I85PREP
⌘ K
EPSO IT/ICT study materials
EPSO IT/ICT study resources

EPSO IT/ICT practice questions

One question at a time. Build your EPSO IT/ICT understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ICT quantitative and textual reasoning under supplied assumptions

In the EPSO reasoning tests, the verbal reasoning section asks you to decide whether a statement is true based only on the passage. What is the correct approach?

  1. Choose the answer fully supported by the text, ignoring outside knowledge Correct answer.
  2. Choose the answer that matches your general knowledge of the topic
  3. Choose the longest, most detailed answer option
  4. Choose the answer that sounds most professional

Explanation

EPSO verbal reasoning measures logical comprehension, not general knowledge. The correct statement must be 100% supported by the passage; even a small outside assumption makes an option wrong.

Question 2ICT quantitative and textual reasoning under supplied assumptions

Passage: 'All regions receiving Cohesion Funding have a GNI per capita below 90% of the EU average. Region X has a GNI per capita of 95% of the EU average.' Which conclusion is fully supported?

  1. Region X does not receive Cohesion Funding Correct answer.
  2. Region X receives Cohesion Funding
  3. Region X is the poorest region in the EU
  4. Region X will lose funding next year

Explanation

Within the supplied fictional passage, receiving the named funding implies GNI below the stated threshold. RegionX does not meet that necessary condition, so it does not receive the funding in this model. This is contrapositive reasoning, not a statement of actual EU eligibility rules or current regional statistics.

Question 3ICT quantitative and textual reasoning under supplied assumptions

A data centre processed 1,200 TB of traffic in 2024 and 1,500 TB in 2025. What was the percentage increase in traffic?

  1. 25% Correct answer.
  2. 20%
  3. 30%
  4. 300%

Explanation

The increase is 1,500 - 1,200 = 300 TB. As a percentage of the original 1,200 TB, that is 300 / 1,200 = 0.25 = 25%. EPSO numerical reasoning rewards quick percentage-change calculation.

Question 4ICT quantitative and textual reasoning under supplied assumptions

A server cluster has 8 nodes and serves 24,000 requests per minute evenly. If 2 nodes fail and load is redistributed evenly across the remaining nodes, how many requests per minute does each remaining node handle?

  1. 4,000 Correct answer.
  2. 3,000
  3. 3,500
  4. 6,000

Explanation

After 2 nodes fail, 6 nodes remain. Total load stays at 24,000 requests/minute, so each node handles 24,000 / 6 = 4,000 requests per minute. EPSO numerical items reward extracting the right divisor.

Question 5ICT quantitative and textual reasoning under supplied assumptions

A cloud bill was EUR 8,000 in Q1 and rose by 15% in Q2, then fell by 20% in Q3. What was the Q3 bill?

  1. EUR 7,360 Correct answer.
  2. EUR 7,600
  3. EUR 9,200
  4. EUR 6,800

Explanation

Q2 = 8,000 x 1.15 = 9,200. Q3 = 9,200 x 0.80 = 7,360. Sequential percentage changes must be applied multiplicatively, not added together.

Question 6ICT quantitative and textual reasoning under supplied assumptions

EPSO abstract reasoning items show a series of figures with an underlying rule. What ability does this test primarily assess?

  1. Identifying logical patterns among shapes without using language or numbers Correct answer.
  2. Knowledge of geometry formulas
  3. Speed of mental arithmetic
  4. Familiarity with EU institutions

Explanation

Abstract reasoning is a non-verbal, non-numerical test of logical pattern recognition. Candidates spot rules in size, shape, rotation, position, shading and number of elements, then pick the figure that completes the series.

Question 7ICT quantitative and textual reasoning under supplied assumptions

In a supplied exercise, regional broadband percentages are A92%,B78%,C85%,D88%,and the fictional target is90%. How many regions meet or exceed it?

  1. One (A) Correct answer.
  2. Two (A and D)
  3. Three (A, C, D)
  4. None

Explanation

Only region A at 92% reaches or exceeds the 90% target. B (78%), C (85%) and D (88%) all fall short. EPSO numerical items reward careful threshold comparison.

Question 8ICT quantitative and textual reasoning under supplied assumptions

Passage: 'The new platform reduced incident resolution time. Teams that adopted it earliest saw the largest gains.' Which statement can be safely concluded?

  1. Earlier adopters of the platform experienced larger reductions in resolution time Correct answer.
  2. All teams now resolve incidents instantly
  3. The platform increased the number of incidents
  4. Late adopters refused to use the platform

Explanation

The passage links the platform to reduced resolution time and states earliest adopters saw the largest gains. That directly supports the conclusion about earlier adopters; the other options add unsupported claims.

Question 9ICT quantitative and textual reasoning under supplied assumptions

A project's budget is EUR 2,000,000. After spending 35%, how much remains?

  1. EUR 1,300,000 Correct answer.
  2. EUR 700,000
  3. EUR 1,650,000
  4. EUR 650,000

Explanation

Spending 35% leaves 65%. 2,000,000 x 0.65 = 1,300,000. EPSO numerical items frequently test converting a percentage spent into the remaining balance.

Question 10Computing Systems

In an enterprise data centre, what is the primary purpose of an Uninterruptible Power Supply (UPS)?

  1. Provide short-term battery power during outages so systems shut down safely or generators start Correct answer.
  2. Increase the clock speed of servers
  3. Encrypt data at rest on disk arrays
  4. Balance network traffic across switches

Explanation

A UPS bridges the gap between mains power loss and backup generator start-up, supplying battery power for seconds to minutes so workloads continue or shut down gracefully. It protects against data loss and hardware damage from sudden power cuts.

Question 11Computing Systems

What does the term RTO (Recovery Time Objective) describe in business continuity and disaster recovery planning?

  1. The maximum acceptable time to restore a service after a disruption Correct answer.
  2. The maximum data loss measured in time
  3. The total cost of a recovery operation
  4. The number of redundant servers required

Explanation

RTO is the target duration within which a business process or service must be restored after an incident to avoid unacceptable consequences. It is paired with RPO (Recovery Point Objective), which defines acceptable data loss.

Question 12Computing Systems

Which RAID level provides striping with distributed parity, tolerating the failure of a single disk?

  1. RAID 5 Correct answer.
  2. RAID 0
  3. RAID 1
  4. JBOD

Explanation

RAID 5 stripes data across disks with distributed parity, allowing the array to rebuild data and survive any one disk failure. It balances usable capacity, performance and fault tolerance.

Question 13Computing Systems

In a DevSecOps pipeline, what does 'shift left' on security mean?

  1. Integrating security testing early in development rather than only before release Correct answer.
  2. Moving servers physically to the left of the rack
  3. Delaying security checks until production
  4. Assigning all security tasks to a separate end-of-cycle team

Explanation

'Shift left' means embedding security activities, such as SAST, dependency scanning and threat modelling, early in the development lifecycle. Catching vulnerabilities sooner is cheaper and reduces risk compared with last-minute checks.

Question 14Computing Systems

What is the main characteristic of High-Performance Computing (HPC) clusters used for scientific and EU research workloads?

  1. Many interconnected nodes working in parallel on large computational problems Correct answer.
  2. A single very large mainframe with no networking
  3. Low-power devices optimised for battery life
  4. Standalone desktops not connected to each other

Explanation

HPC clusters aggregate many compute nodes linked by a high-speed, low-latency interconnect to run massively parallel workloads such as simulations and modelling. EU institutions use HPC for research, climate and data-intensive tasks.

Question 15Computing Systems

Which technology lets multiple isolated operating system instances run on one physical server by abstracting hardware via a hypervisor?

  1. Server virtualization Correct answer.
  2. Network address translation
  3. Disk defragmentation
  4. Packet sniffing

Explanation

Server virtualization uses a hypervisor (such as VMware ESXi, KVM or Hyper-V) to run several virtual machines on one physical host, improving utilisation, isolation and flexibility in data centres.

Question 16Computing Systems

What does the metric PUE (Power Usage Effectiveness) measure in a data centre, and what value is ideal?

  1. Total facility energy divided by IT equipment energy; ideal value approaches 1.0 Correct answer.
  2. CPU temperature; ideal value approaches 0
  3. Storage utilisation percentage; ideal value is 100%
  4. Network throughput in gigabits; higher is always better

Explanation

The stated PUE ratio compares total facility energy with IT-equipment energy over a consistent relevant boundary and interval. A value approaching1indicates less overhead in this model, not proof of adequate resilience, low carbon impact or overall business efficiency. Actual metering and operating conditions govern interpretation.

Question 17Computing Systems

Within the CIA triad of information security, which property ensures that data has not been altered in an unauthorised way?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Availability
  4. Accountability

Explanation

Integrity guarantees that information remains accurate and unaltered except by authorised actions, often enforced with hashes, checksums and digital signatures. Confidentiality protects against disclosure and availability ensures access when needed.

Question 18Computing Systems

What is the purpose of Infrastructure as Code (IaC) tools such as Terraform or Ansible?

  1. Define and provision infrastructure through version-controlled, repeatable configuration files Correct answer.
  2. Manually click through cloud consoles to create resources
  3. Replace all programming languages
  4. Encrypt network packets in transit

Explanation

IaC lets teams describe servers, networks and services declaratively in code that can be versioned, reviewed and applied repeatedly. This reduces configuration drift and human error and supports automated, consistent provisioning.

Question 19Cloud concepts, architecture and service models

Which cloud service model gives the customer the most control, providing virtualized compute, storage and networking that the customer manages and configures?

  1. Infrastructure as a Service (IaaS) Correct answer.
  2. Software as a Service (SaaS)
  3. Platform as a Service (PaaS)
  4. Function as a Service (FaaS)

Explanation

IaaS delivers fundamental compute, storage and networking resources that customers configure and manage, including the OS and applications. SaaS and PaaS abstract progressively more of the stack away from the customer.

Question 20Cloud concepts, architecture and service models

In Kubernetes, what is the smallest deployable unit that can hold one or more containers sharing storage and network?

  1. A Pod Correct answer.
  2. A Node
  3. A Cluster
  4. A Namespace

Explanation

A Pod is the smallest deployable unit in Kubernetes, wrapping one or more tightly coupled containers that share the same network namespace and storage volumes. Nodes host Pods, and a Cluster is the whole set of nodes.

Question 21Cloud concepts, architecture and service models

What is the primary function of the Border Gateway Protocol (BGP) on the internet?

  1. Exchange routing and reachability information between autonomous systems Correct answer.
  2. Assign IP addresses to devices automatically
  3. Resolve domain names to IP addresses
  4. Encrypt web traffic between browser and server

Explanation

BGP is the routing protocol that exchanges reachability information between autonomous systems, making it the routing backbone of the internet. It decides the best paths for traffic between large networks.

Question 22Cloud concepts, architecture and service models

How many bits are in an IPv6 address, and what notation is used to write it?

  1. 128 bits, written as eight groups of hexadecimal digits Correct answer.
  2. 32 bits, written as four decimal octets
  3. 64 bits, written in binary only
  4. 256 bits, written in decimal

Explanation

IPv6 uses 128-bit addresses written as eight groups of four hexadecimal digits separated by colons, vastly expanding the address space over IPv4's 32 bits. This supports the growth of connected devices.

Question 23Cloud concepts, architecture and service models

What does SD-WAN (Software-Defined Wide Area Network) primarily enable for distributed organisations?

  1. Centralised, policy-based control of WAN traffic across multiple links and locations Correct answer.
  2. Replacement of all physical network cabling with wireless
  3. Storage of backups in a single data centre
  4. Automatic writing of application source code

Explanation

SD-WAN abstracts WAN connectivity into a software control layer, dynamically steering traffic across MPLS, broadband and LTE links based on policy and application needs. It improves performance, resilience and cost efficiency for multi-site networks.

Question 24Cloud concepts, architecture and service models

What is the key benefit of containerization (e.g., Docker) compared with running each application on its own virtual machine?

  1. Containers share the host OS kernel, making them lighter and faster to start than full VMs Correct answer.
  2. Containers require a separate full operating system per application
  3. Containers cannot be moved between hosts
  4. Containers always need more memory than VMs

Explanation

Containers package an application with its dependencies but share the host's OS kernel, so they are lightweight, start quickly and use fewer resources than full virtual machines, which each carry a complete guest OS.

Question 25Cloud concepts, architecture and service models

Which cloud deployment model combines on-premises private infrastructure with public cloud, allowing workloads to move between them?

  1. Hybrid cloud Correct answer.
  2. Pure public cloud
  3. Air-gapped on-premises only
  4. Single-tenant SaaS

Explanation

A hybrid cloud integrates private (on-premises) and public cloud environments so data and applications can move between them, balancing control, compliance and scalability. EU institutions often use hybrid models for sensitive workloads.

Question 26Cloud concepts, architecture and service models

In networking, what does latency measure?

  1. The time delay for data to travel from source to destination Correct answer.
  2. The total amount of data transferred per second
  3. The number of devices on a subnet
  4. The strength of a wireless signal

Explanation

Latency is the time delay between sending and receiving data, usually measured in milliseconds. It is distinct from bandwidth (throughput); low latency is critical for real-time and interactive applications.

Question 27Cloud concepts, architecture and service models

Which of the following best describes the 'shared responsibility model' in public cloud computing?

  1. The provider secures the cloud infrastructure while the customer secures their data and configurations Correct answer.
  2. The provider is responsible for everything including customer data
  3. The customer is responsible for the physical data centre
  4. Security is fully automated and requires no party's involvement

Explanation

In the shared responsibility model, the cloud provider secures the underlying infrastructure (hardware, hypervisor, physical facilities) while the customer is responsible for securing their data, identities, access controls and configurations. Misconfiguration by customers is a leading cause of cloud breaches.

Question 28Cloud concepts, architecture and service models

Which protocol is commonly used to securely access and manage remote servers via an encrypted command-line session?

  1. SSH (Secure Shell) Correct answer.
  2. FTP (File Transfer Protocol)
  3. Telnet
  4. SMTP

Explanation

SSH provides an encrypted channel for secure remote login and command execution, replacing insecure protocols like Telnet. It also underpins secure file transfer (SFTP/SCP) and tunnelling.

Question 29Cloud concepts, architecture and service models

What does 'auto-scaling' provide in a cloud environment?

  1. Automatic adjustment of compute resources up or down based on demand Correct answer.
  2. A fixed number of servers that never changes
  3. Permanent deletion of unused data
  4. Manual provisioning approved by an administrator each time

Explanation

Auto-scaling automatically adds or removes compute instances in response to metrics such as CPU load or request volume, matching capacity to demand. This improves resilience under spikes and controls cost during quiet periods.

Question 30Cloud concepts, architecture and service models

A network engineer needs to segment a corporate LAN into isolated broadcast domains without adding new physical switches. Which technology achieves this?

  1. VLANs (Virtual LANs) Correct answer.
  2. A single flat subnet
  3. Increasing cable length
  4. Disabling the firewall

Explanation

VLANs logically partition a switch into separate broadcast domains, isolating traffic between groups without extra hardware. This improves security, reduces broadcast traffic and supports policy enforcement.

Question 31Cyber-risk identification and analysis

In Scrum, what is the primary purpose of the daily stand-up (Daily Scrum)?

  1. Synchronise the development team and surface impediments to reaching the Sprint Goal Correct answer.
  2. Provide a status report to senior management
  3. Assign new tasks from the product owner
  4. Conduct a detailed design review of the codebase

Explanation

The Daily Scrum helps Developers inspect progress toward the Sprint Goal and adapt the Sprint Backlog and near-term plan. Coordination and identifying impediments can support that purpose, but it is not primarily a manager’s status meeting or a mandatory fixed script. The role and goal are framework-specific.

Question 32Cyber-risk identification and analysis

Which principle is central to the PRINCE2 project management methodology?

  1. Manage by stages with continued business justification throughout the project Correct answer.
  2. Avoid all documentation to move faster
  3. Let developers decide scope without governance
  4. Deliver only at the very end with no interim reviews

Explanation

PRINCE2 is built on principles including continued business justification and managing by stages, with defined roles, controlled stage boundaries and regular review of whether the project remains viable. Governance and a sound business case are core.

Question 33Cyber-risk identification and analysis

In project management, what does the 'critical path' of a schedule represent?

  1. The longest sequence of dependent tasks that determines the minimum project duration Correct answer.
  2. The cheapest set of tasks in the project
  3. The tasks assigned to the most senior staff
  4. The path with the most slack or float

Explanation

The critical path is the longest chain of dependent activities; any delay on it delays the whole project, and tasks on it have zero float. Identifying it is essential for schedule management and prioritising attention.

Question 34Cyber-risk identification and analysis

Which international standard provides principles and guidelines for risk management applicable to ICT projects?

  1. ISO 31000 Correct answer.
  2. ISO 9660
  3. ISO 216
  4. ISO 4217

Explanation

ISO 31000 provides principles, a framework and a process for managing risk in any organisation or project. It guides identifying, assessing, treating and monitoring risks, a core competency for ICT project managers.

Question 35Cyber-risk identification and analysis

In Earned Value Management, a project has Earned Value (EV) of 80 and Actual Cost (AC) of 100. What is the Cost Performance Index (CPI), and what does it indicate?

  1. CPI = 0.8, indicating the project is over budget Correct answer.
  2. CPI = 1.25, indicating the project is under budget
  3. CPI = 0.8, indicating the project is under budget
  4. CPI = 1.0, indicating the project is exactly on budget

Explanation

CPI = EV / AC = 80 / 100 = 0.8. A CPI below 1.0 means you are getting less value than you are spending, so the project is over budget (cost overrun).

Question 36Cyber-risk identification and analysis

What is the main role of a Product Owner in a Scrum team?

  1. Maximise product value by managing and prioritising the Product Backlog Correct answer.
  2. Write all the code for the increment
  3. Run the servers in production
  4. Approve employee holiday requests

Explanation

The Product Owner is accountable for maximising the value of the product by owning, ordering and clearly communicating the Product Backlog. They represent stakeholders and decide what the team builds next.

Question 37Cyber-risk identification and analysis

Which framework is specifically designed for scaling Agile across many teams in large enterprises?

  1. SAFe (Scaled Agile Framework) Correct answer.
  2. Waterfall
  3. PMBOK predictive lifecycle
  4. ITIL incident management

Explanation

SAFe (Scaled Agile Framework) provides structured practices, roles and artifacts such as Agile Release Trains to coordinate Agile delivery across multiple teams and portfolios in large organisations like EU institutions.

Question 38Cyber-risk identification and analysis

In a RACI matrix used for stakeholder and responsibility management, what does the 'A' stand for?

  1. Accountable - the single person ultimately answerable for the task Correct answer.
  2. Available - anyone free to help
  3. Approver of the budget only
  4. Auditor of the deliverable

Explanation

In RACI, 'A' is Accountable: the one person ultimately answerable for the correct completion of a task or deliverable. There should be exactly one Accountable per activity, alongside Responsible, Consulted and Informed roles.

Question 39Cyber-risk identification and analysis

What distinguishes a programme from a project in portfolio management?

  1. A programme coordinates multiple related projects to achieve benefits not available by managing them separately Correct answer.
  2. A programme is always shorter than a single project
  3. A programme has no defined objectives
  4. A programme is simply another word for a single project

Explanation

A programme groups related projects and activities managed together to deliver strategic benefits and outcomes that would not be realised if the projects were run independently. AD7 ICT project managers may handle projects, programmes and portfolios.

Question 40Cyber-risk identification and analysis

In the explicitly versioned PMBOKGuide7th-edition model, which listed emphasis contrasts with organizing the guide solely around predefined processes?

  1. A shift toward principles and project performance domains focused on value delivery Correct answer.
  2. A mandate to use only Waterfall
  3. Elimination of stakeholders from projects
  4. A requirement to avoid Agile entirely

Explanation

PMBOK 7 moved from a process-based to a principles-based approach, organising guidance around 12 principles and 8 performance domains with a strong focus on delivering value and outcomes, accommodating both predictive and Agile approaches.

Question 41Cyber-risk identification and analysis

In Kanban, what is the purpose of a Work In Progress (WIP) limit?

  1. Cap the number of items in a workflow stage to reduce bottlenecks and improve flow Correct answer.
  2. Force the team to start as many tasks as possible at once
  3. Set the project's total budget
  4. Define the number of team members allowed

Explanation

WIP limits restrict how many items can be in a given stage at once. By preventing overload, they expose bottlenecks, shorten cycle time and improve overall flow, a core Kanban practice.

Question 42Programming and Software Development

Which version control practice describes integrating code changes frequently into a shared mainline with automated builds and tests?

  1. Continuous Integration (CI) Correct answer.
  2. Manual nightly backups
  3. Code freeze for the whole year
  4. Storing code only on local machines

Explanation

Continuous Integration means developers merge their work into a shared branch frequently, with each change triggering an automated build and test run. This catches integration issues early and is foundational to CI/CD pipelines.

Question 43Programming and Software Development

In relational databases, what does a primary key guarantee for a table?

  1. Each row is uniquely identifiable and the key cannot be null Correct answer.
  2. Rows can be duplicated freely
  3. The table can have no other columns
  4. Data is automatically encrypted

Explanation

A primary key uniquely identifies each row in a table and cannot contain null values. It enforces entity integrity and is referenced by foreign keys to maintain relationships between tables.

Question 44Programming and Software Development

What does the HTTP status code 404 indicate?

  1. The requested resource was not found on the server Correct answer.
  2. The request succeeded
  3. The server encountered an internal error
  4. The client is unauthorised and must authenticate

Explanation

HTTP 404 'Not Found' means the server could not find the requested resource. It is a client-error class (4xx) code, distinct from 200 success, 401 unauthorised and 500 internal server error.

Question 45Programming and Software Development

Which design approach exposes application functionality over the web using stateless HTTP methods and resource-based URLs?

  1. REST (Representational State Transfer) API Correct answer.
  2. A monolithic batch job
  3. A spreadsheet macro
  4. A physical print server

Explanation

A RESTful API exposes resources via URLs and uses stateless HTTP methods (GET, POST, PUT, DELETE) to operate on them. REST is a dominant style for web and microservice integration in modern systems.

Question 46Programming and Software Development

What is the time complexity of a binary search on a sorted array of n elements?

  1. O(log n) Correct answer.
  2. O(n)
  3. O(n^2)
  4. O(1)

Explanation

Binary search halves the search space each step, giving logarithmic time complexity O(log n). It requires the input array to be sorted in advance.

Question 47Programming and Software Development

Which practice helps prevent SQL injection vulnerabilities in application code?

  1. Using parameterised queries (prepared statements) Correct answer.
  2. Concatenating user input directly into SQL strings
  3. Disabling the database entirely
  4. Storing passwords in plain text

Explanation

Parameterised queries separate SQL code from user-supplied data, so input cannot alter the query structure. This is the primary defence against SQL injection, a top web-application security risk.

Question 48Programming and Software Development

In object-oriented programming, what does 'encapsulation' refer to?

  1. Bundling data and the methods that operate on it, restricting direct external access to internal state Correct answer.
  2. Allowing any code to modify all variables globally
  3. Copying an object byte by byte
  4. Writing programs without any functions

Explanation

Encapsulation binds data and behaviour together within an object and hides internal state behind controlled interfaces. This reduces coupling, protects invariants and is a core OOP principle alongside inheritance and polymorphism.

Question 49Programming and Software Development

What is the main advantage of a microservices architecture over a monolithic application?

  1. Services can be developed, deployed and scaled independently Correct answer.
  2. There is only ever one process to manage
  3. It removes the need for any network communication
  4. It guarantees zero latency between components

Explanation

Microservices decompose an application into small, independently deployable services, each owning a capability. This enables independent scaling, technology choice and deployment, at the cost of added distributed-system complexity.

Question 50Programming and Software Development

Which testing level verifies that individual functions or methods work correctly in isolation?

  1. Unit testing Correct answer.
  2. End-to-end acceptance testing
  3. Penetration testing
  4. Load testing

Explanation

Unit tests check the smallest testable parts of code, such as individual functions or methods, in isolation, often using mocks for dependencies. They form the base of the testing pyramid and catch regressions early.