I85PREP
⌘ K
IBITGQ C-DORA study materials
IBITGQ C-DORA study resources

IBITGQ C-DORA practice questions

One question at a time. Build your IBITGQ C-DORA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1DORA compliance and ICT resilience

Under DORA, which entities fall directly within the scope of the regulation's ICT risk management obligations?

  1. Only entities supervised directly by the European Central Bank
  2. All companies established in the EU that use digital technology
  3. Financial entities listed in Article 2, including insurers, investment firms and certain crypto-asset service providers Correct answer.
  4. Only credit institutions and payment institutions

Explanation

DORA applies to a defined list of financial entities in Article 2, which includes credit institutions, payment institutions, investment firms, insurers and crypto-asset service providers among others. Scope is determined by the type of financial entity, not by technology use alone or by which supervisor oversees it.

Question 2DORA compliance and ICT resilience

What is the primary objective of the DORA ICT risk management framework?

  1. To standardise accounting treatment of software assets
  2. To ensure financial entities can withstand, respond to and recover from ICT-related disruptions Correct answer.
  3. To replace national cybersecurity laws entirely
  4. To maximise the profitability of digital channels

Explanation

The ICT risk management framework requires governance, identification, protection, detection, response and recovery capabilities so that entities remain resilient to ICT disruptions. It is a resilience objective, not a commercial or accounting one.

Question 3DORA compliance and ICT resilience

Under DORA, who within a financial entity bears ultimate responsibility for managing ICT risk?

  1. The internal helpdesk team
  2. The external ICT auditor
  3. The outsourcing provider
  4. The management body Correct answer.

Explanation

DORA places accountability for ICT risk on the management body, which must define and approve the ICT risk strategy and tolerate responsibility for oversight. Operational tasks may be delegated, but accountability remains with the management body.

Question 4DORA compliance and ICT resilience

A financial entity is documenting its ICT asset inventory. Under DORA, what should the inventory of ICT-supported business functions and assets primarily enable?

  1. Calculation of staff bonus pools
  2. Identification of dependencies and mapping of ICT risk exposure Correct answer.
  3. Marketing analysis of customer digital behaviour
  4. Replacement of the entity's financial reporting system

Explanation

DORA requires entities to identify and document business functions, assets and dependencies so that ICT risk exposure and criticality can be understood. The inventory supports risk identification and mapping, not unrelated commercial purposes.

Question 5DORA compliance and ICT resilience

Which of the following best describes an ICT-related incident under DORA?

  1. A single event or series of linked events that disrupts or is likely to disrupt ICT services Correct answer.
  2. Any planned software upgrade performed during a maintenance window
  3. A routine backup that completes successfully
  4. A change in the entity's marketing strategy

Explanation

An ICT-related incident is a single event or a series of linked events that compromises the security of network and information systems and disrupts or is likely to disrupt services. Successful routine operations and planned upgrades are not incidents by themselves.

Question 6DORA compliance and ICT resilience

DORA introduces a framework for the oversight of critical ICT third-party service providers. Which authority leads this oversight?

  1. The national competition authorities
  2. The European Supervisory Authorities acting through designated lead overseers Correct answer.
  3. The European Data Protection Board
  4. The European Court of Auditors

Explanation

DORA establishes an oversight framework for critical ICT third-party service providers, led by the European Supervisory Authorities through designated lead overseers. Data protection, audit and competition bodies do not perform this ICT oversight role.

Question 7DORA compliance and ICT resilience

Under DORA, which of the following is a required element of the contractual arrangements with ICT third-party service providers?

  1. A clause transferring all regulatory liability to the provider
  2. An agreement to waive the entity's exit strategy
  3. A guarantee that no incident will ever occur
  4. Clear service level descriptions and provisions on audit and access rights Correct answer.

Explanation

DORA requires written contracts to specify service levels, audit and access rights, data location, and exit provisions among other elements. Regulatory liability cannot be transferred away and no provider can guarantee the absence of incidents.

Question 8DORA compliance and ICT resilience

What does DORA require regarding the testing of digital operational resilience?

  1. Testing only after an incident has occurred
  2. Annual testing limited to the finance department
  3. Testing exclusively by the ICT third-party provider
  4. A sound and comprehensive digital operational resilience testing programme proportionate to the entity's risk profile Correct answer.

Explanation

DORA requires a documented, risk-based testing programme covering the entity's critical systems and proportionate to its size and risk profile. Testing is proactive and is not limited to post-incident reviews or third parties.

Question 9DORA compliance and ICT resilience

Under DORA, which entities must perform threat-led penetration testing (TLPT) at least every three years?

  1. Only ICT third-party service providers
  2. All financial entities regardless of size
  3. Only entities with fewer than ten employees
  4. Financial entities identified as significant under the criteria set out in the regulation Correct answer.

Explanation

TLPT is mandatory for significant financial entities identified according to DORA criteria, and is performed at least every three years. It is not imposed on every entity regardless of size, nor on providers or micro-entities as a default.

Question 10DORA compliance and ICT resilience

DORA requires financial entities to maintain a register of information. What does this register primarily record?

  1. All contractual arrangements with ICT third-party service providers Correct answer.
  2. The salaries of ICT staff
  3. All customer complaints received during the year
  4. Every software licence purchased since incorporation

Explanation

The register of information records all contractual arrangements with ICT third-party service providers, supporting supervisory oversight and the identification of dependencies. It is not a complaints log, payroll record or licence archive.

Question 11DORA compliance and ICT resilience

A financial entity outsources a critical function to an ICT provider. Under DORA, which statement about the entity's responsibility is accurate?

  1. Responsibility ceases if the provider is certified
  2. Responsibility is shared equally with the supervisory authority
  3. Responsibility transfers entirely to the provider once the contract is signed
  4. The entity may delegate the function but retains full responsibility for compliance Correct answer.

Explanation

DORA allows outsourcing of functions but the financial entity remains fully responsible for compliance with its obligations. Contractual delegation does not shift regulatory accountability to the provider, supervisor or any certification body.

Question 12DORA compliance and ICT resilience

Which of the following is an example of an ICT-related incident that would likely require classification and reporting under DORA?

  1. A scheduled server reboot announced one week in advance
  2. A ransomware attack that encrypts core banking systems and disrupts customer payments Correct answer.
  3. A planned change to the entity's logo
  4. A staff training session on phishing awareness

Explanation

A ransomware attack that disrupts core banking systems is a clear ICT-related incident with adverse impact on services, triggering classification and reporting. Planned reboots, training and branding changes are not incidents.

Question 13DORA compliance and ICT resilience

Under DORA's incident reporting requirements, what must a financial entity do after classifying a major ICT-related incident?

  1. Publish it in its annual marketing brochure
  2. Notify the relevant competent authority according to the prescribed timelines and templates Correct answer.
  3. Report it only to its customers
  4. Wait until the next supervisory review cycle

Explanation

Major ICT-related incidents must be reported to the competent authority using the timelines, templates and content defined in the regulatory technical standards. Reporting is not limited to customers or deferred to a review cycle.

Question 14DORA compliance and ICT resilience

A financial entity wants to adopt a new cloud service for a critical function. Which DORA-aligned step should occur before signing the contract?

  1. Delegate the decision entirely to the provider's sales team
  2. Rely solely on the provider's self-certification
  3. Conduct a risk assessment and due diligence of the provider including concentration and exit considerations Correct answer.
  4. Skip due diligence because cloud services are inherently resilient

Explanation

Before entering into a critical arrangement, DORA requires appropriate due diligence and risk assessment covering the provider's suitability, concentration risk and exit strategy. Self-certification alone or provider-led decisions do not satisfy this obligation.

Question 15DORA compliance and ICT resilience

Which of the following best describes the role of an exit strategy in DORA's ICT third-party risk requirements?

  1. An optional marketing plan for ending customer relationships
  2. A clause allowing the provider to terminate without notice
  3. A documented plan enabling the entity to transition or terminate services without undue disruption Correct answer.
  4. A guarantee that the provider will never fail

Explanation

DORA requires exit strategies that allow the entity to terminate arrangements and migrate to alternatives without undue disruption to business. It is a resilience safeguard, not a marketing plan, guarantee or provider right.

Question 16DORA compliance and ICT resilience

DORA's information-sharing arrangements on cyber threat information are intended to do which of the following?

  1. Allow financial entities to exchange cyber threat intelligence within trusted communities while protecting confidentiality Correct answer.
  2. Replace the entity's incident reporting obligations
  3. Require public disclosure of all vulnerabilities
  4. Prohibit any communication with other entities about threats

Explanation

DORA encourages exchange of cyber threat information among trusted communities, subject to confidentiality and data protection safeguards. It supplements, rather than replaces, incident reporting and does not mandate public disclosure.

Question 17DORA compliance and ICT resilience

Which statement about DORA's relationship with the NIS2 Directive is most accurate?

  1. NIS2 fully replaces DORA for financial entities
  2. DORA and NIS2 are mutually exclusive and cannot apply to the same entity
  3. DORA applies only to non-financial critical infrastructure
  4. DORA is lex specialis for financial entities, while NIS2 continues to apply to entities outside DORA's scope Correct answer.

Explanation

DORA is designed as the sector-specific (lex specialis) regime for financial entities, while NIS2 covers other sectors and entities outside DORA's scope. They are not mutually exclusive in a way that removes DORA's role for financial entities.

Question 18DORA compliance and ICT resilience

A financial entity's business continuity policy under DORA must address which of the following?

  1. Only the entity's tax reporting deadlines
  2. Only the physical security of headquarters
  3. Only the recovery of marketing materials
  4. ICT business impact analysis and recovery objectives for critical functions Correct answer.

Explanation

DORA requires business impact analysis and defined recovery objectives, such as recovery time and recovery point objectives, for critical functions. Continuity planning is not confined to marketing, physical premises or tax deadlines.

Question 19DORA compliance and ICT resilience

Under DORA, what is the purpose of the ICT risk management framework's detection mechanisms?

  1. To increase the number of marketing emails sent
  2. To identify anomalous activities and ICT incidents in a timely manner Correct answer.
  3. To eliminate the need for incident response
  4. To replace the role of the management body

Explanation

Detection mechanisms are designed to identify anomalous activities and incidents promptly so that response and recovery can be triggered. They support, rather than replace, incident response and management oversight.

Question 20DORA compliance and ICT resilience

A significant financial entity is planning its TLPT scope. Which approach aligns with DORA?

  1. Restrict testing to a paper-based questionnaire
  2. Test only non-critical systems to avoid disruption
  3. Include critical or important functions and use threat intelligence to design realistic attack scenarios Correct answer.
  4. Outsource all responsibility for the test results to the provider

Explanation

TLPT under DORA covers critical or important functions and uses threat intelligence to simulate realistic adversary behaviour. It is a live, intelligence-led exercise, not a questionnaire, and responsibility for acting on results remains with the entity.

Question 21DORA compliance and ICT resilience

Which of the following describes a concentration risk that DORA expects financial entities to assess when using ICT third-party providers?

  1. The risk that staff take annual leave at the same time
  2. The risk that too many critical services depend on a single provider or a small number of providers Correct answer.
  3. The risk that a provider changes its brand name
  4. The risk that a provider charges different prices in different regions

Explanation

Concentration risk arises when critical services rely on a single provider or a small number of providers, increasing the impact of a failure or exit. Pricing differences, staff leave and rebranding are not concentration risks in this sense.

Question 22DORA compliance and ICT resilience

A financial entity discovers that a provider subcontracts part of a critical ICT service to another company. What does DORA require the entity to consider?

  1. Whether the subcontracting is covered by the contractual chain and whether it affects risk, oversight and exit options Correct answer.
  2. Only whether the subcontractor offers a discount
  3. Nothing, because subcontracting is invisible to the entity
  4. Whether the subcontractor is located in the same city

Explanation

DORA requires entities to understand and manage the full chain of subcontracting for critical services, including its effect on risk, oversight and exit. Subcontracting cannot be treated as invisible, and discounts or location alone are not the criterion.

Question 23DORA compliance and ICT resilience

How does DORA treat the use of ICT third-party providers in relation to the entity's overall ICT risk management?

  1. Third-party risk is an integral part of the entity's ICT risk management framework Correct answer.
  2. Third-party risk is relevant only after a contract ends
  3. Third-party risk only matters for providers based outside the EU
  4. Third-party risk is a separate silo unrelated to ICT risk management

Explanation

DORA integrates third-party risk into the broader ICT risk management framework, requiring ongoing monitoring and governance of provider arrangements. It is not a separate silo, limited to non-EU providers, or relevant only after termination.

Question 24DORA compliance and ICT resilience

Which of the following best explains why DORA requires a post-incident review after a major ICT-related incident?

  1. To identify root causes and improve the ICT risk management framework and controls Correct answer.
  2. To avoid reporting the incident to the authority
  3. To reduce the number of staff training hours
  4. To assign blame to individual employees publicly

Explanation

Post-incident reviews are required to identify root causes, evaluate the effectiveness of controls and feed lessons into the ICT risk management framework. They are improvement mechanisms, not public blame exercises or a way to avoid reporting.

Question 25DORA compliance and ICT resilience

A financial entity uses an ICT provider whose services support a critical function, and the provider is designated as critical under DORA's oversight framework. What is a likely consequence for the entity?

  1. The provider becomes subject to oversight by a designated lead overseer, and the entity must still manage its own risk and contractual duties Correct answer.
  2. The entity must transfer its regulatory accountability to the lead overseer
  3. The entity may ignore the provider's recommendations entirely
  4. The entity is exempt from all ICT risk obligations

Explanation

Designation of a provider as critical brings it under the DORA oversight framework led by a designated lead overseer, while the financial entity retains its own risk management and contractual obligations. Exemption and transfer of accountability do not follow from designation.

Question 26DORA compliance and ICT resilience

Under DORA, who within a financial entity holds ultimate responsibility for managing ICT risk?

  1. The external auditor engaged for the annual review
  2. The internal audit function, which owns the ICT risk appetite
  3. The ICT third-party providers under contract
  4. The management body, which defines and approves the ICT risk strategy Correct answer.

Explanation

DORA places ICT risk management accountability on the management body, which must define, approve, oversee and periodically review the entity's ICT risk strategy and tolerance levels. Operational staff and providers execute controls, but accountability cannot be delegated to them.

Question 27DORA compliance and ICT resilience

Which statement best describes the proportionality principle in DORA's ICT risk management requirements?

  1. All financial entities must apply identical controls regardless of size
  2. Requirements scale with the entity's size, risk profile, and the nature and complexity of its services Correct answer.
  3. Only entities above 250 staff must comply with the framework
  4. Proportionality applies solely to the reporting timelines for incidents

Explanation

DORA requires financial entities to apply ICT risk management proportionate to their size, business and risk profile, and the nature, scale and complexity of their services. This does not exempt smaller entities from the core obligations.

Question 28DORA compliance and ICT resilience

What is the primary purpose of the simplified ICT risk management framework available to certain financial entities?

  1. To allow entities to outsource all ICT risk management to their providers
  2. To reduce the required governance and testing obligations to a lighter but still complete set of requirements Correct answer.
  3. To exempt small entities from maintaining any ICT risk documentation
  4. To replace national supervisory examinations with self-certification

Explanation

The simplified framework lets eligible entities (such as certain small and non-interconnected investment firms, payment institutions and insurers) meet a lighter but still complete set of ICT risk management requirements. It reduces burden without removing the core obligation to manage ICT risk.

Question 29DORA compliance and ICT resilience

Which element is central to the digital operational resilience strategy that a financial entity must adopt under DORA?

  1. A description of how the entity maintains and improves its operational resilience using ICT Correct answer.
  2. A schedule of fees charged by ICT third-party providers
  3. A marketing plan for digital products offered to retail clients
  4. A list of competitors' ICT outsourcing arrangements

Explanation

The digital operational resilience strategy explains how the entity maintains and improves its operational resilience using ICT, including its risk tolerance and the measures it takes to address identified risks. It is a governance document, not a commercial or pricing plan.

Question 30DORA compliance and ICT resilience

DORA requires financial entities to have a business continuity policy that includes which of the following?

  1. A guarantee that no incident will ever affect clients
  2. An annual bonus scheme for ICT staff
  3. ICT business continuity plans and measures to restore operations after disruption Correct answer.
  4. A commitment to never use cloud services for critical functions

Explanation

The business continuity policy must include ICT business continuity plans that set out how the entity responds to and recovers from disruptions, including restoring critical functions within defined objectives. It is about preparedness and recovery, not absolute prevention.

Question 31DORA compliance and ICT resilience

A financial entity outsources a critical function to an ICT provider. Under DORA, which statement about the entity's responsibility is correct?

  1. The entity remains fully responsible for compliance with DORA obligations Correct answer.
  2. Responsibility shifts to the provider only if the contract says so
  3. The entity may delegate full regulatory responsibility for the function to the provider
  4. Responsibility is shared equally with the provider under DORA

Explanation

DORA makes clear that outsourcing does not transfer regulatory responsibility: the financial entity remains responsible for complying with its obligations even when a provider performs the function. Contracts must therefore support effective oversight.

Question 32DORA compliance and ICT resilience

Which of the following best explains the purpose of DORA's incident reporting framework?

  1. To enable supervisors to understand the scale of ICT incidents and coordinate responses across the financial sector Correct answer.
  2. To set the fees that providers may charge for incident response
  3. To replace the entity's internal incident log
  4. To provide clients with marketing information about the entity's security

Explanation

Incident reporting gives supervisors timely information on significant ICT incidents so they can assess impact and coordinate responses where needed. It complements, rather than replaces, the entity's own internal incident management.

Question 33DORA compliance and ICT resilience

A financial entity is reviewing its contractual arrangements with an ICT provider supporting a critical function. Which clause is most directly required by DORA's contract provisions?

  1. Service level descriptions, including performance targets and quantitative and qualitative metrics Correct answer.
  2. The provider's unrelated business lines
  3. The personal social media accounts of provider staff
  4. The provider's internal marketing budget

Explanation

DORA requires contractual arrangements to describe the services, including service levels with quantitative and qualitative performance targets, so the entity can monitor delivery and enforce obligations. Other required clauses cover audit rights, termination and data protection.

Question 34DORA compliance and ICT resilience

Which authority leads the oversight framework for critical ICT third-party service providers under DORA?

  1. The financial entity's internal audit committee
  2. The provider's own national data protection authority
  3. The European Court of Auditors
  4. A designated lead overseer appointed from among the European Supervisory Authorities for each critical provider Correct answer.

Explanation

DORA creates an oversight framework in which a lead overseer, drawn from the European Supervisory Authorities, is designated for each critical ICT third-party service provider. The lead overseer coordinates oversight and can make recommendations.

Question 35DORA compliance and ICT resilience

A financial entity uses an ICT provider whose services support a critical function, and the provider is designated as critical under DORA. What is a likely consequence for the entity?

  1. The entity may receive recommendations from the lead overseer addressed to the provider and must consider them in its own risk management Correct answer.
  2. The entity becomes subject to the provider's national law exclusively
  3. The entity is released from its own ICT risk management obligations
  4. The entity must terminate the arrangement immediately

Explanation

When a provider is designated critical, the lead overseer can issue recommendations to the provider, and financial entities using it must take account of those recommendations in their own third-party risk management. The entity's own obligations remain intact.

Question 36DORA compliance and ICT resilience

A financial entity's ICT risk register shows a critical application with no tested recovery procedure. How should this be treated under DORA?

  1. As irrelevant if the application has never failed
  2. As a gap requiring remediation within the ICT risk management framework, including testing and a documented recovery plan Correct answer.
  3. As acceptable because the application is supported by a third party
  4. As a matter only for the provider to resolve without entity involvement

Explanation

DORA requires entities to identify, manage and remediate ICT risks, including ensuring that critical functions have tested recovery capability. An untested recovery procedure for a critical application is a gap that must be addressed and documented.

Question 37DORA compliance and ICT resilience

A financial entity plans to rely on a provider's certification to satisfy its due diligence for a critical function. Which DORA-aligned view is most accurate?

  1. Due diligence is only needed after a major incident occurs
  2. A valid certification fully discharges the entity's due diligence obligation
  3. Certifications are irrelevant and must be ignored entirely
  4. Certifications can inform the assessment but do not replace the entity's own risk-based due diligence and ongoing monitoring Correct answer.

Explanation

Third-party certifications can provide useful evidence, but DORA requires the entity to perform its own risk-based due diligence and to monitor the provider on an ongoing basis. The entity cannot outsource its judgement to a certificate.

Question 38DORA compliance and ICT resilience

Under DORA, which document must a financial entity's management body approve and review at least annually, covering arrangements for using ICT services supporting critical or important functions?

  1. The digital operational resilience strategy Correct answer.
  2. The ICT third-party expenditure budget
  3. The internal audit charter for ICT
  4. The ICT business continuity policy

Explanation

DORA requires the management body to define, approve, oversee and periodically review the digital operational resilience strategy, including the policy on ICT service use supporting critical or important functions. This strategy is reviewed at least annually, and after material incidents or supervisory direction, so it remains aligned with the entity's risk appetite.

Question 39DORA compliance and ICT resilience

A financial entity's ICT incident management process must include which capability before it can classify an event as a major ICT-related incident for reporting purposes?

  1. A quarterly penetration test of all internet-facing systems
  2. A register of every employee who accessed production systems
  3. A contractual clause requiring providers to fund regulatory fines
  4. A procedure for logging, tracking and categorising incidents against defined criteria Correct answer.

Explanation

DORA requires an incident management process that records, categorises and prioritises ICT-related incidents according to defined criteria such as clients affected, duration and data losses. Classification against those criteria is what determines whether an incident is major and triggers reporting obligations.

Question 40DORA compliance and ICT resilience

Which mechanism does DORA establish to promote consistent supervisory practices across Member States on ICT risk and incident reporting?

  1. A voluntary industry code adopted by large banks only
  2. A European Central Bank licensing regime for all ICT providers
  3. Binding technical standards and guidelines developed through the European Supervisory Authorities Correct answer.
  4. A single European ICT supervisor replacing national authorities

Explanation

DORA tasks the European Supervisory Authorities with drafting regulatory and implementing technical standards and guidelines, which competent authorities apply to harmonise supervision. National competent authorities remain in place, so the regime coordinates rather than replaces them.

Question 41DORA compliance and ICT resilience

An entity's ICT risk management framework must enable it to identify and document which of the following as a foundation for managing ICT risk?

  1. The functions, assets and dependencies supporting its business processes Correct answer.
  2. The market share of each ICT provider in the European Union
  3. The salary bands of ICT security staff
  4. The energy consumption of its data centres

Explanation

DORA requires entities to identify and document business functions, the ICT assets and systems supporting them, and the dependencies between them. This mapping underpins risk assessment, impact analysis and continuity planning across the framework.

Question 42DORA compliance and ICT resilience

A financial entity relies on an ICT provider for a critical function. Under DORA, which arrangement best satisfies the requirement on exit strategies?

  1. Maintaining documented exit strategies that are tested and updated periodically Correct answer.
  2. Deferring exit planning until the contract enters its final year
  3. Delegating exit decisions entirely to the outsourcing steering committee
  4. Relying on the provider's own published exit plan for all its customers

Explanation

DORA requires entities to maintain and periodically test exit strategies for ICT services supporting critical or important functions, so they can migrate or terminate without disruption. The strategy must be documented, proportionate to the dependency and reviewed as the arrangement evolves.

Question 43DORA compliance and ICT resilience

During a major ICT-related incident, a financial entity must notify which parties under DORA's reporting framework?

  1. The competent authority, and where relevant clients and the public Correct answer.
  2. The European Central Bank directly in all cases
  3. Only its external auditor and its shareholders
  4. Only the ICT provider that caused the incident

Explanation

DORA requires notification of major ICT-related incidents to the competent authority, with additional communication to clients where the incident affects their interests and to the public where appropriate. Reporting flows through the competent authority rather than directly to every European body.

Question 44DORA compliance and ICT resilience

An entity's ICT risk management framework requires a security awareness programme. Which design most closely matches DORA's expectations?

  1. A one-off induction briefing at the point of hire
  2. Role-based training for all staff and management, including the management body, refreshed regularly Correct answer.
  3. Awareness content limited to phishing simulations for front-office staff
  4. Annual mandatory training only for the ICT department

Explanation

DORA expects digital operational resilience awareness and training to cover all staff and management, including members of the management body, and to be tailored to roles and kept current. Training is a continuous control rather than a single event.

Question 45DORA compliance and ICT resilience

An entity is assessing the ICT risk of a new cloud service supporting a critical function. Which action best reflects DORA's requirement for risk assessment before and during use?

  1. Assess the provider's financial statements only and proceed if profitable
  2. Delegate the risk assessment to the provider's account manager
  3. Rely on the provider's marketing material describing its certifications
  4. Perform due diligence and a documented risk assessment covering security, continuity and concentration before onboarding Correct answer.

Explanation

DORA requires a documented risk assessment and due diligence before entering into ICT arrangements, particularly for critical or important functions, covering security, availability, integrity and concentration. The assessment is reviewed throughout the lifecycle of the arrangement.

Question 46DORA compliance and ICT resilience

A financial entity's ICT systems must be subject to independent review. Under DORA, which function typically performs this assurance?

  1. The ICT operations team that administers the systems
  2. The external ICT provider under the contract
  3. The management body acting as first line of defence
  4. The internal audit function, following a risk-based approach Correct answer.

Explanation

DORA assigns the internal audit function responsibility for reviewing the ICT risk management framework and controls on a risk-based, independent basis. Independence distinguishes audit from the operational teams that design and run the controls.

Question 47DORA compliance and ICT resilience

A financial entity wants to test the resilience of a critical payment system. Which approach is consistent with DORA's testing requirements?

  1. Test only after a real incident has occurred
  2. Rely solely on vendor-supplied test reports
  3. Run a risk-based testing programme that includes vulnerability assessments, scenario-based tests and, where required, TLPT Correct answer.
  4. Restrict testing to annual firewall configuration reviews

Explanation

DORA requires a sound, risk-based testing programme covering critical ICT systems, combining vulnerability assessments, scenario-based and penetration testing, and threat-led penetration testing where required. Testing is proportionate to risk and informs the entity's resilience posture.

Question 48DORA compliance and ICT resilience

An entity maintains redundant ICT systems for a critical function. Which DORA requirement most directly governs how the redundancy is validated?

  1. The redundant systems must be located in the same data centre
  2. The entity must test the redundancy and recovery arrangements at planned intervals Correct answer.
  3. The systems must be certified by the provider's auditor
  4. The redundancy must be disclosed in the annual financial statements

Explanation

DORA requires entities to test business continuity and recovery plans, including redundancy and failover arrangements, at planned intervals and after significant changes. Testing demonstrates that recovery objectives can actually be met.

Question 49DORA compliance and ICT resilience

An entity's board is reviewing its ICT risk appetite. Which statement best reflects DORA's governance expectations for the management body?

  1. The management body must personally approve every ICT change request
  2. The management body may delegate all ICT risk decisions permanently to the CIO
  3. The management body should focus only on financial risk and leave ICT to technical staff
  4. The management body sets and monitors the risk appetite and ensures adequate resources for resilience Correct answer.

Explanation

DORA makes the management body accountable for defining the risk appetite, approving the resilience strategy and ensuring sufficient resources and oversight. It may delegate execution but retains ultimate responsibility for ICT risk.

Question 50DORA compliance and ICT resilience

An entity identifies that several critical functions depend on the same underlying ICT provider infrastructure. What does DORA require the entity to do with this finding?

  1. Assess the concentration risk and consider mitigating measures such as diversification or exit planning Correct answer.
  2. Report it only to shareholders in the annual report
  3. Immediately terminate all contracts with the provider
  4. Ignore it because the provider holds a valid certification

Explanation

DORA requires entities to assess concentration risk arising from dependence on a small number of ICT providers and to consider mitigants, including diversification, contractual safeguards and exit strategies. The assessment is part of the entity's ongoing ICT third-party risk management.