PECB-NIS2-LI sample questions

Question 1

A multinational logistics company, classified as an 'essential entity' in several EU Member States, uses a centralized security operations center (SOC) in a non-EU country. To comply with NIS 2, the company must ensure its incident reporting obligations are met. Which statement accurately describes the jurisdictional responsibility for reporting a significant incident that affects services in Germany and Poland?

Accepted Answer

The company must report the incident to the competent authorities in both Germany and Poland, as services in both Member States were affected.

Answer

The company must report the incident only to the competent authorities in the Member State where its main establishment in the EU is located.

Answer

The company can choose to report the incident to ENISA directly, which will then coordinate with the national authorities of the affected Member States.

Answer

As the SOC is located in a non-EU country, the company is only required to report to the authorities of the country where its EU legal representative is based.

Question 2

A lead implementer is drafting a cybersecurity policy for a newly classified 'important entity' in the food production sector. The policy must align with the risk management measures mandated by Article 21 of the NIS 2 Directive. Which of the following areas must be included in the policy as a baseline requirement? (Select TWO)

Accepted Answer

Policies on the use of cryptography and, where appropriate, encryption.

Accepted Answer

Policies and procedures to assess the effectiveness of cybersecurity risk management measures.

Answer

A mandate for achieving ISO/IEC 27001 certification within 24 months.

Answer

A detailed budget for cybersecurity expenditures for the next five fiscal years.

Answer

A requirement for all employees to use biometrics for system authentication.

Question 3

True or False: Under the NIS 2 Directive, the management body of an essential entity can delegate the legal liability for non-compliance with cybersecurity risk management obligations to a third-party managed security service provider (MSSP) through a contractual agreement.

Accepted Answer

False

Answer

True

Question 4

## Case Study: AquaPure Water Services

**Company Background:** AquaPure Water Services is a public utility responsible for drinking water supply and wastewater management for a region of over one million people in an EU Member State. They are classified as an 'essential entity' under NIS 2. Their operations rely heavily on an Industrial Control System (ICS) and SCADA network to manage water treatment plants, pumping stations, and distribution networks. This OT network has been historically air-gapped but now has limited, firewalled connections to the corporate IT network for reporting and maintenance purposes.

**Current Situation:** During a preliminary NIS 2 gap analysis, the newly appointed lead implementer discovers that AquaPure has no formal business continuity or crisis management plans specifically for cyber incidents affecting the OT environment. The existing disaster recovery plan only covers physical failures like pump malfunctions or power outages. Furthermore, the engineering team that manages the OT network has a separate command structure from the IT department, and there is no integrated incident response plan.

**Requirements:** The CEO has tasked the lead implementer with developing a plan to meet the business continuity and crisis management requirements of NIS 2. The primary concern is ensuring the continuity of safe drinking water supply in the event of a significant cyberattack, such as ransomware encrypting SCADA servers.

**Question:** As the lead implementer, what is the most critical first step AquaPure should take to develop a NIS 2-compliant cyber crisis management and business continuity capability?

Accepted Answer

Conduct a comprehensive Business Impact Analysis (BIA) focused on cyber threats to OT processes and define Recovery Time Objectives (RTOs) for critical water supply functions.

Answer

Procure and implement a new, advanced EDR solution for all endpoints in the OT network to prevent ransomware attacks.

Answer

Immediately create an integrated cyber incident response team with members from both IT and OT departments and draft a preliminary communication plan.

Answer

Develop and document manual fallback procedures for operating critical plant machinery and distribution valves in case of a total SCADA system failure.

Question 5

A lead implementer is creating a project plan for achieving NIS 2 compliance. The organization is a large digital service provider. The plan needs to account for all key phases of the implementation. Which of the following represents the most logical sequence of phases for the implementation project?
```mermaid
graph TD
A[Initiation & Scoping] --> B{...}
B --> C[Control Implementation & Operations]
C --> D[Monitoring & Continual Improvement]
```

Accepted Answer

Gap Analysis & Risk Assessment

Answer

Control Implementation & Operations

Answer

Management Review & Approval

Answer

Awareness Training & Communication

Question 6

During a review of a draft incident response plan for an 'essential entity', the lead implementer notes that the plan triggers reporting to the national CSIRT only for incidents that have resulted in confirmed data exfiltration. Why is this plan non-compliant with the NIS 2 Directive's definition of a 'significant incident'?

Accepted Answer

The plan fails to consider incidents that cause severe operational disruption to the service, even without data loss.

Answer

The plan does not require reporting within the mandatory 12-hour early warning window.

Answer

The plan omits the requirement to submit a final report no later than 72 hours after the incident is resolved.

Answer

The plan does not include a process for notifying ENISA and the European Commission concurrently with the national CSIRT.

Question 7

An organization is setting up a program to monitor its NIS 2 compliance. The management body requires a dashboard with Key Performance Indicators (KPIs). Which of the following would be the LEAST effective KPI for demonstrating the effectiveness of the cybersecurity risk management program to the management body?

Accepted Answer

The number of cybersecurity-related trouble tickets opened by users per month.

Answer

Percentage reduction in the number of critical vulnerabilities on essential systems over time.

Answer

Risk exposure score, calculated based on the likelihood and impact of top 10 cybersecurity risks.

Answer

Percentage of critical suppliers that have been assessed against the organization's cybersecurity requirements.

Question 8

A public administration body in a Member State is considered an 'essential entity'. It is undergoing a NIS 2 implementation and needs to establish a cybersecurity training program for its management body. What is the primary objective of this training as mandated by the NIS 2 Directive?

Accepted Answer

To gain sufficient knowledge to identify risks and assess cybersecurity risk-management practices.

Answer

To enable them to write secure code and configure firewalls.

Answer

To ensure they can personally conduct forensic investigations after a breach.

Answer

To fulfill a generic annual training requirement with no specific content focus.

Question 9

A lead implementer is conducting a risk assessment for a digital marketplace platform, which is an 'important entity'. The assessment identifies a critical risk related to a third-party payment gateway provider. The provider has suffered breaches in the past. What is the most appropriate risk treatment strategy in alignment with NIS 2's focus on supply chain security?

Accepted Answer

Mitigate the risk by enforcing stringent contractual security requirements, conducting a supplier security assessment, and developing a specific incident response plan for a gateway compromise.

Answer

Accept the risk, as the payment gateway is a market leader and difficult to replace.

Answer

Transfer the risk by purchasing a comprehensive cyber insurance policy.

Answer

Avoid the risk by removing all payment functionality from the platform.

Question 10

When planning the implementation of NIS 2 requirements for a cross-border healthcare provider, the lead implementer must define the scope of the compliance program. Which elements are essential to define in this scoping phase? (Select THREE)

Accepted Answer

The organizational boundaries, including all departments involved in delivering the essential service.

Accepted Answer

The specific network and information systems that support the provision of the essential healthcare services.

Accepted Answer

The physical boundaries, such as the data centers and primary operational sites.

Answer

The brand and model of all planned firewall and antivirus software.

Answer

The exact penalties for non-compliance as determined by the competent national authority.

Top vendors

Top exams

Free PECB-NIS2-LI sample questions

True or False: Under the NIS 2 Directive, the management body of an essential entity can delegate the legal liability for non-compliance with cybersecurity risk management obligations to a third-party managed security service provider (MSSP) through a contractual agreement.

A public administration body in a Member State is considered an 'essential entity'. It is undergoing a NIS 2 implementation and needs to establish a cybersecurity training program for its management body. What is the primary objective of this training as mandated by the NIS 2 Directive?

When planning the implementation of NIS 2 requirements for a cross-border healthcare provider, the lead implementer must define the scope of the compliance program. Which elements are essential to define in this scoping phase? (Select THREE)

10 more free samples are waiting