I85PREP
⌘ K
NIS 2 Foundation study materials
NIS 2 Foundation study resources

NIS 2 Foundation practice questions

One question at a time. Build your NIS 2 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1NIS 2 Directive fundamentals and scope

The NIS 2 Directive was adopted to replace which earlier EU legal instrument on network and information security?

  1. The Cybersecurity Act (EU) 2019/881
  2. The NIS Directive (EU) 2016/1148 Correct answer.
  3. The GDPR (EU) 2016/679
  4. The eIDAS Regulation (EU) 910/2014

Explanation

NIS 2 (Directive (EU) 2022/2555) repeals and replaces the original NIS Directive (EU) 2016/1148, which had been in force since 2016. The GDPR covers personal data protection, eIDAS covers electronic identification and trust services, and the Cybersecurity Act establishes the ENISA mandate and certification framework. Only the 2016 NIS Directive is the predecessor that NIS 2 formally replaces.

Question 2NIS 2 Directive fundamentals and scope

Which type of legal instrument is the NIS 2 Directive, and what does that imply for Member States?

  1. A regulation that applies directly without national transposition
  2. A directive that Member States must transpose into national law by a set deadline Correct answer.
  3. A recommendation that Member States may adopt voluntarily
  4. A decision addressed only to EU institutions

Explanation

A directive binds Member States as to the result to be achieved but leaves the choice of form and methods to national authorities, so each Member State must adopt transposing legislation. NIS 2 sets a transposition deadline of 17 October 2024. Regulations, by contrast, apply directly, while recommendations carry no binding obligation.

Question 3NIS 2 Directive fundamentals and scope

Under NIS 2, entities are classified into which two categories that determine the intensity of obligations and supervision?

  1. Essential and important entities Correct answer.
  2. Micro and small enterprises
  3. Public and private bodies
  4. Operators of essential services and digital service providers

Explanation

NIS 2 introduces a two-tier classification of essential entities and important entities, based on sector, size and criticality criteria. The distinction drives differences in ex-ante supervision, penalties and enforcement. The older NIS 1 categories of operators of essential services and digital service providers were replaced by this framework.

Question 4NIS 2 Directive fundamentals and scope

Which of the following is one of the sectors listed in Annex I of NIS 2 as a sector of high criticality?

  1. Energy Correct answer.
  2. Tourism
  3. Real estate
  4. Retail trade

Explanation

Annex I of NIS 2 lists sectors of high criticality, including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space. Energy is explicitly named there. Retail trade, tourism and real estate are not among the Annex I high-criticality sectors.

Question 5NIS 2 Directive fundamentals and scope

Which sector appears in Annex II of NIS 2 as an 'other critical sector' rather than in Annex I?

  1. Space
  2. Digital infrastructure
  3. Drinking water
  4. Postal and courier services Correct answer.

Explanation

Annex II covers other critical sectors such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. Postal and courier services are listed there. Drinking water, digital infrastructure and space are all Annex I high-criticality sectors.

Question 6NIS 2 Directive fundamentals and scope

A medium-sized company provides cloud computing services in the EU. Under NIS 2, how is it generally treated for scope purposes?

  1. It is in scope only if it is designated as an operator of essential services by a Member State
  2. It is in scope as a digital infrastructure provider regardless of the general size threshold Correct answer.
  3. It is out of scope because cloud providers are regulated only under the GDPR
  4. It is out of scope unless it employs more than 500 staff

Explanation

NIS 2 treats cloud computing service providers as part of the digital infrastructure sector, and certain digital infrastructure and ICT service providers fall in scope irrespective of their size. The general medium-enterprise threshold does not exclude them. Designation as an operator of essential services is a NIS 1 concept that NIS 2 replaced.

Question 7NIS 2 Directive fundamentals and scope

Which size criterion generally brings a medium-sized enterprise in a listed sector into the scope of NIS 2?

  1. It has 50 or more staff, or annual turnover and balance sheet total above EUR 10 million Correct answer.
  2. It has 25 or more staff, or annual turnover above EUR 2 million
  3. It has 250 or more staff only
  4. It has 100 or more staff and annual turnover above EUR 50 million

Explanation

NIS 2 applies to medium and large enterprises, where a medium enterprise has 50 or more employees or an annual turnover and balance sheet total exceeding EUR 10 million. Large enterprises have 250 or more employees or turnover above EUR 50 million and a balance sheet total above EUR 43 million. The other thresholds do not correspond to the directive's size rules.

Question 8NIS 2 Directive fundamentals and scope

Under NIS 2, when is a qualified trust service provider considered in scope?

  1. Only when it exceeds 250 employees
  2. Only when it processes personal data
  3. Only when it is publicly owned
  4. Regardless of its size, because qualified trust service providers are always covered Correct answer.

Explanation

NIS 2 explicitly includes qualified trust service providers in scope irrespective of their size, reflecting their role in digital trust. The general medium and large enterprise thresholds do not apply to them. Ownership and personal data processing are not the determining criteria.

Question 9NIS 2 Directive fundamentals and scope

Which entities does NIS 2 cover as 'public administration entities' at central government level?

  1. Public administration entities of central government, with limited exceptions such as judiciary, parliaments and central banks for certain activities Correct answer.
  2. Only agencies that manage critical infrastructure directly
  3. Only ministries of defence and interior
  4. All municipalities regardless of size

Explanation

NIS 2 covers public administration entities at central government level, but carves out entities carrying out activities in the areas of national security, public security, defence and law enforcement, and excludes parliaments and central banks from certain provisions. Municipalities are not automatically covered as central government entities. The scope is therefore broader than defence or interior ministries alone.

Question 10NIS 2 Directive fundamentals and scope

An SME provides domain name registration services. How does NIS 2 treat DNS service providers for scope purposes?

  1. They are covered only if they host more than 10,000 domains
  2. They fall within the digital infrastructure sector and are covered irrespective of size Correct answer.
  3. They are covered only if they are also telecom operators
  4. They are exempt because they are small

Explanation

DNS service providers, along with TLD name registries and domain name registration services, are part of the digital infrastructure sector and are covered by NIS 2 without applying the general size threshold. Being small does not exempt them. There is no domain-count threshold in the directive for this coverage.

Question 11NIS 2 Directive fundamentals and scope

What is the default rule under NIS 2 for entities that fall below the size thresholds but are nonetheless critical for specific reasons?

  1. They must self-declare as important entities to a national authority
  2. They may be brought into scope by Member States where they are critical, subject to the directive's conditions Correct answer.
  3. They can never be in scope
  4. They are automatically essential entities

Explanation

NIS 2 allows Member States to include entities that do not meet the size thresholds where they are considered critical for specific reasons, under conditions set out in the directive. This preserves flexibility for national authorities. Such entities are not automatically classified as essential, and self-declaration is not the mechanism.

Question 12NIS 2 Directive fundamentals and scope

Which of the following best describes the territorial scope of NIS 2?

  1. Only entities physically located in the EU
  2. Entities providing services in the EU, including certain non-EU entities that offer services within the Union Correct answer.
  3. Only entities that process EU citizens' personal data
  4. Only entities that are majority-owned by EU nationals

Explanation

NIS 2 has an effects-based territorial scope: it applies to entities providing services within the EU, and it can reach non-EU entities that offer services in the Union, for example through a designated representative. Physical establishment in the EU is not the sole criterion. Personal data processing and ownership nationality are not the tests.

Question 13NIS 2 Directive fundamentals and scope

How does NIS 2 address the relationship with the GDPR when an incident involves personal data?

  1. NIS 2 obligations apply without prejudice to the GDPR, and both regimes can apply simultaneously Correct answer.
  2. Only the GDPR applies if any personal data is involved
  3. NIS 2 replaces the GDPR for cybersecurity incidents
  4. The GDPR prevails and NIS 2 incident reporting is suspended

Explanation

NIS 2 states that its requirements apply without prejudice to the GDPR and other Union law on personal data protection. Where an incident involves personal data, both the NIS 2 incident reporting and the GDPR breach notification obligations may apply. Neither regime displaces the other.

Question 14NIS 2 Directive fundamentals and scope

Which national body does NIS 2 require Member States to designate to oversee implementation at national level?

  1. One or more competent authorities, a single point of contact, and CSIRTs Correct answer.
  2. An independent data protection authority in every case
  3. The European Commission directly
  4. A single national cyber crisis management team only

Explanation

NIS 2 requires each Member State to designate one or more competent authorities responsible for cybersecurity and supervisory tasks, a single point of contact for cross-border cooperation, and one or more CSIRTs. The Commission coordinates at EU level but does not act as the national authority. Data protection authorities are not the default NIS 2 supervisors.

Question 15NIS 2 Directive fundamentals and scope

Which EU body does NIS 2 establish to support strategic cooperation and information exchange among Member States?

  1. The Board of Supervisors of ENISA
  2. The Cooperation Group Correct answer.
  3. The European Data Protection Board
  4. The European Cybersecurity Certification Group

Explanation

NIS 2 establishes the Cooperation Group to enable strategic cooperation and information exchange among Member States, supported by the CSIRTs network and the EU-CyCLONe network for operational crisis cooperation. The EDPB is a GDPR body, the certification group relates to the Cybersecurity Act, and the ENISA management board is an agency governance body.

Question 16NIS 2 Directive fundamentals and scope

Which network does NIS 2 create for operational-level cooperation on large-scale cybersecurity incidents and crises?

  1. The CSIRTs network
  2. The European Cybercrime Centre
  3. The EU-CyCLONe network Correct answer.
  4. The NIS Cooperation Group

Explanation

EU-CyCLONe is the European Cyber Crises Liaison Organisation Network, set up under NIS 2 to support coordinated management of large-scale cybersecurity incidents and crises at operational level. The CSIRTs network handles technical incident cooperation, the Cooperation Group is strategic, and Europol's EC3 is a law enforcement body.

Question 17NIS 2 Directive fundamentals and scope

What is the main purpose of the peer reviews introduced by NIS 2?

  1. To approve mergers between critical infrastructure operators
  2. To audit the financial statements of essential entities
  3. To assess the effectiveness of Member States' implementation and supervisory practices Correct answer.
  4. To certify products under the EU cybersecurity certification scheme

Explanation

NIS 2 introduces peer reviews to examine the effectiveness of Member States' implementation of the directive, including their supervisory practices and institutional arrangements. They are not financial audits, product certifications under the Cybersecurity Act, or merger approvals. The goal is mutual learning and consistent implementation across the Union.

Question 18NIS 2 Directive fundamentals and scope

Which of the following is a key change introduced by NIS 2 compared with the original NIS Directive regarding scope?

  1. It removes all obligations for digital service providers
  2. It narrows scope to only operators designated as essential services
  3. It limits the directive to public sector entities
  4. It expands scope to additional sectors and introduces the essential/important distinction Correct answer.

Explanation

NIS 2 significantly broadens the scope of the original NIS Directive by covering more sectors and by classifying entities as essential or important. It does not narrow the scope to designated operators, does not remove digital service provider obligations, and does not restrict coverage to the public sector.

Question 19NIS 2 Directive fundamentals and scope

Which of these is an example of an 'important entity' under NIS 2?

  1. A national central bank
  2. A large hospital providing essential healthcare services
  3. A medium-sized enterprise in the manufacturing sector listed in Annex II Correct answer.
  4. A public administration entity of central government

Explanation

Annex II sectors, such as manufacturing, generally lead to classification as important entities when the entity is medium or large. Healthcare providers are typically essential entities, and central banks and central government administration are treated under the public administration provisions. The essential/important distinction follows the annex and sector rules.

Question 20NIS 2 Directive fundamentals and scope

What does NIS 2 require Member States to establish for the management of large-scale cybersecurity incidents at national level?

  1. A private certification body for cloud services
  2. A single EU-wide supervisory authority
  3. A national cybersecurity strategy and national cyber crisis management framework Correct answer.
  4. A voluntary code of conduct for SMEs

Explanation

NIS 2 requires each Member State to adopt a national cybersecurity strategy and to establish a national cyber crisis management framework with clear roles and responsibilities. It does not create a single EU-wide supervisory authority, and certification and codes of conduct are separate instruments. The crisis management framework supports coordinated response.

Question 21NIS 2 Directive fundamentals and scope

How does NIS 2 relate to the Cybersecurity Act (EU) 2019/881?

  1. NIS 2 transfers ENISA's mandate to the Commission
  2. NIS 2 repeals the Cybersecurity Act
  3. NIS 2 prohibits the use of certification schemes
  4. NIS 2 complements it by using the EU cybersecurity certification schemes developed under it Correct answer.

Explanation

NIS 2 works alongside the Cybersecurity Act, and Member States may require or encourage the use of certified products and services under EU cybersecurity certification schemes. NIS 2 does not repeal the Cybersecurity Act, ban certification, or transfer ENISA's mandate. The two instruments are complementary.

Question 22NIS 2 Directive fundamentals and scope

Which of the following entities is generally excluded from the scope of NIS 2?

  1. A TLD name registry
  2. A cloud computing service provider
  3. A qualified trust service provider
  4. A small enterprise in a non-listed sector Correct answer.

Explanation

NIS 2 applies to medium and large enterprises in listed sectors, plus certain entities irrespective of size such as cloud providers, qualified trust service providers and TLD registries. A small enterprise operating in a sector not listed in the annexes generally falls outside scope. The other listed options are expressly covered.

Question 23NIS 2 Directive fundamentals and scope

Which statement best captures the registration obligation that NIS 2 imposes on in-scope entities?

  1. Entities must register annually with ENISA
  2. Entities are not required to register if they are important entities
  3. Entities must register only with the European Commission
  4. Entities must register with the competent authority, providing information such as their services, addresses and IP ranges Correct answer.

Explanation

NIS 2 requires essential and important entities to submit certain information to the competent authorities for registration, including their name, relevant sector, addresses and, where applicable, IP ranges. Registration is not centralised with the Commission or ENISA. Important entities are also subject to this obligation.

Question 24NIS 2 Directive fundamentals and scope

Which of the following is a stated aim of NIS 2 as reflected in its scope and structure?

  1. To centralise all cybersecurity supervision in a single EU agency
  2. To replace national CSIRTs with a single EU team
  3. To harmonise cybersecurity requirements across the EU internal market and reduce fragmentation Correct answer.
  4. To exempt critical infrastructure from national regulation

Explanation

NIS 2 aims to achieve a high common level of cybersecurity across the Union, harmonising requirements and reducing fragmentation in the internal market. It does not centralise supervision in one EU agency, replace national CSIRTs, or exempt critical infrastructure. National authorities and CSIRTs remain central to implementation.

Question 25NIS 2 Directive fundamentals and scope

A non-EU cloud provider offers services to customers in several Member States but has no establishment in the EU. How does NIS 2 generally address this situation?

  1. It is entirely out of scope because it has no EU establishment
  2. It is covered only if it signs a voluntary code of conduct
  3. It must designate a representative in the EU in the Member State where it offers services, and is otherwise subject to NIS 2 obligations Correct answer.
  4. It is covered only if it processes EU personal data

Explanation

NIS 2 requires non-EU entities providing services within the Union to designate a representative in a Member State where they offer services, unless they are established there. The representative serves as the point of contact for authorities. Absence of an EU establishment does not by itself exclude the provider, and voluntary codes or personal data processing are not the test.

Question 26NIS 2 Directive fundamentals and scope

NIS 2 requires Member States to ensure that in-scope entities comply with its risk-management and reporting obligations. Who bears the ultimate responsibility for compliance within an entity under NIS 2?

  1. The external auditor, which signs off the security policy annually
  2. The sector regulator, which drafts the entity's security policy
  3. The national CSIRT, which certifies each measure before deployment
  4. The entity's management bodies, which must approve and oversee the measures Correct answer.

Explanation

NIS 2 places accountability on the management bodies of essential and important entities. They must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. This makes cybersecurity a governance duty rather than a purely technical task.

Question 27NIS 2 Directive fundamentals and scope

Under NIS 2, which of the following best describes an 'essential entity'?

  1. Any entity that voluntarily registers with the national cybersecurity authority
  2. Any entity that suffers a significant incident in a given calendar year
  3. An entity in a sector of high criticality that exceeds the size thresholds, plus certain entities regardless of size Correct answer.
  4. An entity that supplies hardware to operators of essential services

Explanation

Essential entities are generally entities in the sectors of high criticality listed in Annex I that meet the size thresholds, together with specific categories such as qualified trust service providers and certain providers regardless of size. Voluntary registration or past incidents do not create essential status. The classification drives which supervisory regime applies.

Question 28NIS 2 Directive fundamentals and scope

NIS 2 distinguishes 'essential' from 'important' entities. What is the main consequence of that distinction?

  1. The supervisory approach: ex ante oversight for essential entities, ex post for important entities Correct answer.
  2. The scope of the GDPR: important entities are exempt from data protection rules
  3. The reporting deadlines: essential entities report within 24 hours, important entities within 72 hours
  4. The language of notification: essential entities report in English only

Explanation

The essential/important distinction primarily shapes supervision. Essential entities are subject to proactive, ex ante supervision, while important entities are generally supervised ex post, after evidence or an incident emerges. Both categories share the same core risk-management and reporting obligations.

Question 29NIS 2 Directive fundamentals and scope

Which list in NIS 2 identifies the sectors of high criticality whose entities may qualify as essential entities?

  1. Annex V
  2. Annex III
  3. Annex VII
  4. Annex I Correct answer.

Explanation

Annex I of NIS 2 lists the sectors of high criticality, such as energy, transport, health, and digital infrastructure. Annex II lists the other critical sectors whose entities are generally important entities. The annex placement matters because it feeds into the essential/important classification.

Question 30NIS 2 Directive fundamentals and scope

A hospital group operates in a Member State and exceeds the size thresholds. Under NIS 2, in which sector category does health care generally fall?

  1. A voluntary sector covered only if the Member State opts in
  2. A sector outside NIS 2 scope, because health data is covered only by the GDPR
  3. A sector of high criticality under Annex I, making the entity potentially essential Correct answer.
  4. An other critical sector under Annex II, making the entity always important

Explanation

Health is listed among the sectors of high criticality in Annex I of NIS 2. A health entity above the size thresholds therefore falls into the essential entity category by default. GDPR obligations apply in parallel but do not remove the entity from NIS 2 scope.

Question 31NIS 2 Directive fundamentals and scope

Which of the following is listed in NIS 2 as an 'other critical sector' under Annex II rather than a sector of high criticality?

  1. Drinking water supply
  2. Digital infrastructure
  3. Postal and courier services Correct answer.
  4. Waste water management

Explanation

Postal and courier services appear among the other critical sectors in Annex II. Drinking water, waste water, and digital infrastructure are sectors of high criticality in Annex I. Entities in Annex II sectors are generally classified as important entities when they meet the size rules.

Question 32NIS 2 Directive fundamentals and scope

NIS 2 applies size thresholds to determine which entities are in scope. Which combination reflects the general rule for medium-sized enterprises?

  1. 500 or more employees, or turnover above EUR 100 million
  2. 50 or more employees, or annual turnover and balance sheet total above EUR 10 million Correct answer.
  3. 10 or more employees, or turnover above EUR 2 million
  4. 250 or more employees, or turnover above EUR 50 million

Explanation

NIS 2 uses the SME definition from the Annex to Recommendation 2003/361/EC. Medium-sized enterprises generally have 50 or more but fewer than 250 employees, or turnover and balance sheet total above EUR 10 million but not exceeding EUR 50 million. Entities at or above the medium threshold are generally in scope when their sector is listed.

Question 33NIS 2 Directive fundamentals and scope

NIS 2 contains provisions for entities that fall below the size thresholds but are still considered critical. How are such entities generally handled?

  1. Member States may designate them as essential or important entities based on criteria such as criticality or sole provider status Correct answer.
  2. They become essential entities only after a significant incident occurs
  3. They are automatically excluded from NIS 2 regardless of their role in the supply chain
  4. They are covered only if they are majority-owned by the state

Explanation

NIS 2 allows Member States to identify entities below the size thresholds that are nonetheless critical, for example because of their role in society, the economy, or particular sectors. Such entities can be designated as essential or important. This prevents small but systemically important providers from escaping the regime.

Question 34NIS 2 Directive fundamentals and scope

Which of the following best describes the entities that NIS 2 covers in the digital infrastructure sector?

  1. Only entities that manufacture network hardware inside the EU
  2. Only telecommunications operators that own physical network infrastructure
  3. Internet exchange points, DNS service providers, TLD name registries, cloud providers, data centres, CDNs, and managed service providers Correct answer.
  4. Only social media platforms with more than 45 million users

Explanation

NIS 2 lists a set of digital infrastructure categories including internet exchange points, DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery networks, managed service providers, and managed security service providers. Many of these are in scope regardless of size. The list is broader than classic telecom operators.

Question 35NIS 2 Directive fundamentals and scope

A managed security service provider is established in a Member State. How does NIS 2 treat such providers for scope purposes?

  1. They are in scope only if they serve more than 250 employees
  2. They are in scope as digital infrastructure providers, generally regardless of size Correct answer.
  3. They are out of scope because security services are not listed in the annexes
  4. They are in scope only if they also operate a public telecom network

Explanation

Managed security service providers are expressly listed among digital infrastructure entities in NIS 2. Like several other digital infrastructure categories, they are generally covered regardless of size because of their systemic role. Their customers' size does not determine their own scope status.

Question 36NIS 2 Directive fundamentals and scope

Which of the following is a public administration entity covered by NIS 2?

  1. A municipal museum with no digital service obligations
  2. A privately owned bank operating under a national licence
  3. A regional government body that provides administrative services, where designated under national law Correct answer.
  4. A state-owned energy utility that operates generation assets

Explanation

NIS 2 covers public administration entities at central and regional level, subject to certain exclusions such as parliaments, courts, and central banks in specific functions. Member States determine the detailed application at regional level. A private bank or an energy utility falls under other sector categories, not public administration.

Question 37NIS 2 Directive fundamentals and scope

NIS 2 covers certain entities in the space sector. Which of the following best describes that coverage?

  1. Operators of ground-based infrastructure supporting space-based services, such as teleports and satellite control Correct answer.
  2. Only entities that launch rockets from EU territory
  3. All companies that manufacture satellites, regardless of the services they provide
  4. Only public space agencies funded by Member States

Explanation

The space sector coverage in NIS 2 focuses on operators of ground-based infrastructure that support the provision of space-based services, such as teleports and satellite control centres. Satellite manufacturing or launch activity alone is not the defining criterion. The focus is on the infrastructure that supports service delivery.

Question 38NIS 2 Directive fundamentals and scope

NIS 2 requires Member States to adopt a national cybersecurity strategy. Which of the following is a typical element that such a strategy should address?

  1. The exact tariff rates that telecom operators may charge for security services
  2. The names of individual employees responsible for security at each entity
  3. The licensing fees payable to the national CSIRT by vendors
  4. Objectives and priorities for cybersecurity, including supply chain security and incident response Correct answer.

Explanation

A national cybersecurity strategy under NIS 2 sets objectives and priorities and addresses matters such as supply chain security, incident response, and cooperation. It is a policy instrument rather than a schedule of tariffs or a register of named individuals. Member States must adopt and periodically review it.

Question 39NIS 2 Directive fundamentals and scope

NIS 2 requires Member States to designate one or more competent authorities. Which of the following is a task assigned to those authorities?

  1. Operating the EU Agency for Cybersecurity on behalf of the Commission
  2. Adopting the directive's annexes through delegated acts
  3. Representing the EU in international cyber defence negotiations
  4. Supervising compliance by essential and important entities and imposing penalties where needed Correct answer.

Explanation

Competent authorities supervise entities in their territory, assess compliance, and can impose penalties. They also handle registration and cooperation tasks under the directive. ENISA is an EU agency with its own mandate, and annex changes are not made by national authorities.

Question 40NIS 2 Directive fundamentals and scope

Which body does NIS 2 establish to support strategic cooperation and information exchange among Member States on cybersecurity?

  1. The European Data Protection Board
  2. The European Cybersecurity Certification Group
  3. The Cooperation Group Correct answer.
  4. The Single Resolution Board

Explanation

NIS 2 establishes the Cooperation Group, composed of representatives of Member States, the Commission, and ENISA. Its role is strategic cooperation and information exchange. The other bodies listed have different mandates or exist under other legal instruments.

Question 41NIS 2 Directive fundamentals and scope

NIS 2 creates a network of national CSIRTs to support operational cooperation. What is the main purpose of that network?

  1. To set the salary scales of cybersecurity staff in Member States
  2. To approve the annual budgets of essential entities
  3. To issue binding interpretations of the GDPR
  4. To support coordinated handling of incidents and crises and to exchange technical information Correct answer.

Explanation

The CSIRTs network supports operational cooperation, including coordinated incident and crisis handling and technical information exchange. It complements the more strategic Cooperation Group. It does not set salaries, approve entity budgets, or interpret data protection law.

Question 42NIS 2 Directive fundamentals and scope

How does NIS 2 relate to the GDPR when an entity processes personal data?

  1. NIS 2 excludes personal data from its incident reporting duties
  2. NIS 2 requires entities to choose one regime and notify the other authority
  3. NIS 2 replaces the GDPR for entities in the essential category
  4. NIS 2 applies without prejudice to the GDPR, so both regimes can apply simultaneously Correct answer.

Explanation

NIS 2 is without prejudice to Union law on data protection, so the GDPR continues to apply in full. An incident may trigger both NIS 2 reporting to the CSIRT and GDPR breach notification to the supervisory authority. The two obligations are cumulative, not alternatives.

Question 43NIS 2 Directive fundamentals and scope

NIS 2 requires in-scope entities to register with the competent authority. What information must generally be provided?

  1. The source code of the entity's core software products
  2. The entity's full customer list and contract values
  3. The personal data of all employees handling security
  4. The entity's name, address, sector, and the Member State where it provides services Correct answer.

Explanation

Registration under NIS 2 captures basic identification and scope information, such as name, address, sector, and the Member State or States where the entity provides services. It is not a disclosure of customer lists, employee data, or source code. The register supports supervision and cooperation.

Question 44NIS 2 Directive fundamentals and scope

An entity provides electronic communications services to the public in a Member State. In which NIS 2 sector is it classified?

  1. Space, because it uses satellites for transmission
  2. Digital infrastructure, within the annexes of the directive Correct answer.
  3. Banking, because it handles payment data
  4. Public administration, because it serves the public

Explanation

Providers of public electronic communications networks or services are covered within the digital infrastructure category in NIS 2. Serving the public does not make them public administration entities. The classification depends on the service type, not on the medium used for transmission.

Question 45NIS 2 Directive fundamentals and scope

Which of the following is the main stated purpose of NIS 2 as reflected in its scope?

  1. To achieve a high common level of cybersecurity across the Union Correct answer.
  2. To harmonise consumer contract law for digital products
  3. To replace national criminal law on cybercrime
  4. To establish a single EU-wide cybersecurity certification scheme

Explanation

NIS 2 aims to achieve a high common level of cybersecurity across the Union by broadening and strengthening the rules introduced by the original directive. Consumer contract law, certification schemes, and criminal law fall under other instruments. The directive's scope reflects that overarching objective.

Question 46NIS 2 Directive fundamentals and scope

Which of the following entities is expressly excluded from the scope of NIS 2?

  1. Entities carrying out activities in the area of national security or defence Correct answer.
  2. Qualified trust service providers
  3. Cloud computing service providers
  4. Operators of drinking water supply

Explanation

NIS 2 excludes entities active in national security and defence, as well as certain other activities such as law enforcement and judicial functions in specific respects. Cloud providers, trust service providers, and water operators are expressly covered. The exclusion recognises the sovereign nature of security and defence activities.

Question 47NIS 2 Directive fundamentals and scope

NIS 2 establishes a peer review mechanism. What is the main focus of those peer reviews?

  1. Certifying individual security products for the EU market
  2. Evaluating the cybersecurity maturity of non-EU countries
  3. Assessing the implementation of the directive by Member States, including supervisory practices Correct answer.
  4. Auditing the financial statements of essential entities

Explanation

Peer reviews under NIS 2 examine how Member States implement and supervise the directive, promoting consistency and mutual learning. They do not audit entity financial statements or certify products. Product certification is handled through other instruments such as the Cybersecurity Act.

Question 48NIS 2 Directive fundamentals and scope

NIS 2 applies to entities providing services within the Union. How is the territorial scope generally described?

  1. It covers only entities that own physical infrastructure inside the EU
  2. It covers entities established in the Union, plus certain providers offering services in the Union from outside Correct answer.
  3. It covers only entities headquartered in the EU institutions' host country
  4. It covers only entities that employ EU citizens

Explanation

NIS 2 covers entities established in the Union and extends to certain providers offering services within the Union even without an EU establishment, such as DNS, cloud, and managed service providers. Physical infrastructure ownership or employee nationality is not the test. This ensures services used in the EU are covered regardless of where the provider is based.

Question 49NIS 2 Directive fundamentals and scope

A non-EU cloud provider offers services to customers in several Member States without an EU establishment. Which mechanism does NIS 2 use to bring such providers under supervision?

  1. Requirement that customers verify the provider's security on the authority's behalf
  2. Automatic exclusion, because the provider has no EU establishment
  3. Application of the law of the provider's home country instead of NIS 2
  4. Designation of a representative in the Union and attribution to a Member State where services are offered Correct answer.

Explanation

NIS 2 requires certain non-EU providers of services such as cloud computing, DNS, and managed services to designate a representative in the Union. Jurisdiction is attributed to the Member State where the services are offered, allowing supervision to operate. Customers are not made responsible for regulatory verification.

Question 50NIS 2 Directive fundamentals and scope

NIS 2 requires Member States to adopt rules on penalties for breaches of the national measures transposing it. What does the directive require regarding those penalties?

  1. They must always include criminal imprisonment for managers
  2. They must be identical in amount in every Member State
  3. They must be effective, proportionate, and dissuasive Correct answer.
  4. They must be waived for the first reported incident

Explanation

NIS 2 requires penalties that are effective, proportionate, and dissuasive, while leaving the specific amounts to Member States. It does not require identical amounts across the Union. A first reported incident does not automatically waive penalties, and criminal sanctions are not mandatory for all breaches.