NIS 2 Directive Foundation

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 1: Fundamental concepts and definitions of NIS 2

   A ransomware payload reached the file server of a company but was blocked by the endpoint protection before any file was encrypted and before any service became unavailable. Under the terminology of the Directive, how should this event be classified?

   1. An incident, because a malicious payload reached a production server
   2. A near miss, because the compromise was stopped before it materialised
   3. A significant incident, because ransomware can cause severe disruption
   4. A vulnerability, because the server was reachable by the payload

2. Domain 2: Planning of NIS 2 requirements implementation

   The board of a covered entity signs off the cybersecurity risk-management measures and then leaves execution entirely to the IT department, without any further involvement. Which duty of the management body is being missed?

   1. Drafting the technical specifications of each measure before it is deployed
   2. Handing its legal liability down to the head of the department that executes the work
   3. Certifying the entity against an international management system standard
   4. Monitoring the way in which the approved measures are actually put into practice

3. Domain 1: Fundamental concepts and definitions of NIS 2

   Which change did the current Directive introduce in comparison with the network and information security Directive of 2016?

   1. Notification opens with a preliminary alert that precedes the formal report
   2. Only events that produced measurable harm have to be brought to the authorities
   3. Feedback from the authorities to the notifying entity was removed to save time
   4. Sector coverage was narrowed to the critical infrastructure operators listed in 2016

4. Domain 2: Planning of NIS 2 requirements implementation

   A regional postal operator is required by its supervisor to determine for itself what its exposure is, to fix its own targets and to submit the resulting document for review, instead of following a prescribed list of technologies. Which regulatory approach is being applied?

   1. Command and control, because a public body reviews what the operator produces
   2. Performance-based, because the outcome standards are fixed and the means are free
   3. Management-based, because the entity self-regulates and the regulator then evaluates
   4. Co-regulation by binding instruction, because the supervisor keeps the final word

5. Domain 1: Fundamental concepts and definitions of NIS 2

   A company that produces and distributes electricity in one Member State employs 480 people and reports an annual turnover of 210 million euros. How is it classified?

   1. Important entity, because the supply of electricity appears in the annex that lists the other critical sectors
   2. Essential entity, because it goes beyond the ceilings of a medium-sized undertaking in a sector of high criticality
   3. Important entity, because the two ceilings that define a medium-sized undertaking have not both been exceeded
   4. Essential entity, because every undertaking active in the energy sector holds that status whatever its size or turnover

6. Domain 2: Planning of NIS 2 requirements implementation

   A project team has to establish how cybersecurity is currently managed in an organisation whose employees claim that nothing is in place. Which combination of actions is recommended at that stage?

   1. Observing the controls in place on site, interviewing those in charge, reading the documentation held and reviewing past audit findings
   2. Commissioning an external penetration test of the main systems, alongside a vulnerability scan, and treating that report as the whole picture
   3. Postponing every form of data collection until the risk assessment is complete, so that the main risks are known before anyone is questioned
   4. Accepting the statement of the staff at face value, since they work with the systems daily, and recording an absence of any measure in place

7. Domain 1: Fundamental concepts and definitions of NIS 2

   Which part of the legal text supplies the background and the interpretive guidance that help a reader understand the binding requirements, without imposing a requirement itself?

   1. The articles, which are numbered and grouped into chapters
   2. The annexes, which are organised into sectors and subsectors
   3. The recitals, which are numbered paragraphs placed before the enacting terms
   4. The correlation table, which maps the repealed provisions onto the current ones

8. Domain 2: Planning of NIS 2 requirements implementation

   Who has to endorse the cybersecurity objectives of a compliance programme, and may those objectives still change once the work has started?

   1. The project manager endorses them, and they stay fixed until the programme is closed
   2. The supervisory authority endorses them, and they may be revised only at its request
   3. The internal audit function endorses them, and they are revised after each audit cycle
   4. The highest level of the organisation endorses them, and they may be revised as work progresses

9. Domain 1: Fundamental concepts and definitions of NIS 2

   An entity already certified against the management system standard for information security asks which document will give it a reference set of generic controls together with guidance on putting them in place. Which one should it be pointed to?

   1. ISO/IEC 27002, usable within a management system or on its own as a basis of good practice
   2. ISO/IEC 27005, usable to satisfy the requirements on addressing information security risks
   3. ISO/IEC 27701, usable as an extension covering the management of privacy information
   4. ISO 22301, usable to protect against disruptions and to recover once they have arisen

10. Domain 2: Planning of NIS 2 requirements implementation

    A team preparing an analysis of the context of an organisation wants a single tool that separates what comes from inside the organisation from what comes from its environment. Which tool does that by design?

    1. Porter's Five Forces, which weighs the rivalry between competitors, the buyers, the suppliers, the potential entrants and the substitutes
    2. SWOT analysis, whose strengths and weaknesses cover internal issues while opportunities and threats cover external ones
    3. PEST analysis, which reviews the political, economic, social and technological forces at work
    4. The maturity scale, which rates each process from nonexistent to optimised

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.