I85PREP
⌘ K
GER Category 2 study materials
GER Category 2 study resources

GER Category 2 practice questions

One question at a time. Build your GER Category 2 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Regulatory Framework and Legislation

Under the EU General Data Protection Regulation, which entity determines the purposes and means of processing personal data?

  1. The supervisory authority
  2. The controller Correct answer.
  3. The data subject
  4. The processor

Explanation

The GDPR defines the controller as the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. The processor acts on the controller's behalf, and the supervisory authority is the public regulator, not a party to the processing decision.

Question 2Regulatory Framework and Legislation

Which legal instrument establishes the binding minimum standards for the protection of personal data across all EU member states?

  1. The NIS2 Directive
  2. The Digital Services Act
  3. The General Data Protection Regulation Correct answer.
  4. The ePrivacy Directive

Explanation

The GDPR is a regulation with direct effect in all member states and sets a uniform baseline of data protection obligations. The ePrivacy Directive governs confidentiality of electronic communications and complements, but does not replace, the GDPR's general regime.

Question 3Regulatory Framework and Legislation

A company processes employee health data to administer sick leave. Under the GDPR, which category does this data fall into?

  1. Pseudonymised data
  2. Special category data Correct answer.
  3. Synthetic data
  4. Anonymised data

Explanation

Article 9 of the GDPR treats data concerning health as a special category of personal data subject to stricter conditions and a general processing prohibition unless a specific exception applies. Pseudonymised data remains personal data but is not automatically a special category, and anonymised data falls outside the GDPR entirely.

Question 4Regulatory Framework and Legislation

Within how many hours must an organisation notify a personal data breach to the competent supervisory authority under the GDPR where the breach is likely to result in a risk to rights and freedoms?

  1. One calendar month
  2. 24 hours
  3. 72 hours Correct answer.
  4. 48 hours

Explanation

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of the breach. The one-month period applies to responding to data subject access requests, not to breach notification.

Question 5Regulatory Framework and Legislation

What is the maximum administrative fine the GDPR allows for the most serious infringements?

  1. 50 million euro flat
  2. 5 percent of national annual turnover
  3. 20 million euro or 4 percent of global annual turnover, whichever is higher Correct answer.
  4. 10 million euro or 2 percent of global annual turnover

Explanation

Article 83 sets a two-tier fine structure; the higher tier allows up to 20 million euro or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is greater. The lower tier of 10 million euro or 2 percent applies to other infringements.

Question 6Regulatory Framework and Legislation

Which principle requires that personal data be collected for specified, explicit and legitimate purposes and not further processed in an incompatible manner?

  1. Integrity and confidentiality
  2. Data minimisation
  3. Storage limitation
  4. Purpose limitation Correct answer.

Explanation

Purpose limitation under Article 5(1)(b) binds processing to the declared purposes and prohibits incompatible further processing. Storage limitation instead restricts how long data are kept, and minimisation restricts how much data are collected.

Question 7Regulatory Framework and Legislation

Under the GDPR, which lawful basis is most appropriate when a public authority processes personal data in the performance of a task carried out in the public interest?

  1. Contract
  2. Legal obligation or public task Correct answer.
  3. Legitimate interests
  4. Consent

Explanation

Article 6(1)(e) permits processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority, and Article 6(1)(c) covers compliance with a legal obligation. Public authorities cannot generally rely on legitimate interests for their public tasks, and consent is inappropriate where there is an imbalance of power.

Question 8Regulatory Framework and Legislation

A bank relies on legitimate interests to process customer data for fraud prevention. What must the bank do before starting the processing?

  1. Obtain explicit consent from each customer
  2. Notify the supervisory authority for prior authorisation
  3. Conduct and document a legitimate interests balancing assessment Correct answer.
  4. Appoint a processor to take the decision

Explanation

Where legitimate interests is the basis, the controller must carry out a three-part assessment covering the interest, the necessity of the processing and the balance against the individual's rights, and should document it to demonstrate accountability. Prior authorisation by a supervisory authority is not required for this basis.

Question 9Regulatory Framework and Legislation

When must a data protection officer be designated under the GDPR?

  1. Where core activities involve large-scale systematic monitoring or large-scale processing of special category data Correct answer.
  2. Only when the organisation has more than 500 employees
  3. Only when the organisation operates outside the EU
  4. Whenever the organisation processes any personal data

Explanation

Article 37 requires a DPO where processing is carried out by a public authority, where core activities involve regular and systematic monitoring of data subjects on a large scale, or where core activities involve large-scale processing of special categories or criminal data. Headcount alone is not the trigger.

Question 10Regulatory Framework and Legislation

What is the primary purpose of a data protection impact assessment under the GDPR?

  1. To obtain prior authorisation from the supervisory authority
  2. To identify and mitigate risks arising from high-risk processing before it begins Correct answer.
  3. To calculate the applicable administrative fine
  4. To transfer data to a third country

Explanation

Article 35 requires a DPIA where processing is likely to result in a high risk to rights and freedoms, so that the controller can assess and address those risks before processing. It is an internal accountability tool, not an authorisation request or a fine calculation.

Question 11Regulatory Framework and Legislation

Which mechanism allows personal data to be transferred from the EU to a third country that has not received an adequacy decision, without relying on a specific contractual instrument?

  1. An explicit derogation such as the data subject's explicit consent Correct answer.
  2. A memorandum of understanding between regulators
  3. A national certification of the exporter
  4. A binding corporate rule adopted by the recipient

Explanation

Chapter V permits transfers without an adequacy decision where one of the Article 49 derogations applies, such as explicit consent after being informed of the risks. Binding corporate rules are a specific instrument, not a general derogation, and regulator memoranda do not create transfer legality.

Question 12Regulatory Framework and Legislation

A data subject objects to processing based on legitimate interests. What is the controller's obligation?

  1. Stop processing unless it demonstrates compelling legitimate grounds that override the individual's interests Correct answer.
  2. Continue processing regardless of the objection
  3. Automatically erase all data without further assessment
  4. Refer the objection to the supervisory authority for a decision

Explanation

Article 21 gives the data subject the right to object, and the controller must cease processing unless it can show compelling legitimate grounds that override the interests, rights and freedoms of the individual. The controller, not the supervisory authority, performs this assessment.

Question 13Regulatory Framework and Legislation

Which statement best describes the relationship between a controller and a processor under Article 28 of the GDPR?

  1. The processor is jointly liable for all controller decisions
  2. The processor may set its own purposes for the data it receives
  3. The processor may subcontract freely without any notification
  4. The processor must act only on documented instructions from the controller Correct answer.

Explanation

Article 28 requires a written contract under which the processor processes data only on documented instructions from the controller, including for transfers. Sub-processing requires prior authorisation, and the processor does not become a controller by receiving data.

Question 14Regulatory Framework and Legislation

What does the accountability principle require of a controller under the GDPR?

  1. Registering every processing activity with the supervisory authority
  2. Being able to demonstrate compliance with the data protection principles Correct answer.
  3. Obtaining consent for every processing operation
  4. Publishing all processing records on a public website

Explanation

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with the principles. This is evidenced through measures such as records of processing, policies and assessments, not through public disclosure or universal registration.

Question 15Regulatory Framework and Legislation

Which of the following is a valid way to demonstrate an appropriate safeguard for an international transfer under Article 46 of the GDPR?

  1. An internal audit report prepared by the exporter
  2. A verbal assurance from the importer's management
  3. A press release announcing the transfer
  4. Standard contractual clauses adopted by the European Commission Correct answer.

Explanation

Article 46 recognises appropriate safeguards including standard data protection clauses adopted by the Commission or by a supervisory authority and approved by the Commission. Informal assurances, publicity and internal audits do not constitute recognised transfer safeguards.

Question 16Regulatory Framework and Legislation

Under the GDPR, when is a controller required to provide privacy information to a data subject whose data were not obtained from that individual?

  1. Only after the first processing operation is complete
  2. Only if the data subject requests it
  3. Never, because the data were not collected directly
  4. Within a reasonable period and at the latest within one month of obtaining the data Correct answer.

Explanation

Article 14 requires information to be provided within a reasonable period after obtaining the data and at the latest within one month, or at the point of first communication or disclosure if that comes earlier. The obligation applies regardless of whether the data were collected directly.

Question 17Regulatory Framework and Legislation

Which body is responsible for enforcing the GDPR in a member state and handling complaints from individuals?

  1. The national supervisory authority Correct answer.
  2. The Court of Justice of the European Union
  3. The European Data Protection Board
  4. The European Commission

Explanation

Each member state designates one or more independent supervisory authorities that monitor application of the GDPR, handle complaints and impose corrective measures. The European Data Protection Board coordinates consistency but does not enforce in individual cases.

Question 18Regulatory Framework and Legislation

A controller wants to rely on consent for processing. Which requirement must the consent satisfy to be valid under the GDPR?

  1. It must be given in writing and notarised
  2. It must be bundled with the terms of service
  3. It must be freely given, specific, informed and unambiguous Correct answer.
  4. It must be renewed every month

Explanation

Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes. Consent bundled with other terms is not freely given, and there is no monthly renewal or notarisation requirement.

Question 19Regulatory Framework and Legislation

Which of the following best describes the role of the European Data Protection Board?

  1. It replaces national supervisory authorities in cross-border cases
  2. It contributes to the consistent application of the GDPR across member states Correct answer.
  3. It issues binding decisions in individual data subject complaints
  4. It grants adequacy decisions for third countries

Explanation

The EDPB is composed of the heads of national supervisory authorities and the European Data Protection Supervisor, and its role is to ensure consistent application through guidelines, opinions and dispute resolution. Adequacy decisions are adopted by the European Commission, not the Board.

Question 20Regulatory Framework and Legislation

Under the GDPR, what is the default retention rule for personal data?

  1. Data may be kept indefinitely if stored securely
  2. Data must be deleted as soon as the individual requests it in all cases
  3. Data must be kept for at least five years
  4. Data must be kept no longer than necessary for the purposes of processing Correct answer.

Explanation

The storage limitation principle requires that data be kept in a form permitting identification for no longer than necessary for the purposes. Retention may be extended where data are anonymised or where law requires longer storage, and erasure rights are subject to legal exceptions.

Question 21Regulatory Framework and Legislation

What does the principle of data protection by design require under Article 25 of the GDPR?

  1. Encrypting every database field without exception
  2. Appointing an external auditor for every new system
  3. Implementing technical and organisational measures that integrate data protection into processing from the outset Correct answer.
  4. Conducting a DPIA for all processing operations

Explanation

Article 25 requires the controller to implement appropriate technical and organisational measures designed to apply data protection principles effectively and to integrate safeguards into processing. It does not mandate a specific technology such as universal encryption or a DPIA for every operation.

Question 22Regulatory Framework and Legislation

A controller receives a request from a data subject for access to their data. Within what period must the controller generally respond?

  1. Within six months
  2. Within 72 hours
  3. Without undue delay and in any event within one month, extendable by two further months for complex requests Correct answer.
  4. Within ten working days

Explanation

Article 12 requires the controller to respond without undue delay and at the latest within one month, with a possible extension of two further months where requests are complex or numerous, subject to informing the data subject. The 72-hour deadline applies to breach notification instead.

Question 23Regulatory Framework and Legislation

A company in the EU uses a processor in a third country without an adequacy decision. Which factor is most critical when assessing whether a transfer mechanism is valid?

  1. The currency used for payment
  2. Whether the third country's legal framework provides essentially equivalent protection and whether the mechanism is enforceable Correct answer.
  3. The processor's marketing materials
  4. The size of the processor's workforce

Explanation

Following the Schrems II case law, a transfer must be supported by a mechanism that ensures a level of protection essentially equivalent to that in the EU, including an assessment of the destination's legal framework and any supplementary measures. Commercial or administrative factors do not determine validity.

Question 24Regulatory Framework and Legislation

A supervisory authority finds that a controller's processing is lawful but the controller failed to maintain records of processing activities as required by Article 30. Which outcome is most consistent with the GDPR enforcement framework?

  1. The authority may impose corrective measures and an administrative fine under Article 83 Correct answer.
  2. The processing must be suspended immediately in all cases
  3. No action is possible because the processing itself was lawful
  4. The authority must refer the matter to the European Commission for a decision

Explanation

Accountability obligations are independent of the lawfulness of the underlying processing, and Article 58 empowers supervisory authorities to impose corrective measures while Article 83 allows fines for infringements. The Commission does not decide individual enforcement matters.

Question 25Regulatory Framework and Legislation

Under the one-stop-shop mechanism, which supervisory authority is generally competent for a cross-border processing case?

  1. The European Data Protection Board acting as lead authority
  2. The authority of the member state where the controller's main establishment is located Correct answer.
  3. The authority of the member state where the data subject resides
  4. The authority of the member state with the largest fine regime

Explanation

Article 56 designates the supervisory authority of the member state where the controller or processor has its main establishment as the lead authority for cross-border processing. Other concerned authorities cooperate, and the EDPB only intervenes in consistency disputes.

Question 26Regulatory Framework and Legislation

Under the GDPR, which of the following is a special category of personal data for which processing is prohibited unless a specific exception applies?

  1. Data concerning a person's professional certifications
  2. Data concerning a person's employment history
  3. Data concerning a person's educational history
  4. Data concerning a person's racial or ethnic origin Correct answer.

Explanation

Article 9(1) of the GDPR prohibits processing of special categories of personal data, which include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning sex life or sexual orientation. Professional certifications, educational history, and employment history are ordinary personal data, not special categories, unless they reveal one of the listed characteristics.

Question 27Regulatory Framework and Legislation

A controller discovers a personal data breach that is unlikely to result in a risk to the rights and freedoms of natural persons. What does the GDPR require regarding notification to the supervisory authority?

  1. The controller must notify the supervisory authority only if the breach affects more than 500 data subjects.
  2. The controller must notify the supervisory authority within 72 hours of becoming aware of the breach.
  3. The controller must notify the supervisory authority without undue delay and in any event within 30 days.
  4. The controller is not required to notify the supervisory authority because the breach is unlikely to result in a risk. Correct answer.

Explanation

Article 33(1) requires notification to the supervisory authority only when a personal data breach is likely to result in a risk to the rights and freedoms of natural persons. If the breach is unlikely to result in such a risk, notification to the supervisory authority is not required, although the controller must still document the breach internally under Article 33(5).

Question 28Regulatory Framework and Legislation

Which of the following best describes the GDPR's material scope under Article 2(1)?

  1. It applies only to processing carried out by public authorities and large enterprises.
  2. It applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system. Correct answer.
  3. It applies only to processing carried out by automated means and excludes manual processing entirely.
  4. It applies to all processing of personal data regardless of whether the data form part of a filing system.

Explanation

Article 2(1) states that the GDPR applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. Manual processing of data that do not form part of a filing system falls outside the material scope.

Question 29Regulatory Framework and Legislation

A company established outside the EU offers goods or services to data subjects in the EU and monitors their behaviour. Under Article 3(2), which criterion triggers the GDPR's territorial scope in this situation?

  1. The company must have a representative in the EU before processing begins.
  2. The company must target data subjects in the Union by offering goods or services or by monitoring their behaviour. Correct answer.
  3. The company must process data of EU citizens only.
  4. The company must have an establishment in the EU.

Explanation

Article 3(2) applies the GDPR to controllers and processors not established in the Union when their processing activities relate to offering goods or services to data subjects in the Union or to monitoring their behaviour within the Union. The presence of an establishment, the nationality of the data subjects, or the prior appointment of a representative is not the triggering criterion.

Question 30Regulatory Framework and Legislation

Under the GDPR, which of the following is an example of a lawful basis for processing that is based on the data subject's unambiguous indication of wishes?

  1. Legitimate interests
  2. Performance of a contract
  3. Consent Correct answer.
  4. Compliance with a legal obligation

Explanation

Article 6(1)(a) permits processing when the data subject has given consent to the processing of their personal data for one or more specific purposes. Consent is defined in Article 4(11) as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement. The other bases do not depend on the data subject's indication of wishes.

Question 31Regulatory Framework and Legislation

A data subject has provided valid consent for processing. Which of the following statements best describes the data subject's right to withdraw that consent under Article 7(3)?

  1. Consent may be withdrawn only if the controller agrees to the withdrawal.
  2. Consent may be withdrawn at any time, and withdrawal must be as easy as giving consent. Correct answer.
  3. Consent may be withdrawn only where processing is based on a legal obligation.
  4. Consent may be withdrawn only within the first 30 days after it is given.

Explanation

Article 7(3) provides that the data subject shall have the right to withdraw consent at any time and that it shall be as easy to withdraw as to give consent. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. The controller must inform the data subject of this right before giving consent.

Question 32Regulatory Framework and Legislation

Which of the following is a right granted to data subjects under the GDPR regarding automated decision-making, including profiling?

  1. The right to receive a copy of the algorithm used for the decision.
  2. The right to opt out of all profiling regardless of its effects.
  3. The right to demand that all automated decisions be reviewed by a human within 24 hours.
  4. The right to object to solely automated decisions that produce legal effects or similarly significantly affect them. Correct answer.

Explanation

Article 22(1) gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, subject to exceptions. Article 22(3) provides safeguards such as human intervention and the right to contest the decision. There is no general right to the algorithm or a 24-hour review deadline.

Question 33Regulatory Framework and Legislation

A controller is required to maintain records of processing activities under Article 30. Which of the following is a consequence of failing to do so?

  1. The controller must immediately suspend all processing activities.
  2. The controller automatically loses the right to rely on consent.
  3. The controller must appoint a data protection officer.
  4. The controller may be subject to administrative fines and must make the records available to the supervisory authority on request. Correct answer.

Explanation

Article 30 requires controllers and processors to maintain records of processing activities and to make them available to the supervisory authority on request. Failure to comply can lead to administrative fines under Article 83 and is a compliance gap that supervisory authorities consider during investigations. It does not automatically affect consent or require suspension of processing.

Question 34Regulatory Framework and Legislation

Which of the following best describes the role of the lead supervisory authority under the GDPR's one-stop-shop mechanism?

  1. It is the authority of the member state where the data subject resides.
  2. It is the authority chosen by the controller regardless of establishment.
  3. It is the authority of the member state where the controller's main establishment is located. Correct answer.
  4. It is always the European Data Protection Board.

Explanation

Under Article 56, the supervisory authority of the main establishment of the controller or processor is competent to act as lead supervisory authority for cross-border processing. The lead authority cooperates with other concerned supervisory authorities through the consistency mechanism. The controller cannot freely choose the lead authority.

Question 35Regulatory Framework and Legislation

A controller intends to transfer personal data to a third country without an adequacy decision. Which of the following is a valid appropriate safeguard under Article 46?

  1. A verbal assurance from the importer that it will comply with the GDPR.
  2. The data subject's informal consent to the transfer.
  3. Standard data protection clauses adopted by the Commission. Correct answer.
  4. A unilateral statement by the controller that the transfer is safe.

Explanation

Article 46(2)(c) and (d) recognise standard data protection clauses adopted by the Commission or by a supervisory authority as appropriate safeguards for transfers. These clauses must provide appropriate safeguards and enforceable data subject rights. Informal assurances or unilateral statements do not meet the Article 46 standard.

Question 36Regulatory Framework and Legislation

Under the GDPR, what is the maximum administrative fine that can be imposed for infringements of the basic principles for processing, including conditions for consent?

  1. 5 000 000 EUR or 1 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
  2. 20 000 000 EUR or 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. Correct answer.
  3. 50 000 000 EUR or 10 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
  4. 10 000 000 EUR or 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Explanation

Article 83(5) sets the higher tier of administrative fines at up to 20 000 000 EUR or 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements including the basic principles for processing and conditions for consent. The lower tier in Article 83(4) is 10 000 000 EUR or 2 %.

Question 37Regulatory Framework and Legislation

A controller receives a request from a data subject to erase personal data. Which of the following is a ground for erasure under Article 17(1)?

  1. The personal data are no longer necessary in relation to the purposes for which they were collected. Correct answer.
  2. The data subject simply prefers that the data be deleted.
  3. The data subject has not accessed the data for six months.
  4. The controller has processed the data for less than one year.

Explanation

Article 17(1)(a) provides that the data subject has the right to obtain erasure of personal data where the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Other grounds include withdrawal of consent, objection, unlawful processing, and legal obligation. A mere preference or passage of time is not a ground.

Question 38Regulatory Framework and Legislation

Which of the following statements best describes the GDPR's requirement for data protection by design under Article 25(1)?

  1. The controller must implement appropriate technical and organisational measures at the time of determining the means for processing. Correct answer.
  2. The controller must obtain prior authorisation from the supervisory authority for all new technologies.
  3. The controller must appoint a data protection officer before designing any processing operation.
  4. The controller must conduct a data protection impact assessment for every processing operation.

Explanation

Article 25(1) requires the controller to implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement data protection principles in an effective manner and to integrate necessary safeguards into the processing, both at the time of determining the means and at the time of processing. It does not require a DPO or a DPIA for every operation, nor prior authorisation for all new technologies.

Question 39Regulatory Framework and Legislation

Which of the following is a condition for valid consent under the GDPR when a controller relies on consent for processing?

  1. Consent must be renewed every six months.
  2. Consent must be freely given, specific, informed and unambiguous. Correct answer.
  3. Consent must be bundled with the acceptance of general terms and conditions.
  4. Consent must be given in writing and signed by the data subject.

Explanation

Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them. Consent must be distinguished from other matters and cannot be bundled with general terms. The GDPR does not require a written signature or periodic renewal.

Question 40Regulatory Framework and Legislation

A supervisory authority is investigating a controller for a possible infringement of the GDPR. Which of the following powers does the supervisory authority have under Article 58?

  1. The power to suspend the controller's business licence permanently.
  2. The power to award compensation to data subjects for material damage.
  3. The power to criminally prosecute the controller's staff.
  4. The power to order the controller to provide any information it requires for the performance of its tasks. Correct answer.

Explanation

Article 58(1)(a) grants supervisory authorities the power to order the controller and the processor to provide any information they require for the performance of their tasks. Other investigative powers include access to data and premises. Compensation is a matter for judicial remedies under Article 82, and criminal prosecution or permanent licence suspension is outside the GDPR's administrative powers.

Question 41Radiation Protection and Safety

Under the system of radiological protection, which quantity is used for the purpose of setting dose limits for occupational exposure?

  1. Equivalent dose to the lens of the eye only
  2. Effective dose Correct answer.
  3. Ambient dose equivalent
  4. Collective effective dose

Explanation

Dose limits in the system of radiological protection are expressed in effective dose for whole-body stochastic risk, supplemented by equivalent dose limits for specific tissues such as the lens of the eye, skin, and extremities. Ambient dose equivalent is an operational quantity used for area monitoring, not for regulatory dose limits. Collective dose aggregates population exposure and is not compared with individual limits.

Question 42Radiation Protection and Safety

A radiation worker is classified as a Category A worker under the IAEA Basic Safety Standards. Which set of arrangements is required for this classification?

  1. Self-declared dose records submitted annually
  2. Individual dose monitoring and health surveillance, with dose records maintained Correct answer.
  3. Only a film badge issued at the start of employment
  4. Monitoring required only when the worker handles unsealed sources

Explanation

Category A workers are those who may receive an effective dose exceeding 6 mSv per year or an equivalent dose exceeding three-tenths of the relevant limit, and they require individual monitoring, health surveillance, and recorded dose assessment. Monitoring must be routine and dose records maintained, not issued once and forgotten. Self-declaration is not an acceptable substitute for the required individual monitoring programme.

Question 43Radiation Protection and Safety

Which principle of the system of radiological protection requires that no practice be adopted unless it produces sufficient benefit to offset the detriment it causes?

  1. Dose limitation
  2. Optimisation
  3. Justification Correct answer.
  4. Graded approach

Explanation

Justification is the principle that decisions to introduce or change a practice should do more good than harm. Optimisation concerns keeping doses as low as reasonably achievable, and dose limitation caps individual doses from a source. The graded approach concerns applying regulatory requirements in proportion to the magnitude of risk.

Question 44Radiation Protection and Safety

During a planned maintenance task, a worker's extremities may receive a significant dose. Which limit applies to the equivalent dose to the hands and feet for an occupational exposure?

  1. 50 mSv per year
  2. 150 mSv per year
  3. 20 mSv per year
  4. 500 mSv per year Correct answer.

Explanation

The IAEA Basic Safety Standards set an equivalent dose limit of 500 mSv per year for the extremities (hands and feet) and for the skin, averaged over any 1 cm² area. The 150 mSv value is the limit for the lens of the eye in the current standards. The 20 mSv figure is the effective dose limit averaged over defined periods.

Question 45Radiation Protection and Safety

A sealed source containing a high-activity radionuclide is used in a fixed industrial radiography installation. Which combination of safety measures is most appropriate for the installation?

  1. A storage cupboard with a padlock and annual leak testing
  2. A lead apron for the operator and a sign on the door
  3. A hand-held survey meter and a written procedure only
  4. Interlocked shielding enclosure, warning signals, and restricted access Correct answer.

Explanation

Fixed radiography installations require engineered controls such as shielded enclosures, interlocks, and warning signals to prevent inadvertent exposure, together with restricted access. A survey meter and written procedure alone provide no engineered barrier against exposure. Personal protective equipment and signage are supporting measures but cannot replace shielding and interlocks for high-activity sources.

Question 46Radiation Protection and Safety

Which of the following best describes the ALARA principle as applied to occupational radiation protection?

  1. Doses must always be reduced to zero regardless of cost
  2. Doses are kept below the dose limit at all times
  3. Doses and likelihood of exposure are kept as low as reasonably achievable, economic and social factors being taken into account Correct answer.
  4. Doses are reduced only when they exceed half of the dose limit

Explanation

ALARA is the optimisation principle: doses and the likelihood of exposure should be kept as low as reasonably achievable, taking economic and social factors into account. It is not an absolute requirement to reach zero, nor a fixed fraction of the dose limit. Compliance with the dose limit is a separate, mandatory requirement.

Question 47Radiation Protection and Safety

Which instrument is most suitable for measuring dose rates from a gamma-emitting source in a workplace survey?

  1. A Geiger counter without energy compensation used as a dosimeter
  2. A personal dosimeter worn on the chest
  3. A liquid scintillation counter
  4. A calibrated survey meter with an energy-compensated GM or ionisation chamber detector Correct answer.

Explanation

Workplace dose-rate surveys require a calibrated survey meter whose detector response is appropriate for the photon energies present; energy-compensated GM tubes or ionisation chambers are suitable. A personal dosimeter measures accumulated individual dose, not instantaneous area dose rate. Liquid scintillation counting is a laboratory technique for measuring activity in samples, not for area dose-rate surveys.

Question 48Radiation Protection and Safety

What is the primary purpose of personal dosimetry for radiation workers?

  1. To measure the activity of a sealed source
  2. To determine the half-life of a radionuclide
  3. To assess and record individual doses for comparison with dose limits and for optimisation Correct answer.
  4. To detect contamination on the skin

Explanation

Personal dosimetry provides an assessment of the individual dose received by a worker so that it can be compared with dose limits and used to optimise protection. Contamination monitoring uses different techniques such as wipe tests and hand monitors. Activity measurement and half-life determination are source or radionuclide characterisation tasks, not personal dosimetry.

Question 49Radiation Protection and Safety

An unsealed source of iodine-131 is used in a hospital. Which measure is most important for controlling internal exposure of staff?

  1. Limiting the number of staff who enter the building
  2. Increasing the distance from the source at all times
  3. Containment and ventilation controls combined with contamination monitoring and personal protective equipment Correct answer.
  4. Using lead aprons during all procedures

Explanation

Internal exposure from unsealed radionuclides is controlled primarily by containment, ventilation, contamination control, and appropriate personal protective equipment to prevent inhalation and ingestion. Distance reduces external dose but does not prevent intake of radioactive material. Lead aprons shield against external radiation and offer no protection against internal contamination.

Question 50Radiation Protection and Safety

Which document in a radiation protection programme typically defines the organisational structure, responsibilities, and arrangements for protection?

  1. The instrument calibration certificate
  2. The radiation protection programme description Correct answer.
  3. The source inventory list
  4. The patient consent form

Explanation

The radiation protection programme description sets out the organisational structure, responsibilities, policies, and arrangements for implementing protection. Calibration certificates, source inventories, and consent forms are supporting records, not the governing programme document.