RN-BC Security Practice Questions (80 Flashcards)

The primary risk is Session Persistence or unauthorized access if a user fails to log out. In a clinical setting, SSO allows a single set of credentials to open multiple apps. If a nurse leaves a terminal without locking it, the next person has access to all integrated systems. Mitigation: Proximity badges (tap-out), aggressive inactivity timeouts, and clinical workspace managers that clear sessions upon logout. ANCC Tip: SSO does NOT inherently improve security; it improves compliance by reducing the number of passwords users must remember, but it creates a single point of failure. Key Strategy: Focus on the shared workstation aspect as it is a common clinical informatics exam scenario.

The most effective strategy is performing regular, scheduled Access Certification (or User Access Reviews). This is a formal process where department managers or the informatics team review the current permissions of all users and recertify that the access is still required for their current role. Exam Strategy: Role Creep happens when users change jobs or take on temporary projects but retain their old permissions. ANCC emphasizes that security is a lifecycle, not a one-time setup. Automated deprovisioning and periodic audits are the gold standards for preventing the gradual accumulation of unnecessary privileges.

This is Tailgating (or Piggybacking). It occurs when an unauthorized person follows an authorized person into a restricted area. **Rationale:** While often perceived as professional courtesy in a clinical setting, it is a significant security breach. **Exam Tip:** The ANCC evaluates your ability to recognize that security involves physical, administrative, and technical safeguards. Mitigation includes mantraps, turnstiles, and robust staff education on the No Badge, No Entry policy. Distractor: Baiting involves leaving physical media (like a USB) for someone to find, not physical entry.

Medical devices (Infusion pumps, monitors) often run on legacy operating systems and require manufacturer validation before updates can be applied. Informatics nurses must manage the Conflict of Availability: the device must be available for patient care, but unpatched devices are primary entry points for ransomware (e.g., WannaCry). Strategies include isolating these devices on a separate VLAN (Virtual Local Area Network) if they cannot be patched immediately.

In an Active-Active configuration, two or more nodes in a cluster work simultaneously to handle traffic. If one node fails, the others pick up the load with near-zero downtime. This provides the highest level of redundancy and ensures the RTO is near zero. Clinical Pearl: This is more resilient than Active-Passive, where a standby server must be activated. For the exam, associate Active-Active with Zero Downtime and high-cost, high-criticality systems.