2026年最新のPECB NIS-2-Directive-Lead-Implementer試験問題には83問があります [Q23-Q40]

質問23、 Scenario 2:
MHospital, founded in 2005 in Metropolis, has become a healthcare industry leader with over 2,000 dedicated employees known for its commitment to qualitative medical services and patient care innovation. With the rise of cyberattacks targeting healthcare institutions, MHospital acknowledged the need for a comprehensive cyber strategy to mitigate risks effectively and ensure patient safety and data security. Hence, it decided to implement the NIS 2 Directive requirements. To avoid creating additional processes that do not fit the company’s context and culture, MHospital decided to integrate the Directive’s requirements into its existing processes. To initiate the implementation of the Directive, the company decided to conduct a gap analysis to assess the current state of the cybersecurity measures against the requirements outlined in the NIS 2 Directive and then identify opportunities for closing the gap.
Recognizing the indispensable role of a computer security incident response team (CSIRT) in maintaining a secure network environment, MHospital empowers its CSIRT to conduct thorough penetration testing on the company’s networks. This rigorous testing helps identify vulnerabilities with a potentially significant impact and enables the implementation of robust security measures. The CSIRT monitors threats and vulnerabilities at the national level and assists MHospital regarding real-time monitoring of their network and information systems. MHospital also conducts cooperative evaluations of security risks within essential supply chains for critical ICT services and systems. Collaborating with interested parties, it engages in the assessment of security risks, contributing to a collective effort to enhance the resilience of the healthcare sector against cyber threats.
To ensure compliance with the NIS 2 Directive’s reporting requirements, MHospital has streamlined its incident reporting process. In the event of a security incident, the company is committed to issuing an official notification within four days of identifying the incident to ensure that prompt actions are taken to mitigate the impact of incidents and maintain the integrity of patient data and healthcare operations. MHospital’s dedication to implementing the NIS 2 Directive extends to cyber strategy and governance. The company has established robust cyber risk management and compliance protocols, aligning its cybersecurity initiatives with its overarching business objectives.
Based on the scenario above, answer the following question:
Is the role of the MHospital’s CSIRT regarding vulnerability assessment in alignment with the requirements of Article 11 of the NIS 2 Directive?

質問24、 During which phase of the key management life cycle can keys be manually adjusted to implement alternative algorithms?

質問25、 Scenario 8: FoodSafe Corporation is a well-known food manufacturing company in Vienna, Austria, which specializes in producing diverse products, from savory snacks to artisanal desserts. As the company operates in regulatory environment subject to this NIS 2 Directive, FoodSafe Corporation has employed a variety of techniques for cybersecurity testing to safeguard the integrity and security of its food production processes.
To conduct an effective vulnerability assessment process, FoodSafe Corporation utilizes a vulnerability assessment tool to discover vulnerabilities on network hosts such as servers and workstations. Additionally, FoodSafe Corporation has made a deliberate effort to define clear testing objectives and obtain top management approval during the discovery phase. This structured approach ensures that vulnerability assessments are conducted with clear objectives and that the management team is actively engaged and supports the assessment process, reinforcing the company’s commitment to cybersecurity excellence.
In alignment with the NIS 2 Directive, FoodSafe Corporation has incorporated audits into its core activities, starting with an internal assessment followed by an additional audit conducted by its partners. To ensure the effectiveness of these audits, the company meticulously identified operational sectors, procedures, and policies. However, FoodSafe Corporation did not utilize an organized audit timetable as part of its internal compliance audit process. While FoodSafe’s Corporation organizational chart does not clearly indicate the audit team’s position, the internal audit process is well-structured. Auditors familiarize themselves with established policies and procedures to gain a comprehensive understanding of their workflow. They engage in discussions with employees further to enhance their insights, ensuring no critical details are overlooked.
Subsequently, FoodSafe Corporation’s auditors generate a comprehensive report of findings, serving as the foundation for necessary changes and improvements within the company. Auditors also follow up on action plans in response to nonconformities and improvement opportunities.
The company recently expanded its offerings by adding new products and services, which had an impact on its cybersecurity program. This required the cybersecurity team to adapt and ensure that these additions were integrated securely into their existing framework. FoodSafe Corporation commitment to enhancing its monitoring and measurement processes to ensure product quality and operational efficiency. In doing so, the company carefully considers its target audience and selects suitable methods for reporting monitoring and measurement results. This incudes incorporating additional graphical elements and labeling of endpoints in their reports to provide a clearer and more intuitive representation of data, ultimately facilitating better decision-making within the organization.
Based on the scenario above, answer the following questions:
Which vulnerability assessment tool did FoodSafe Corporation use?

質問26、 Which statement regarding the EU-CyCLONe is correct?

質問27、 Scenario 6: Solicure is a leading pharmaceutical company dedicated to manufacturing and distributing essential medications. Thriving in an industry characterized by strict regulations and demanding quality benchmarks, Solicure has taken proactive steps to adhere to the requirements of the NIS 2 Directive. This proactive approach strengthens digital resilience and ensures the continued excellence of product offerings.
Last year, a cyberattack disrupted Solicure’s research and development operations, raising concerns about the potential compromise of sensitive information regarding drug formulation. Solicure initiated an immediate investigation led by its cybersecurity team, gathering technical data to understand the attackers’ methods, assess the damage, and swiftly identify the source of the breach. In addition, the company implemented measures to isolate compromised systems and remove the attackers from its network. Lastly, acknowledging the necessity for long-term security improvement, Solicure implemented a comprehensive set of security measures to comply with NIS 2 Directive requirements, covering aspects such as cybersecurity risk management, supply chain security, incident handling, crisis management, and cybersecurity crisis response planning, among others.
In line with its crisis management strategy, Solicure’s chief information security officer, Sarah, led the initiative to develop a comprehensive exercise plan to enhance cyber resilience. This plan was designed to be adaptable and inclusive, ensuring that organizational decision-makers possessed the essential knowledge and skills required for effective cybersecurity threat mitigation. Additionally, to enhance the efficacy of its crisis management planning, Solicure adopted an approach that prioritized the structuring of crisis response.
A key aspect of Solicure’s cybersecurity risk management approach centered on the security of its human resources. Given the sensitive nature of its pharmaceutical products, the company placed utmost importance on the employees’ backgrounds. As a result, Solicure implemented a rigorous evaluation process for new employees, including criminal history reviews, prior role investigations, reference check, and pre-employment drug tests.
To comply with NIS 2 requirements, Solicure integrated a business continuity strategy into its operations. As a leading provider of life-saving medicines and critical healthcare products, Solicure faced high stakes, with potential production and distribution interruptions carrying life-threatening consequences for patients. After extensive research and consultation with business management experts, the company decided to utilize a secondary location to reinforce the critical operations at the primary site. Along with its business continuity management strategy, Solicure developed a set of procedures to recover and protect its IT infrastructure in the event of a disaster and ensure the continued availability of its medications.
Based on this scenario, answer the following question:
Which of the following screening levels did Solicure implement during the evaluation process for new employees?

質問28、 Scenario 3: Founded in 2001, SafePost is a prominent postal and courier company headquartered in Brussels, Belguim. Over the years, it has become a key player in the logistics and courier in the region. With more than 500 employees, the company prides itself on its efficient and reliable services, catering to individual and corporate clients. SafePost has recognized the importance of cybersecurity in an increasingly digital world and has taken significant steps to align its operations with regulatory directives, such as the NIS 2 Directive.
SafePost recognized the importance of thoroughly analyzing market forces and opportunities to inform its cybersecurity strategy. Hence, it selected an approach that enabled the analysis of market forces and opportunities in the four following areas: political, economic, social, and technological. The results of the analysis helped SafePost in anticipating emerging threats and aligning its security measures with the evolving landscape of the postal and courier industry.
To comply with the NIS 2 Directive requirements, SafePost has implemented comprehensive cybersecurity measures and procedures, which have been documented and communicated in training sessions. However, these procedures are used only on individual initiatives and have still not been implemented throughout the company. Furthermore, SafePost’s risk management team has developed and approved several cybersecurity risk management measures to help the company minimize potential risks, protect customer data, and ensure business continuity.
Additionally, SafePost has developed a cybersecurity policy that contains guidelines and procedures for safeguarding digital assets, protecting sensitive data, and defining the roles and responsibilities of employees in maintaining security. This policy will help the company by providing a structured framework for identifying and mitigating cybersecurity risks, ensuring compliance with regulations, and fostering a culture of security awareness among employees, ultimately enhancing overall cybersecurity posture and reducing the likelihood of cyber incidents.
As SafePost continues to navigate the dynamic market forces and opportunities, it remains committed to upholding the highest standards of cybersecurity to safeguard the interests of its customers and maintain its position as a trusted leader in the postal and courier industry.
Based on scenario 3, which of the following approaches was used by SafePost to analyze market forces and opportunities?

質問29、 Scenario 3: Founded in 2001, SafePost is a prominent postal and courier company headquartered in Brussels, Belguim. Over the years, it has become a key player in the logistics and courier in the region. With more than 500 employees, the company prides itself on its efficient and reliable services, catering to individual and corporate clients. SafePost has recognized the importance of cybersecurity in an increasingly digital world and has taken significant steps to align its operations with regulatory directives, such as the NIS 2 Directive.
SafePost recognized the importance of thoroughly analyzing market forces and opportunities to inform its cybersecurity strategy. Hence, it selected an approach that enabled the analysis of market forces and opportunities in the four following areas: political, economic, social, and technological. The results of the analysis helped SafePost in anticipating emerging threats and aligning its security measures with the evolving landscape of the postal and courier industry.
To comply with the NIS 2 Directive requirements, SafePost has implemented comprehensive cybersecurity measures and procedures, which have been documented and communicated in training sessions. However, these procedures are used only on individual initiatives and have still not been implemented throughout the company. Furthermore, SafePost’s risk management team has developed and approved several cybersecurity risk management measures to help the company minimize potential risks, protect customer data, and ensure business continuity.
Additionally, SafePost has developed a cybersecurity policy that contains guidelines and procedures for safeguarding digital assets, protecting sensitive data, and defining the roles and responsibilities of employees in maintaining security. This policy will help the company by providing a structured framework for identifying and mitigating cybersecurity risks, ensuring compliance with regulations, and fostering a culture of security awareness among employees, ultimately enhancing overall cybersecurity posture and reducing the likelihood of cyber incidents.
As SafePost continues to navigate the dynamic market forces and opportunities, it remains committed to upholding the highest standards of cybersecurity to safeguard the interests of its customers and maintain its position as a trusted leader in the postal and courier industry.
Based on scenario 3, what type of policy has SafePost established for protecting digital assets and maintaining security?

質問30、 Scenario 4: StellarTech is a technology company that provides innovative solutions for a connected world. Its portfolio includes groundbreaking Internet of Things (IoT) devices, high-performance software applications, and state-of-the-art communication systems. In response to the ever-evolving cybersecurity landscape and the need to ensure digital resilience, StellarTech has decided to establish a cybersecurity program based on the NIS 2 Directive requirements. The company has appointed Nick, an experienced information security manager, to ensure the successful implementation of these requirements. Nick initiated the implementation process by thoroughly analyzing StellarTech’s organizational structure. He observed that the company has embraced a well-defined model that enables the allocation of verticals based on specialties or operational functions and facilitates distinct role delineation and clear responsibilities.
To ensure compliance with the NIS 2 Directive requirements, Nick and his team have implemented an asset management system and established as asset management policy, set objectives, and the processes to achieve those objectives. As part of the asset management process, the company will identify, record, maintain all assets within the system’s scope.
To manage risks effectively, the company has adopted a structured approach involving the definition of the scope and parameters governing risk management, risk assessments, risk treatment, risk acceptance, risk communication, awareness and consulting, and risk monitoring and review processes. This approach enables the application of cybersecurity practices based on previous and currently cybersecurity activities, including lessons learned and predictive indicators. StellarTech’s organization-wide risk management program aligns with objectives monitored by senior executives, who treat it like financial risk. The budget is structured according to the risk landscape, while business units implement executive vision with a strong awareness of system-level risks. The company shares real-time information, understanding its role within the larger ecosystem and actively contributing to risk understanding. StellarTech’s agile response to evolving threats and emphasis on proactive communication showcase its dedication to cybersecurity excellence and resilience.
Last month, the company conducted a comprehensive risk assessment. During this process, it identified a potential threat associated with a sophisticated form of cyber intrusion, specifically targeting IoT devices. This threat, although theoretically possible, was deemed highly unlikely to materialize due to the company’s robust security measures, the absence of prior incidents, and its existing strong cybersecurity practices.
In terms of the NIST Framework, under which implementation tier does StellarTech fall based on the level of implementation of its risk management measures within the company? Refer to scenario 4.

質問31、 Scenario 4: StellarTech is a technology company that provides innovative solutions for a connected world. Its portfolio includes groundbreaking Internet of Things (IoT) devices, high-performance software applications, and state-of-the-art communication systems. In response to the ever-evolving cybersecurity landscape and the need to ensure digital resilience, StellarTech has decided to establish a cybersecurity program based on the NIS 2 Directive requirements. The company has appointed Nick, an experienced information security manager, to ensure the successful implementation of these requirements. Nick initiated the implementation process by thoroughly analyzing StellarTech’s organizational structure. He observed that the company has embraced a well-defined model that enables the allocation of verticals based on specialties or operational functions and facilitates distinct role delineation and clear responsibilities.
To ensure compliance with the NIS 2 Directive requirements, Nick and his team have implemented an asset management system and established as asset management policy, set objectives, and the processes to achieve those objectives. As part of the asset management process, the company will identify, record, maintain all assets within the system’s scope.
To manage risks effectively, the company has adopted a structured approach involving the definition of the scope and parameters governing risk management, risk assessments, risk treatment, risk acceptance, risk communication, awareness and consulting, and risk monitoring and review processes. This approach enables the application of cybersecurity practices based on previous and currently cybersecurity activities, including lessons learned and predictive indicators. StellarTech’s organization-wide risk management program aligns with objectives monitored by senior executives, who treat it like financial risk. The budget is structured according to the risk landscape, while business units implement executive vision with a strong awareness of system-level risks. The company shares real-time information, understanding its role within the larger ecosystem and actively contributing to risk understanding. StellarTech’s agile response to evolving threats and emphasis on proactive communication showcase its dedication to cybersecurity excellence and resilience.
Last month, the company conducted a comprehensive risk assessment. During this process, it identified a potential threat associated with a sophisticated form of cyber intrusion, specifically targeting IoT devices. This threat, although theoretically possible, was deemed highly unlikely to materialize due to the company’s robust security measures, the absence of prior incidents, and its existing strong cybersecurity practices.
Based on scenario 4, which framework is StellarTech’s structured approach to managing risks aligned with?

質問32、 A financial institution issued a public statement acknowledging a significant breach that occurred. However, they used complex technical jargon and industry-specific terminology that was difficult for the general public to understand. Which principle of effective communication strategy did the institution fail to apply?

質問33、 Scenario 8: FoodSafe Corporation is a well-known food manufacturing company in Vienna, Austria, which specializes in producing diverse products, from savory snacks to artisanal desserts. As the company operates in regulatory environment subject to this NIS 2 Directive, FoodSafe Corporation has employed a variety of techniques for cybersecurity testing to safeguard the integrity and security of its food production processes.
To conduct an effective vulnerability assessment process, FoodSafe Corporation utilizes a vulnerability assessment tool to discover vulnerabilities on network hosts such as servers and workstations. Additionally, FoodSafe Corporation has made a deliberate effort to define clear testing objectives and obtain top management approval during the discovery phase. This structured approach ensures that vulnerability assessments are conducted with clear objectives and that the management team is actively engaged and supports the assessment process, reinforcing the company’s commitment to cybersecurity excellence.
In alignment with the NIS 2 Directive, FoodSafe Corporation has incorporated audits into its core activities, starting with an internal assessment followed by an additional audit conducted by its partners. To ensure the effectiveness of these audits, the company meticulously identified operational sectors, procedures, and policies. However, FoodSafe Corporation did not utilize an organized audit timetable as part of its internal compliance audit process. While FoodSafe’s Corporation organizational chart does not clearly indicate the audit team’s position, the internal audit process is well-structured. Auditors familiarize themselves with established policies and procedures to gain a comprehensive understanding of their workflow. They engage in discussions with employees further to enhance their insights, ensuring no critical details are overlooked.
Subsequently, FoodSafe Corporation’s auditors generate a comprehensive report of findings, serving as the foundation for necessary changes and improvements within the company. Auditors also follow up on action plans in response to nonconformities and improvement opportunities.
The company recently expanded its offerings by adding new products and services, which had an impact on its cybersecurity program. This required the cybersecurity team to adapt and ensure that these additions were integrated securely into their existing framework. FoodSafe Corporation commitment to enhancing its monitoring and measurement processes to ensure product quality and operational efficiency. In doing so, the company carefully considers its target audience and selects suitable methods for reporting monitoring and measurement results. This incudes incorporating additional graphical elements and labeling of endpoints in their reports to provide a clearer and more intuitive representation of data, ultimately facilitating better decision-making within the organization.
Which change factors impacted FoodSafe’s Corporation cybersecurity program? Refer to scenario 8.

質問34、 What is the primary responsibility of an information security manager?

質問35、 Scenario 6: Solicure is a leading pharmaceutical company dedicated to manufacturing and distributing essential medications. Thriving in an industry characterized by strict regulations and demanding quality benchmarks, Solicure has taken proactive steps to adhere to the requirements of the NIS 2 Directive. This proactive approach strengthens digital resilience and ensures the continued excellence of product offerings.
Last year, a cyberattack disrupted Solicure’s research and development operations, raising concerns about the potential compromise of sensitive information regarding drug formulation. Solicure initiated an immediate investigation led by its cybersecurity team, gathering technical data to understand the attackers’ methods, assess the damage, and swiftly identify the source of the breach. In addition, the company implemented measures to isolate compromised systems and remove the attackers from its network. Lastly, acknowledging the necessity for long-term security improvement, Solicure implemented a comprehensive set of security measures to comply with NIS 2 Directive requirements, covering aspects such as cybersecurity risk management, supply chain security, incident handling, crisis management, and cybersecurity crisis response planning, among others.
In line with its crisis management strategy, Solicure’s chief information security officer, Sarah, led the initiative to develop a comprehensive exercise plan to enhance cyber resilience. This plan was designed to be adaptable and inclusive, ensuring that organizational decision-makers possessed the essential knowledge and skills required for effective cybersecurity threat mitigation. Additionally, to enhance the efficacy of its crisis management planning, Solicure adopted an approach that prioritized the structuring of crisis response.
A key aspect of Solicure’s cybersecurity risk management approach centered on the security of its human resources. Given the sensitive nature of its pharmaceutical products, the company placed utmost importance on the employees’ backgrounds. As a result, Solicure implemented a rigorous evaluation process for new employees, including criminal history reviews, prior role investigations, reference check, and pre-employment drug tests.
To comply with NIS 2 requirements, Solicure integrated a business continuity strategy into its operations. As a leading provider of life-saving medicines and critical healthcare products, Solicure faced high stakes, with potential production and distribution interruptions carrying life-threatening consequences for patients. After extensive research and consultation with business management experts, the company decided to utilize a secondary location to reinforce the critical operations at the primary site. Along with its business continuity management strategy, Solicure developed a set of procedures to recover and protect its IT infrastructure in the event of a disaster and ensure the continued availability of its medications.
Based on scenario 6, which of the following approaches did Solicure implement as a part of its business continuity strategy?

質問36、 According to Article 20 of the NIS 2 Directive, what should members of management bodies of essential and important entities be trained on?

質問37、 What is the role of a sponsoring senior executive in the supply chain risk management approach?

質問38、 What is the role of the Commission within the Union Civil Protection Mechanism regarding cybersecurity situational awareness?

質問39、 Scenario 2:
MHospital, founded in 2005 in Metropolis, has become a healthcare industry leader with over 2,000 dedicated employees known for its commitment to qualitative medical services and patient care innovation. With the rise of cyberattacks targeting healthcare institutions, MHospital acknowledged the need for a comprehensive cyber strategy to mitigate risks effectively and ensure patient safety and data security. Hence, it decided to implement the NIS 2 Directive requirements. To avoid creating additional processes that do not fit the company’s context and culture, MHospital decided to integrate the Directive’s requirements into its existing processes. To initiate the implementation of the Directive, the company decided to conduct a gap analysis to assess the current state of the cybersecurity measures against the requirements outlined in the NIS 2 Directive and then identify opportunities for closing the gap.
Recognizing the indispensable role of a computer security incident response team (CSIRT) in maintaining a secure network environment, MHospital empowers its CSIRT to conduct thorough penetration testing on the company’s networks. This rigorous testing helps identify vulnerabilities with a potentially significant impact and enables the implementation of robust security measures. The CSIRT monitors threats and vulnerabilities at the national level and assists MHospital regarding real-time monitoring of their network and information systems. MHospital also conducts cooperative evaluations of security risks within essential supply chains for critical ICT services and systems. Collaborating with interested parties, it engages in the assessment of security risks, contributing to a collective effort to enhance the resilience of the healthcare sector against cyber threats.
To ensure compliance with the NIS 2 Directive’s reporting requirements, MHospital has streamlined its incident reporting process. In the event of a security incident, the company is committed to issuing an official notification within four days of identifying the incident to ensure that prompt actions are taken to mitigate the impact of incidents and maintain the integrity of patient data and healthcare operations. MHospital’s dedication to implementing the NIS 2 Directive extends to cyber strategy and governance. The company has established robust cyber risk management and compliance protocols, aligning its cybersecurity initiatives with its overarching business objectives.
According to scenario 2, as a first step toward the NIS 2 Directive implementation, MHospital decided to conduct a gap analysis to assess its current state of the cybersecurity measures against the requirements outlined in the NIS 2 Directive. Is this in alignment with best practices?

質問40、 According to Article 10 of the NIS 2 Directive, what is one of the responsibilities of Member States concerning CSIRTs?