Quizzes & Surveys Archive • Projekt.dk

Quiz published APR 12, 2026

24 questions with four options - select the correct one.

Quiz published APR 8, 2026

Which product category is explicitly included in the scope of the CRA?

Standalone cloud-based software that has no local device interaction.

Any motor vehicle governed by the Type Approval Regulation (EU) 2018/858.

Any hardware or software product that allows for a logical data connection.

Medical devices that are already regulated under Regulation (EU) 2017/745.

None

What defines a "substantial modification"?

Releasing a standard security patch to fix a known critical software bug.

Updating the visual branding of the physical product or user interface.

Moving the product hosting from one cloud provider to another similar one.

A change that affects compliance with the essential security requirements.

None

How long is the mandatory support period for updates?

A fixed period of exactly five years from the date of market placement.

The duration of the standard two-year consumer legal guarantee period.

The expected product lifetime, taking into account user expectations.

For the entire duration that the manufacturer remains a legal entity.

None

What is the deadline for an "early warning" of an exploited vulnerability?

Within 72 hours of the manufacturer identifying the risk of an exploit.

Within 24 hours of becoming aware of an actively exploited vulnerability.

Without undue delay and in any event within 48 hours of detection.

Within 12 hours of the first recorded attempt at a network breach.

None

1 out of 6

Where must the Software Bill of Materials (SBOM) be maintained?

On a public website for general consumer access and security auditing.

Inside a secure database that is managed and audited directly by ENISA.

As part of the technical documentation for market surveillance purposes.

In a printed document that is included in the physical product packaging.

None

When must a manufacturer submit a vulnerability notification with general information?

Within 72 hours of becoming aware of the actively exploited vulnerability.

No later than 48 hours after the vulnerability has been patched for users.

Simultaneously with the early warning to provide authorities with context.

Within seven days of the incident, provided the risk has been mitigated.

None

Who manages the Single Reporting Platform for vulnerability notifications?

The national data protection authority of the manufacturer's home state.

The European Data Protection Board in collaboration with local police.

The European Commission’s Directorate-General for Communications and Technology.

ENISA, the European Union Agency for Cybersecurity, manages the platform.

None

What is an importer's primary verification duty?

Ensuring the manufacturer has affixed the CE mark to the product.

Redesigning default security policies to meet specific local preferences.

Conducting independent penetration testing on all incoming product code.

Notify the market surveillance authorities, what products are being imported.

None

2 out of 6

How long must the EU declaration of conformity be retained?

For the duration of the active support period provided to the users.

Until the specific product model is no longer sold in the Union.

For ten years after the product has been placed on the market.

For twenty-five years from the date the initial design was finalized.

None

10.

Which assessment applies to "unclassified" (default) products?

A third-party audit performed by a designated EU Notified Body.

The manufacturer’s self-assessment through an internal control process.

A full quality assurance audit by an external specialized audit firm.

A mandatory source code review conducted by the European Commission.

None

11.

Which product is classified as "Important" Class I?

Identity management systems and browsers for general consumer use.

Smart lighting systems designed for private domestic user environments.

Basic fitness trackers that only monitor steps and heart rate data.

Industrial firewalls designed to protect the core of a power plant.

None

12.

Which product is classified as "Important" Class II?

A basic smart home thermostat that controls a single heating zone.

Standalone calculator software that does not connect to the internet.

Operating systems that are used exclusively on consumer mobile devices.

Firewalls and intrusion detection/prevention systems.

None

3 out of 6

Loading questions...

4 out of 6

Loading questions...

5 out of 6

Loading questions...

6 out of 6

25.

When do manufacturers become obligated to report actively exploited vulnerabilities and severe incidents?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

26.

When can Member States begin designating notified bodies and conformity assessment bodies under the CRA?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

27.

When do the CRA’s essential cybersecurity requirements (Annex I) start applying to products placed on the market?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

1 out of 11

28.

When must a manufacturer perform a cybersecurity risk assessment under the CRA?

Only for internet‑connected products

For every product with digital elements placed on the market

Only when a vulnerability is found

Only for important or critical products

None

29.

What is a “product with digital elements” under the CRA?

Only hardware with firmware

Any software that connects to the internet

Only commercial software

A software or hardware product and its remote data processing solutions

None

30.

What is “remote data processing” (RDPS)?

Any cloud service used by the manufacturer

Data processing at a distance designed and developed by the manufacturer

Any third‑party SaaS

Any analytics performed for marketing

None

2 out of 11

31.

Which of the following is NOT RDPS?

Cloud‑based onboarding service developed by the manufacturer

Telemetry analysis never fed back into the product

Remote update distribution service

Cloud‑based authentication developed by the manufacturer

None

32.

Which obligation applies even to products placed on the market before 11 December 2027?

Full essential requirements

Support period declaration

Conformity assessment

Reporting actively exploited vulnerabilities and severe incidents

None

33.

What is a “substantial modification”?

A change in packaging

A change affecting compliance with essential cybersecurity requirements

Any software update

A change in distribution channel

None

3 out of 11

Loading questions...

4 out of 11

Loading questions...

5 out of 11

Loading questions...

6 out of 11

Loading questions...

7 out of 11

Loading questions...

8 out of 11

Loading questions...

9 out of 11

Loading questions...

10 out of 11

Loading questions...

11 out of 11

Now press SUBMIT for the results.

Quiz published APR 12, 2026

24 questions with four options - select the correct one.

Quiz published APR 8, 2026

58.

Which product category is explicitly included in the scope of the CRA?

Standalone cloud-based software that has no local device interaction.

Any motor vehicle governed by the Type Approval Regulation (EU) 2018/858.

Any hardware or software product that allows for a logical data connection.

Medical devices that are already regulated under Regulation (EU) 2017/745.

None

59.

What defines a "substantial modification"?

Releasing a standard security patch to fix a known critical software bug.

Updating the visual branding of the physical product or user interface.

Moving the product hosting from one cloud provider to another similar one.

A change that affects compliance with the essential security requirements.

None

60.

How long is the mandatory support period for updates?

A fixed period of exactly five years from the date of market placement.

The duration of the standard two-year consumer legal guarantee period.

The expected product lifetime, taking into account user expectations.

For the entire duration that the manufacturer remains a legal entity.

None

61.

What is the deadline for an "early warning" of an exploited vulnerability?

Within 72 hours of the manufacturer identifying the risk of an exploit.

Within 24 hours of becoming aware of an actively exploited vulnerability.

Without undue delay and in any event within 48 hours of detection.

Within 12 hours of the first recorded attempt at a network breach.

None

1 out of 6

62.

Where must the Software Bill of Materials (SBOM) be maintained?

On a public website for general consumer access and security auditing.

Inside a secure database that is managed and audited directly by ENISA.

As part of the technical documentation for market surveillance purposes.

In a printed document that is included in the physical product packaging.

None

63.

When must a manufacturer submit a vulnerability notification with general information?

Within 72 hours of becoming aware of the actively exploited vulnerability.

No later than 48 hours after the vulnerability has been patched for users.

Simultaneously with the early warning to provide authorities with context.

Within seven days of the incident, provided the risk has been mitigated.

None

64.

Who manages the Single Reporting Platform for vulnerability notifications?

The national data protection authority of the manufacturer's home state.

The European Data Protection Board in collaboration with local police.

The European Commission’s Directorate-General for Communications and Technology.

ENISA, the European Union Agency for Cybersecurity, manages the platform.

None

65.

What is an importer's primary verification duty?

Ensuring the manufacturer has affixed the CE mark to the product.

Redesigning default security policies to meet specific local preferences.

Conducting independent penetration testing on all incoming product code.

Notify the market surveillance authorities, what products are being imported.

None

2 out of 6

66.

How long must the EU declaration of conformity be retained?

For the duration of the active support period provided to the users.

Until the specific product model is no longer sold in the Union.

For ten years after the product has been placed on the market.

For twenty-five years from the date the initial design was finalized.

None

67.

Which assessment applies to "unclassified" (default) products?

A third-party audit performed by a designated EU Notified Body.

The manufacturer’s self-assessment through an internal control process.

A full quality assurance audit by an external specialized audit firm.

A mandatory source code review conducted by the European Commission.

None

68.

Which product is classified as "Important" Class I?

Identity management systems and browsers for general consumer use.

Smart lighting systems designed for private domestic user environments.

Basic fitness trackers that only monitor steps and heart rate data.

Industrial firewalls designed to protect the core of a power plant.

None

69.

Which product is classified as "Important" Class II?

A basic smart home thermostat that controls a single heating zone.

Standalone calculator software that does not connect to the internet.

Operating systems that are used exclusively on consumer mobile devices.

Firewalls and intrusion detection/prevention systems.

None

3 out of 6

Loading questions...

4 out of 6

Loading questions...

5 out of 6

Loading questions...

6 out of 6

82.

When do manufacturers become obligated to report actively exploited vulnerabilities and severe incidents?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

83.

When can Member States begin designating notified bodies and conformity assessment bodies under the CRA?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

84.

When do the CRA’s essential cybersecurity requirements (Annex I) start applying to products placed on the market?

10 December 2024

11 June 2026

11 September 2026

11 December 2027

None

1 out of 11

85.

When must a manufacturer perform a cybersecurity risk assessment under the CRA?

Only for internet‑connected products

For every product with digital elements placed on the market

Only when a vulnerability is found

Only for important or critical products

None

86.

What is a “product with digital elements” under the CRA?

Only hardware with firmware

Any software that connects to the internet

Only commercial software

A software or hardware product and its remote data processing solutions

None

87.

What is “remote data processing” (RDPS)?

Any cloud service used by the manufacturer

Data processing at a distance designed and developed by the manufacturer

Any third‑party SaaS

Any analytics performed for marketing

None

2 out of 11

88.

Which of the following is NOT RDPS?

Cloud‑based onboarding service developed by the manufacturer

Telemetry analysis never fed back into the product

Remote update distribution service

Cloud‑based authentication developed by the manufacturer

None

89.

Which obligation applies even to products placed on the market before 11 December 2027?

Full essential requirements

Support period declaration

Conformity assessment

Reporting actively exploited vulnerabilities and severe incidents

None

90.

What is a “substantial modification”?

A change in packaging

A change affecting compliance with essential cybersecurity requirements

Any software update

A change in distribution channel

None

3 out of 11

Loading questions...

4 out of 11

Loading questions...

5 out of 11

Loading questions...

6 out of 11

Loading questions...

7 out of 11

Loading questions...

8 out of 11

Loading questions...

9 out of 11

Loading questions...

10 out of 11

Loading questions...

11 out of 11

Now press SUBMIT for the results.

Start Quiz Next

Previous Previous

Start Quiz Start Quiz Next Next

Time's up

Archives: Quizzes & Surveys

CRA quiz compliance 2

Quiz published APR 12, 2026

General CRA Quiz 1

Quiz published APR 12, 2026

Quiz published APR 12, 2026