Free PECB NIS 2 Directive Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB NIS 2 Directive Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An event could have compromised a network service, but was successfully prevented from materialising. Which NIS 2 term describes it?

   1. A.An incident
   2. B.A near missCorrect answer: B
   3. C.A vulnerability
   4. D.A significant cyber threat

   Explanation: The event could have compromised a service but was prevented from materialising, so it is a near miss. The directive states: "‘near miss’ means an event that could have compromised the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems, but that was successfully prevented from materialising or that did not materialise".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 6(5)

2. 2Under Article 20, what must the management body of an essential or important entity do with its Article 21 risk-management measures?

   1. A.Approve the measures and oversee their implementationCorrect answer: A
   2. B.Approve the measures but leave implementation without management oversight
   3. C.Oversee implementation without approving the measures
   4. D.Delegate both approval and oversight to the competent authority

   Explanation: Management bodies approve the measures and oversee their implementation. The directive states: "approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 20(1)

3. 3Under NIS 2, what distinguishes an incident from a near miss?

   1. A.An incident compromises protected properties or servicesCorrect answer: A
   2. B.An incident only threatens a future compromise
   3. C.An incident must affect at least two Member States
   4. D.An incident requires an exploitable product flaw

   Explanation: An incident involves an actual compromise; a near miss is prevented or does not materialise. The directive states: "‘incident’ means an event compromising the availability, authenticity, integrity or confidentiality".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 6(6)

4. 4What training requirement does Article 20 apply to management body members of essential and important entities?

   1. A.Management members must follow training to identify risks and assess practicesCorrect answer: A
   2. B.Management members need training only after a significant incident
   3. C.Management members need training only if they operate the network personally
   4. D.Management training is optional while employee training is mandatory

   Explanation: The required training supports identifying risks and assessing risk-management practices and their impact. The directive states: "the members of the management bodies of essential and important entities are required to follow training".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 20(2)

5. 5How does NIS 2 express the risk associated with an incident?

   1. A.As the number of affected systems and users
   2. B.As response cost combined with recovery time
   3. C.As loss or disruption magnitude and incident likelihoodCorrect answer: C
   4. D.As the age of the flaw and the threat source

   Explanation: The definition combines the magnitude of potential loss or disruption with the likelihood of the incident. The directive states: "a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 6(9)

6. 6An essential entity discovers it does not comply with Article 21(2) measures. What does Article 21 require it to do?

   1. A.Take necessary, appropriate and proportionate corrective measures without undue delayCorrect answer: A
   2. B.Wait for a binding authority order before taking corrective measures
   3. C.Defer necessary corrective measures until the next scheduled risk assessment
   4. D.Take corrective measures only after a significant incident occurs

   Explanation: The entity must take corrective measures without undue delay, proportionate to the noncompliance. The directive states: "takes, without undue delay, all necessary, appropriate and proportionate corrective measures".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 21(4)

7. 7What is a vulnerability in the NIS 2 definition?

   1. A.An event that has disrupted a network service
   2. B.A weakness in an ICT product or service exploitable by a cyber threatCorrect answer: B
   3. C.An action taken to restore a compromised system
   4. D.A consequence that exceeds national response capacity

   Explanation: A vulnerability is the exploitable weakness itself, not the event, response, or consequence. The directive states: "‘vulnerability’ means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 6(15)

8. 8Which combination reflects the categories of NIS 2 cybersecurity risk-management measures?

   1. A.Technical, operational and organisational measuresCorrect answer: A
   2. B.Technical, organisational and contractual measures
   3. C.Operational, commercial and administrative measures
   4. D.Operational, organisational and accounting measures

   Explanation: Article 21 requires an appropriate and proportionate combination of technical, operational and organisational measures. The directive states: "appropriate and proportionate technical, operational and organisational measures".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 21(1)

9. 9Under the NIS 2 definition, which incident is large-scale based on its stated impact?

   1. A.A local incident within national response capacity and with no cross-border impact
   2. B.A cross-border incident with no significant impact and within each state's response capacity
   3. C.A single-state incident whose disruption exceeds that state's response capacityCorrect answer: C
   4. D.A single-state incident within national response capacity that causes a service delay

   Explanation: The disruption exceeds a Member State's response capacity, which is sufficient under Article 6(7). The other cases do not meet either stated alternative. The directive defines a large-scale incident as one that "causes a level of disruption that exceeds a Member State’s capacity to respond to it or which has a significant impact on at least two Member States".

   Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 6(7)

10. 10Which assessment includes both direct-supplier security factors expressly named in Article 21(3)?

    1. A.Supplier-specific vulnerabilities and the quality of supplier products and cybersecurity practicesCorrect answer: A
    2. B.Supplier-specific revenues and the quality of the entity's own cybersecurity practices
    3. C.Entity-specific vulnerabilities and the quality of the entity's own cybersecurity practices
    4. D.Supplier-specific revenues and the quality of supplier products and delivery practices

    Explanation: Article 21(3) also includes suppliers' secure development procedures in the assessment. The directive states: "the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices".

    Reference: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — Article 21(3)