates credential sharing, but they overlook that biometrics can be bypassed or shared (e.g., a user holding a fingerprint scanner for a colleague) and introduce significant privacy and revocation challenges under HIPAA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access
SSO integrated with RBAC reduces the attack surface of shared credentials by centralizing authentication and enforcing least-privilege access based on job roles. Audit logging provides non-repudiation and traceability, which deters credential sharing and satisfies HIPAA's requirement to track access to ePHI. This combination directly addresses the root cause (shared credentials) while maintaining workflow efficiency through seamless authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement single sign-on (SSO) integrated with role-based access control (RBAC) and enforce audit logging of all access
Why this is correct
Single Sign-On (SSO) centralizes authentication, significantly reducing password fatigue and the associated risk of users resorting to insecure practices like writing down or sharing credentials. Integrated Role-Based Access Control (RBAC) ensures that users are granted only the minimum necessary privileges to perform their job functions, directly enforcing the principle of least privilege and preventing unauthorized access to sensitive EHR data. Furthermore, comprehensive audit logging creates an immutable record of all system access and data interactions, establishing clear accountability and providing a strong deterrent against credential sharing or misuse, as all actions are traceable.
- ✗
Enforce a policy requiring password changes every 30 days and complexity requirements
Why it's wrong here
While complexity requirements are beneficial, mandating frequent password changes, such as every 30 days, often backfires by increasing user frustration and password fatigue. This can compel users to choose simpler, predictable passwords or, more critically, write them down or share them to avoid the inconvenience, inadvertently weakening overall security posture rather than strengthening it. Modern security best practices prioritize strong, unique passwords combined with multi-factor authentication over arbitrary expiration.
- ✗
Replace passwords with biometric authentication (fingerprint and iris scans) for all users
Why it's wrong here
Biometric authentication, while offering convenience and strong identity verification, presents significant challenges as a sole authentication method for an entire hospital chain. Deployment across diverse devices and user scenarios can be costly and impractical, and issues like false positives/negatives or sensor failures can impede workflow. Crucially, biometrics are not secrets; if compromised, they cannot be easily changed, and a user could still physically authenticate another person, undermining the goal of preventing credential sharing.
- ✗
Disable remote access to the EHR system and require all access to occur only from within the hospital's LAN
Why it's wrong here
Completely disabling remote access to the EHR system, while seemingly enhancing perimeter security, would severely impede the operational efficiency and quality of patient care in a modern hospital chain. Clinicians frequently require secure access to patient records from various locations, including satellite clinics, on-call situations, or during emergencies. Furthermore, this measure does not address the core problem of internal credential sharing or misuse by authorized users within the LAN, failing to provide granular access control or accountability.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.