EPSOHQ
EN

EPSO/AD/430/26 AD8 · Field-related MCQ

AD8 Cybersecurity: EPSO Study Guide

Prepare for Field 2 of EPSO/AD/430/26 with five study topics, free source readings and worked questions on cybersecurity decisions in EU institutions.

Full field mock Worked questions

EPSOHQ Editorial Updated

questions
30
minutes
40
pass mark
15/30

EPSO lists January 2027 as the indicative testing period. Check your personal invitation for exact dates. Official field page: EPSO/AD/430/26 – 2.

Study checklist from Annex II

This EPSOHQ study map follows the published job duties. EPSO has not published a detailed field-test syllabus or topic weights. See Annex II of the official notice.

  1. Risk management and assurance

    Learn: Risk treatment, maturity, assessment scope, patch coverage and residual risk.

    Read: Use NIST CSF 2.0 profiles to compare current and target outcomes (NIST CSF 2.0).

    Practise: Check whether a patching metric hides risk

  2. Architecture, design and technology

    Learn: Trust boundaries, least privilege, secure development, identity, cryptography and cloud responsibility.

    Read: Read the zero-trust tenets in NIST SP 800-207 (NIST SP 800-207).

    Practise: Limit access to a sensitive service

  3. Security operations and incident response

    Learn: Detection coverage, triage, containment, evidence integrity, recovery and lessons learned.

    Read: Use NIST SP 800-61 Rev. 3 to connect investigation, containment and recovery (NIST SP 800-61r3).

    Practise: Preserve evidence while containing an incident

  4. Governance, policy and coordination

    Learn: Institutional responsibilities, significant incident reporting, security programmes and coordination. Contrast Union-entity duties with NIS2 and product duties under the Cyber Resilience Act.

    Read: Compare the actors and reporting triggers in Articles 21 and 34; check the scope of NIS2 and the CRA separately (2023/2841 (Art. 21), 2018/1725 (Art. 34), NIS2, CRA).

    Practise: Decide who must receive an incident report

  5. Awareness, skills and advisory

    Learn: Measure behaviour, advise on authentication and distinguish signatures, seals and other trust services.

    Read: Read NIST’s guidance on learning outcomes and compare eIDAS Articles 25 and 35 (NIST SP 800-50r1, eIDAS (Art. 25 and 35)).

    Practise: Measure whether awareness training changes behaviour

Under Article 21 of Regulation (EU, Euratom) 2023/2841, a Union entity sends CERT-EU an early warning of a significant incident within 24 hours and an incident notification within 72 hours, without undue delay, from becoming aware of it. Under Article 34 of Regulation (EU) 2018/1725, the controller also notifies the EDPS of a personal data breach without undue delay and where feasible within 72 hours of awareness, unless risk to individuals’ rights and freedoms is unlikely. One report does not replace the other. Know what the Interinstitutional Cybersecurity Board oversees and what CERT-EU coordinates.

For trust services, compare eIDAS Articles 25 and 35. A qualified electronic signature has the legal effect of a handwritten signature. A qualified electronic seal carries a presumption of data integrity and correct origin. Use the distinction when advising on a document that needs a person’s signature versus evidence that an organisation issued it.

Worked practice questions

Check whether a patching metric hides risk

Median patch time fell from 20 to 10 days. Several internet-facing critical assets still have overdue fixes. Which evidence best tests whether exposure actually fell?

  1. AThe overall median from a longer reporting period.
  2. BThe number of patch tickets closed this month.
  3. CThe number and age of outstanding critical issues on exposed assets, with coverage checked against the inventory.
  4. DThe number of systems in the patch management tool.
Reveal answer and explanation
C

Severity, exposure, age and coverage connect the metric to risk. A better overall median (A) can mask persistent risk in a small group of assets.

Limit access to a sensitive service

Staff reach a case system over a VPN from managed and unmanaged devices. Which design most directly reduces reliance on network location?

  1. AAuthorise access to the specific resource based on identity, device posture and policy; limit granted permissions.
  2. BRequire the VPN but allow all connected users the same application access.
  3. CUse longer session lifetimes on the internal network.
  4. DMove the service to a new subnet while keeping its access rules.
Reveal answer and explanation
A

Evaluate access to the resource itself. A VPN (B) protects the connection but does not establish that a user and device should have access to a particular resource.

Preserve evidence while containing an incident

The response lead approves isolating a suspected host. Relevant logs will soon rotate. What should the team do?

  1. AReimage the host immediately and document only the alert time.
  2. BDelay containment until the team has reconstructed the full timeline.
  3. CExport a screenshot of the most recent alert and discard the raw logs.
  4. DIsolate as approved and preserve relevant logs with timestamps, integrity checks and a record of custody.
Reveal answer and explanation
D

Containment limits harm; preserving the records makes findings reproducible. Reimaging first (A) can destroy evidence needed for investigation.

Decide who must receive an incident report

An EU agency confirms a significant cyber incident involving leaked staff records. A risk to affected staff’s rights and freedoms is likely. Which approach is appropriate?

  1. AReport to CERT-EU only, since the loss followed a cyber incident.
  2. BReport to CERT-EU and notify the EDPS under the separate rules and deadlines.
  3. CNotify only the EDPS, since the leaked data identify staff.
  4. DWait for a final forensic report before notifying anyone.
Reveal answer and explanation
B

Both triggers are met. Reporting to CERT-EU (A) addresses the significant incident; it does not discharge the controller’s separate duty to notify the EDPS.

Measure whether awareness training changes behaviour

After training, course completion reaches 98%. Which measure best tests whether staff respond more effectively to suspicious messages?

  1. ANumber of slides viewed per employee.
  2. BAverage satisfaction score after training.
  3. CCorrect reporting rate and time to report in comparable exercises before and after training.
  4. DTotal number of training invitations sent.
Reveal answer and explanation
C

Compare observable actions under similar conditions. Completion and satisfaction (B) tell you who took part or liked the course; they do not measure whether staff report incidents better.

How to use your mock results

Take a field mock in 40 minutes (80 seconds per question on average). Review wrong answers and correct guesses. Record the rule or assumption you missed, drill your weakest duty group, then repeat the mock. Read EU law in your test language to learn its terminology.

Eligibility, tests and scoring · EPSOHQ study centre