Secure and resilient

Self-check

Your score stays on your own device.

1. A colleague says: 'We have had backups for years, so we are covered.' What is true?

   • Not yet: only a test restore shows it
   • Not true: you need a second server instead
   • True: years without errors prove it works
   • True, if the copy sits on the same server

2. The order system is used all day; the internal wiki hardly at all. How do you set their recovery?

   • The same for both, so nobody has to choose between them
   • Separately: orders tolerate far less loss and downtime
   • Wiki first, because it is the smallest
   • Not yet: only once something fails

3. You order a penetration test. What do you agree in writing before it starts?

   • Which findings may stay out of the report
   • Nothing: an attacker does not announce himself
   • What may be tested, when, and how far they go
   • Only the price; the rest follows during the test

4. Your machine supplier's technician needs remote access to one machine. What do you arrange?

   • An admin account, so he cannot get stuck anywhere
   • Nothing; he has to come on site
   • Access to that machine only, with two-step login
   • The VPN password the office uses

5. Someone says: 'NIS2 means replacing all our IT.' What is true?

   • Usually not: a few things tend to be missing
   • True: the law asks for new systems
   • Not true: NIS2 only asks the board to sign a statement
   • True, but only the servers

6. A significant incident on a Friday evening, with half the management away. What gets the first report out on time?

   • Reporting only once the cause is known
   • A procedure you have practised once
   • Asking the supplier to report it for you
   • Waiting until Monday for the full picture

7. An auditor asks who has access to the customer file. What is the strongest answer?

   • A statement that nothing has changed
   • A screenshot someone makes that week
   • Last year's list from the handbook
   • A current list straight from the system

8. You are setting SPF right. What do you list first?

   • Only the mail server in the office
   • The spam folder of your largest customer
   • The mailboxes of every colleague
   • Everything that sends mail in your name