100+ Free NIS 2 LI Practice Questions

The exam is open-book with 12 scenario-based questions to be completed in 3 hours, requiring 70% to pass. PECB is progressively transitioning some certifications to multiple-choice format. Questions assess your ability to apply NIS 2 Directive requirements (Articles 20, 21, 23) to realistic implementation scenarios in essential and important entities.

The NIS 2 Directive transposition deadline was 17 October 2024, meaning EU Member States are now in active enforcement. Around 300,000 organizations across 18 sectors fall in scope, up from roughly 20,000 under NIS 1. Essential entities face fines up to EUR 10 million or 2% of global turnover, and management bodies can be held personally liable under Article 20, driving urgent demand for qualified implementers.

Article 21(2) lists ten minimum measures: (a) risk analysis and information system security policies; (b) incident handling; (c) business continuity and crisis management; (d) supply chain security; (e) security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure; (f) policies to assess effectiveness; (g) basic cyber hygiene and training; (h) cryptography and encryption; (i) human resources security, access control, and asset management; (j) multi-factor authentication or continuous authentication and secured communications.

Article 23 requires three-stage reporting for significant incidents: an early warning within 24 hours of awareness, a more detailed incident notification within 72 hours including initial severity assessment, and a final report within one month of the notification. Reports go to the national CSIRT or competent authority. The phased approach balances speed of containment with depth of post-incident learning.

Essential entities operate in Annex I sectors of high criticality (energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space). Important entities operate in Annex II other critical sectors (postal/courier, waste management, chemicals, food, manufacturing, digital providers, research). Essential entities face stricter ex-ante supervision and fines up to EUR 10M or 2% turnover; important entities face ex-post supervision and fines up to EUR 7M or 1.4% turnover.

ISO/IEC 27001:2022 provides a control framework that maps cleanly to many Article 21 measures, making an existing ISMS a strong NIS 2 starting point. GDPR addresses personal data protection while NIS 2 addresses network and information system security; both require incident reporting but to different authorities. DORA (Digital Operational Resilience Act) is sector-specific (financial entities) and acts as lex specialis, taking precedence over NIS 2 for in-scope financial firms in matters DORA covers.