I85PREP
⌘ K
DORA Lead Manager study materials
DORA Lead Manager study resources

DORA Lead Manager practice questions

One question at a time. Build your DORA Lead Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts of ICT risk management and digital operational resilience

Under DORA, which entity is primarily responsible for ensuring that a financial entity's ICT third-party risk management framework covers the full lifecycle of contractual arrangements with ICT providers?

  1. The European Supervisory Authorities jointly
  2. The ICT third-party service provider's board
  3. The financial entity's management body Correct answer.
  4. The relevant national competent authority

Explanation

DORA places ultimate responsibility for ICT risk management, including third-party arrangements, on the management body of the financial entity. The management body must define, approve and oversee the framework, and it remains accountable even when activities are outsourced. Supervisors and providers do not assume this internal governance duty.

Question 2Fundamental concepts of ICT risk management and digital operational resilience

In DORA terminology, what does 'digital operational resilience' primarily refer to?

  1. The practice of encrypting data at rest and in transit across the enterprise
  2. The ability to build, assure and review the integrity and reliability of the ICT infrastructure
  3. The capacity of an ICT provider to offer cloud services across multiple regions
  4. The ability of a financial entity to withstand, respond to and recover from ICT-related disruptions Correct answer.

Explanation

Digital operational resilience is defined around the ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring the full range of ICT-related capabilities. It centres on withstanding, responding to and recovering from disruptions. Encryption and multi-region hosting are means, not the definition itself.

Question 3Fundamental concepts of ICT risk management and digital operational resilience

Which set of elements forms the ICT risk management framework that DORA requires financial entities to have in place?

  1. An audit charter, a tax report and a payroll register
  2. ICT strategy, policies, procedures, protocols and tools Correct answer.
  3. A marketing plan, a budget forecast and a vendor list
  4. A customer complaint log, a pricing sheet and a sales plan

Explanation

DORA requires a sound, comprehensive and well-documented ICT risk management framework built on an ICT strategy and comprising policies, procedures, protocols and tools. These elements together must secure the ICT systems supporting business processes. Non-ICT documents such as marketing or payroll records are outside this definition.

Question 4Fundamental concepts of ICT risk management and digital operational resilience

A financial entity wants to classify ICT incidents for regulatory reporting. Which criterion does DORA use as a core basis for identifying major ICT-related incidents?

  1. The number of employees who reported the incident internally
  2. The currency in which the entity reports its annual accounts
  3. The vendor's contractual service credits for downtime
  4. The number of clients or counterparties affected and the duration of the incident Correct answer.

Explanation

DORA's classification of major ICT-related incidents relies on criteria such as the number of clients or financial counterparts affected, the duration and service downtime, and data losses. These quantitative and qualitative criteria feed the incident classification process. Internal reporting counts and contract credits are not classification criteria.

Question 5Fundamental concepts of ICT risk management and digital operational resilience

Which type of third-party arrangement does DORA explicitly bring within the scope of its ICT third-party risk requirements?

  1. Arrangements with external legal counsel
  2. Arrangements with advertising agencies
  3. Arrangements with ICT intra-group providers Correct answer.
  4. Arrangements with office cleaning contractors

Explanation

DORA applies its ICT third-party risk requirements to all ICT providers, including intra-group ICT service providers. Legal counsel, cleaning and advertising providers are not ICT service providers under this regime. Intra-group arrangements therefore cannot be excluded simply because they are internal to the group.

Question 6Fundamental concepts of ICT risk management and digital operational resilience

What is the primary purpose of the register of information that DORA requires financial entities to maintain?

  1. To record the salaries of ICT staff employed by the entity
  2. To keep a record of all contractual arrangements with ICT third-party service providers Correct answer.
  3. To list every hardware asset owned by the entity
  4. To document the entity's annual marketing campaigns

Explanation

DORA requires financial entities to maintain and update a register of information on all contractual arrangements with ICT third-party service providers. The register supports supervisory oversight and aggregation of third-party dependencies. It is not a payroll, asset inventory or marketing record.

Question 7Fundamental concepts of ICT risk management and digital operational resilience

Under DORA, which authority is responsible for the oversight framework for critical ICT third-party service providers designated by the European Supervisory Authorities?

  1. The national data protection authority
  2. The European Central Bank alone
  3. The provider's own internal audit function
  4. A lead overseer appointed from among the European Supervisory Authorities Correct answer.

Explanation

DORA establishes an oversight framework in which the ESAs designate critical ICT third-party service providers and appoint a lead overseer from among the ESAs. The lead overseer coordinates oversight and can issue recommendations. National data protection authorities and internal audit functions do not perform this role.

Question 8Fundamental concepts of ICT risk management and digital operational resilience

DORA requires financial entities to have a business continuity policy that addresses ICT business continuity. Which element must such a policy include?

  1. A schedule of staff holiday entitlements
  2. A list of competitors' ICT providers
  3. A forecast of interest rate movements
  4. Plans to restore ICT systems and data from backups after disruption Correct answer.

Explanation

The ICT business continuity policy under DORA must include plans for restoring ICT systems and data from backups and for resuming operations after disruption. It must also set recovery objectives and crisis communication arrangements. Holiday schedules, competitor data and rate forecasts are unrelated to continuity planning.

Question 9Fundamental concepts of ICT risk management and digital operational resilience

A bank discovers that a cloud provider has subcontracted part of a critical ICT service to an unlisted fourth party. How should the bank apply DORA's ICT third-party risk requirements to this situation?

  1. Transfer all responsibility for the subcontract to the cloud provider and take no further action
  2. Assess the subcontracting chain as part of its due diligence and ongoing monitoring of the arrangement Correct answer.
  3. Terminate the contract automatically because subcontracting is prohibited by DORA
  4. Ignore the subcontract because the bank has no direct contract with the fourth party

Explanation

DORA requires financial entities to understand and monitor subcontracting chains that support critical or important functions. The entity must assess whether subcontracting introduces additional risk and whether contractual safeguards apply along the chain. Subcontracting is not prohibited, and responsibility cannot simply be shifted away.

Question 10Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is negotiating an ICT contract for a service supporting a critical function. Which contractual provision does DORA require to be included?

  1. A clause allowing the provider to withhold incident information from the entity
  2. A clause waiving the entity's audit rights to reduce friction
  3. A clause giving the provider unilateral rights to change service levels
  4. A clause specifying the provider's obligation to assist the entity in the event of an ICT incident Correct answer.

Explanation

DORA requires contractual arrangements to include provisions obliging the ICT provider to assist the financial entity during ICT incidents and to cooperate with the entity's response. Other mandatory provisions include audit and access rights, service levels and termination rights. Clauses that remove audit rights or conceal incident information undermine these requirements.

Question 11Fundamental concepts of ICT risk management and digital operational resilience

During an ICT disruption, a financial entity must communicate with external stakeholders. Which DORA concept governs how the entity handles this communication?

  1. Crisis communication plans that are part of its business continuity policy Correct answer.
  2. A vendor's public relations schedule
  3. A marketing strategy approved by the sales department
  4. A tax reporting calendar maintained by finance

Explanation

DORA requires crisis communication plans as part of the ICT business continuity policy, setting out how the entity communicates with clients, counterparties and the public during disruptions. These plans ensure timely and accurate external communication. Marketing, tax and vendor PR schedules do not fulfil this role.

Question 12Fundamental concepts of ICT risk management and digital operational resilience

An entity wants to test its digital operational resilience. Which approach reflects DORA's requirements for resilience testing?

  1. Rely solely on the ICT provider's internal testing reports
  2. Limit testing to penetration tests on the marketing website
  3. Test only once at the start of each contract
  4. Perform a risk-based testing programme including vulnerability assessments and scenario-based tests Correct answer.

Explanation

DORA requires a sound and comprehensive digital operational resilience testing programme that is risk-based and covers a range of assessments, including vulnerability assessments, scenario-based tests and, for significant entities, threat-led penetration testing. Relying only on provider reports or a single test does not satisfy this.

Question 13Fundamental concepts of ICT risk management and digital operational resilience

Which entities are subject to DORA's advanced threat-led penetration testing requirement?

  1. Only ICT third-party service providers
  2. Only entities that have experienced a prior incident
  3. All financial entities regardless of size and risk profile
  4. Only financial entities identified as significant based on criteria set out in DORA Correct answer.

Explanation

DORA reserves threat-led penetration testing for financial entities identified as significant using criteria such as size, systemic importance and risk profile. The test must be conducted at least every three years by independent parties. It is not a universal obligation for every entity.

Question 14Fundamental concepts of ICT risk management and digital operational resilience

A financial entity outsources a critical function to an ICT provider located outside the EU. What does DORA require regarding the competent authority's access to information?

  1. The provider must relocate all data to the EU before signing
  2. The entity must obtain the provider's permission before contacting the authority
  3. The entity must ensure the contract provides for access and inspection rights, including for the competent authority Correct answer.
  4. The entity may refuse to disclose any information about the provider

Explanation

DORA requires contractual arrangements to grant the financial entity and its competent authority access, inspection and audit rights over the provider, including where the provider is located outside the EU. This supports supervisory oversight of cross-border outsourcing. Data localisation before signing and provider permission are not DORA requirements.

Question 15Fundamental concepts of ICT risk management and digital operational resilience

How does DORA treat the relationship between ICT risk management and the entity's overall risk management framework?

  1. ICT risk is delegated entirely to the ICT provider
  2. ICT risk is managed separately and never integrated with overall risk
  3. ICT risk is considered only during annual audits
  4. ICT risk management is integrated into the entity's overall risk management framework Correct answer.

Explanation

DORA requires ICT risk management to be embedded in the entity's overall risk management framework and governance structure. This integration ensures ICT risk is considered alongside other risks such as credit and market risk. Treating ICT risk as isolated or fully delegated conflicts with this requirement.

Question 16Fundamental concepts of ICT risk management and digital operational resilience

What does DORA require regarding the detection of anomalous activities and ICT incidents?

  1. Entities must disable all logging to protect privacy
  2. Entities may rely solely on customer complaints to detect incidents
  3. Entities should monitor only network traffic from external sources
  4. Entities must have mechanisms to promptly detect anomalous activities and incidents Correct answer.

Explanation

DORA requires financial entities to have mechanisms in place to promptly detect anomalous activities, including network performance issues and ICT incidents, and to identify potential material single points of failure. Detection should cover multiple sources and be proactive. Relying only on complaints or disabling logging undermines detection.

Question 17Fundamental concepts of ICT risk management and digital operational resilience

An entity is assessing whether an ICT incident is 'major'. Which factor aligns with DORA's criteria for major incidents?

  1. The number of staff who attended the incident review meeting
  2. The personal preference of the chief executive
  3. The extent of data losses and the impact on critical or important functions Correct answer.
  4. The length of the provider's marketing campaign

Explanation

DORA's major incident criteria include the impact on critical or important functions, the extent of data losses, the number of affected clients and the duration of disruption. These factors guide classification and reporting to competent authorities. Meeting attendance, executive preference and marketing schedules are not criteria.

Question 18Fundamental concepts of ICT risk management and digital operational resilience

What is the role of the management body in DORA's ICT risk management framework?

  1. To personally conduct penetration tests
  2. To approve the ICT risk framework and ensure adequate resources and oversight Correct answer.
  3. To manage the daily operations of the ICT help desk
  4. To negotiate all ICT contracts without delegation

Explanation

DORA assigns the management body responsibility for approving and overseeing the ICT risk management framework, ensuring adequate resources and promoting a culture of resilience. The body must also regularly review the framework. Operational testing and daily help desk work are delegated functions, not the management body's role.

Question 19Fundamental concepts of ICT risk management and digital operational resilience

Which statement best describes DORA's approach to ICT third-party risk in relation to the principle of proportionality?

  1. The requirements should be applied in a manner proportionate to the entity's size, risk profile and complexity Correct answer.
  2. Smaller entities are exempt from third-party risk requirements
  3. Proportionality allows entities to ignore critical provider risks
  4. All entities must apply identical controls regardless of size or complexity

Explanation

DORA's requirements, including those on ICT third-party risk, are applied proportionately according to the size, risk profile and complexity of the financial entity. Proportionality does not exempt entities from managing critical provider risks. A uniform approach ignoring context would not reflect the principle.

Question 20Fundamental concepts of ICT risk management and digital operational resilience

A financial entity uses an ICT provider for a service supporting a critical function. Under DORA, what must the entity do before entering into the arrangement?

  1. Rely on the provider's self-certification without verification
  2. Sign the contract and assess risks only after the first incident
  3. Conduct due diligence on the provider and assess the risks of the arrangement Correct answer.
  4. Delegate the risk assessment to the provider's sales team

Explanation

Before entering into a contractual arrangement for ICT services supporting critical or important functions, DORA requires the entity to conduct due diligence and assess the risks, including the provider's ability to meet service levels. Self-certification alone, post-incident assessment and delegation to a sales team do not satisfy this.

Question 21Fundamental concepts of ICT risk management and digital operational resilience

Which of the following best describes the 'ICT risk' concept as used in DORA?

  1. The risk that a borrower will default on a loan
  2. The risk that interest rates will rise unexpectedly
  3. The risk that a product will fail to meet customer expectations
  4. The risk of loss related to the use of ICT, including disruption, security breaches and system failures Correct answer.

Explanation

In DORA, ICT risk covers any circumstance related to the use of ICT that could compromise the security of networks and information systems, including disruption, breaches and system failures. It is distinct from credit, market and product risks. This definition underpins the entire framework.

Question 22Fundamental concepts of ICT risk management and digital operational resilience

A financial entity must report major ICT-related incidents to the competent authority. Which sequence reflects DORA's incident reporting approach?

  1. Initial notification, followed by an intermediate report and a final report Correct answer.
  2. Reporting only to the provider, not the authority
  3. Notification only if the provider agrees to it
  4. A single final report only after full resolution

Explanation

DORA establishes a phased incident reporting process, typically beginning with an initial notification followed by an intermediate report and a final report. This staged approach allows supervisors to receive timely information and updates. Single reports, provider consent and reporting only to providers do not match the framework.

Question 23Fundamental concepts of ICT risk management and digital operational resilience

A significant financial entity conducts threat-led penetration testing. Which requirement does DORA impose on this testing?

  1. It must be limited to open-source intelligence gathering
  2. It must be performed by the entity's own ICT staff annually
  3. It must be performed by independent parties and repeated at least every three years Correct answer.
  4. It must be conducted only when a regulator requests it

Explanation

DORA requires threat-led penetration testing for significant entities to be carried out by independent parties, whether internal or external, with sufficient expertise, and repeated at least every three years. The scope must cover critical or important functions. Self-testing by ordinary ICT staff, intelligence-only exercises or purely reactive testing do not meet the standard.

Question 24Fundamental concepts of ICT risk management and digital operational resilience

How does DORA address the risk arising from concentration of ICT third-party service providers?

  1. Concentration risk is irrelevant if the provider is large
  2. Entities must assess and manage concentration risk, including dependence on a small number of providers Correct answer.
  3. Entities must avoid all cloud providers
  4. Entities are prohibited from using more than one provider

Explanation

DORA requires financial entities to assess and manage concentration risk, including the risk of relying on a small number of critical ICT providers or on providers that are difficult to replace. The oversight framework for critical providers also addresses systemic concentration. Prohibitions on multiple providers or on cloud use are not part of DORA.

Question 25Fundamental concepts of ICT risk management and digital operational resilience

Which statement correctly captures the relationship between DORA's ICT risk management requirements and the entity's contractual arrangements with ICT providers?

  1. Contractual arrangements must support and reflect the entity's ICT risk management obligations, including audit, exit and incident assistance Correct answer.
  2. Contracts are purely commercial and independent of regulatory obligations
  3. Contractual terms override the entity's regulatory duties
  4. Contractual arrangements remove the need for internal controls

Explanation

DORA requires contractual arrangements to reinforce the entity's ICT risk management, including provisions on audit and access rights, exit strategies and incident assistance. Contracts operate alongside, not instead of, the entity's regulatory duties. They cannot override regulatory obligations or replace internal controls.

Question 26Fundamental concepts of ICT risk management and digital operational resilience

DORA's ICT risk management framework requires financial entities to establish a governance and control framework. Which element is explicitly part of the internal governance requirements for ICT risk?

  1. A mandatory insurance policy covering all cyber losses
  2. A documented ICT risk management framework reviewed at least annually by the management body Correct answer.
  3. A separate legal entity dedicated solely to managing ICT contracts
  4. An external auditor permanently embedded in the ICT department

Explanation

DORA requires financial entities to have a sound and documented ICT risk management framework, reviewed and updated at least once a year by the management body, which remains accountable for ICT risk. The framework must define roles, responsibilities, and reporting lines.

Question 27Fundamental concepts of ICT risk management and digital operational resilience

Under DORA, the ICT risk management framework must enable a financial entity to do which of the following?

  1. Delegate ICT risk ownership entirely to external providers
  2. Eliminate all residual ICT risk before launching new services
  3. Replace the entity's internal control framework with supervisory instructions
  4. Identify, classify, and address ICT risks, including through risk tolerance levels Correct answer.

Explanation

The framework must allow the entity to identify, classify, and address ICT risk in line with its risk appetite, including setting risk tolerance levels. ICT risk remains the entity's responsibility even when services are outsourced.

Question 28Fundamental concepts of ICT risk management and digital operational resilience

Which statement best describes the scope of DORA's ICT risk management obligations across financial sectors?

  1. They apply to a broad list of financial entities, including investment firms, insurers, and crypto-asset service providers Correct answer.
  2. They apply only to entities using cloud services
  3. They apply only to entities with more than 500 employees
  4. They apply only to credit institutions and payment institutions

Explanation

DORA applies horizontally to a broad range of financial entities, including credit institutions, payment institutions, investment firms, insurance undertakings, and crypto-asset service providers. Proportionality affects how obligations are applied, not whether the entity is in scope.

Question 29Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is designing its ICT risk management process. Which activity corresponds to the 'protection and prevention' pillar of DORA's ICT risk management?

  1. Detecting anomalous activity through continuous monitoring
  2. Implementing ICT security policies, access controls, and encryption Correct answer.
  3. Classifying incidents for regulatory reporting
  4. Restoring data from backups after an outage

Explanation

Protection and prevention covers the policies, tools, and controls that reduce the likelihood and impact of ICT incidents, such as access control, encryption, and hardening. Detection, incident classification, and recovery sit under other pillars of the framework.

Question 30Fundamental concepts of ICT risk management and digital operational resilience

A financial entity's ICT risk management framework must address the identification of ICT assets and dependencies. Which practice best satisfies this expectation?

  1. Limiting the inventory to hardware located on the entity's own premises
  2. Maintaining an inventory of ICT assets and mapping their dependencies on third-party services Correct answer.
  3. Documenting assets only at the moment a contract is signed
  4. Relying on the ICT provider's asset list as the authoritative record

Explanation

DORA expects entities to identify and document ICT assets and their interdependencies, including reliance on third parties, so that risk can be assessed and managed. The inventory must be maintained and kept current rather than created once.

Question 31Fundamental concepts of ICT risk management and digital operational resilience

DORA requires financial entities to have a strategy for ICT business continuity. Which element must that strategy cover?

  1. Exclusively the continuity arrangements of ICT providers
  2. The entity's exposure to ICT disruptions and the measures needed to maintain critical functions Correct answer.
  3. Only the recovery of data centres owned by the entity
  4. A guarantee that services will never be interrupted

Explanation

The ICT business continuity strategy must assess the entity's exposure to ICT disruptions and set out how critical or important functions will be maintained or recovered. It must be consistent with the overall business continuity policy and tested periodically.

Question 32Fundamental concepts of ICT risk management and digital operational resilience

An entity is setting recovery objectives for its ICT systems. Which DORA-aligned approach should it take?

  1. Leave recovery objectives to be agreed only after an incident occurs
  2. Apply a single recovery time objective to all systems regardless of criticality
  3. Set recovery objectives only for systems operated by third parties
  4. Define recovery time and recovery point objectives based on the criticality of the supported function Correct answer.

Explanation

DORA requires recovery objectives to reflect the criticality of the business functions supported by each ICT system. A differentiated approach ensures the most important services are restored first and within acceptable limits.

Question 33Fundamental concepts of ICT risk management and digital operational resilience

Which control best reflects DORA's expectations for managing privileged access within an ICT environment?

  1. Allowing providers to create permanent superuser accounts for convenience
  2. Sharing a single administrative credential among the operations team
  3. Restricting and monitoring privileged access, with logging of administrative activity Correct answer.
  4. Granting broad administrative rights to all ICT staff to speed up incident response

Explanation

DORA expects strong access management, with privileged access limited to those who need it and administrative activity logged and monitored. This reduces the risk of misuse and supports detection and investigation.

Question 34Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is updating its ICT risk management framework. How should the framework treat the risk of ICT disruptions to critical or important functions?

  1. It should be assessed and managed separately from the entity's overall operational risk
  2. It should be integrated into the entity's overall risk management and operational resilience arrangements Correct answer.
  3. It should be reviewed only when a major incident occurs
  4. It should be delegated to the ICT provider's risk function

Explanation

DORA requires ICT risk management to be embedded in the entity's overall risk management framework and aligned with its operational resilience objectives. ICT risk is not a stand-alone silo but part of how the entity manages the continuity of critical functions.

Question 35Fundamental concepts of ICT risk management and digital operational resilience

DORA requires financial entities to manage ICT risk arising from their use of third-party providers. Which obligation remains with the entity when a critical function is outsourced?

  1. The entity must obtain supervisory approval before every service renewal
  2. The entity may transfer full regulatory responsibility to the provider under the contract
  3. The entity is exempt from monitoring the service once the contract is signed
  4. The entity retains responsibility for managing the ICT risk and for compliance with DORA Correct answer.

Explanation

Outsourcing an ICT service does not transfer regulatory responsibility: the entity remains accountable for managing the risk and complying with DORA. Contracts and ongoing monitoring are the tools used to keep that responsibility under control.

Question 36Fundamental concepts of ICT risk management and digital operational resilience

Which statement correctly describes how DORA treats the proportionality principle in ICT risk management?

  1. Proportionality applies only to reporting obligations, not to risk management
  2. Proportionality allows smaller entities to opt out of ICT risk management entirely
  3. All financial entities must apply identical controls regardless of size and complexity
  4. Entities may apply requirements in a manner proportionate to their size, risk profile, and the nature of their activities Correct answer.

Explanation

DORA applies proportionality so that the way requirements are implemented reflects the entity's size, risk profile, and the nature and complexity of its activities. It does not exempt entities from the core obligations.

Question 37Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is reviewing its ICT risk management framework after a significant change in its technology estate. Which action best reflects DORA's requirement for keeping the framework effective?

  1. Replace the framework with the ICT provider's security policy
  2. Wait for the next scheduled annual review before documenting any change
  3. Update the framework and re-assess ICT risk whenever significant changes occur, in addition to annual review Correct answer.
  4. Suspend the framework until the supervisory authority issues new guidance

Explanation

DORA requires the ICT risk management framework to be reviewed at least annually and updated in response to significant changes or incidents. Continuous reassessment keeps the framework aligned with the entity's actual risk exposure.

Question 38Fundamental concepts of ICT risk management and digital operational resilience

An entity is mapping its ICT risk management against DORA's pillars. Which grouping correctly pairs a pillar with its core objective?

  1. Response and recovery - identifying and classifying incidents
  2. Protection and prevention - reducing the likelihood and impact of ICT incidents Correct answer.
  3. Detection - restoring services after disruption
  4. Learning and evolving - encrypting data at rest

Explanation

Protection and prevention focuses on controls that reduce the likelihood and impact of ICT incidents, such as security policies, access control, and encryption. Detection, response and recovery, and learning and evolving each have distinct objectives within the framework.

Question 39Fundamental concepts of ICT risk management and digital operational resilience

A financial entity is deciding how to treat residual ICT risk after applying controls. Which approach is most consistent with DORA's ICT risk management requirements?

  1. Accept residual risk only where it is within the entity's defined risk tolerance and documented Correct answer.
  2. Ignore residual risk for systems supporting non-critical functions
  3. Assume residual risk is eliminated once a control is implemented
  4. Transfer all residual risk to the ICT provider through the contract

Explanation

DORA requires entities to identify and manage ICT risk against defined risk tolerance levels. Residual risk should be explicitly accepted, documented, and monitored rather than assumed away or shifted entirely to a provider.

Question 40Fundamental concepts of ICT risk management and digital operational resilience

Which statement best captures how DORA links ICT risk management to the resilience of critical or important functions?

  1. ICT risk management underpins the ability to withstand, respond to, and recover from disruptions affecting critical functions Correct answer.
  2. Resilience is achieved solely by purchasing additional ICT capacity
  3. Critical functions are protected only by contractual penalties on providers
  4. ICT risk management is a compliance exercise independent of business continuity planning

Explanation

DORA's ICT risk management framework is the foundation for digital operational resilience: it enables the entity to withstand, respond to, and recover from ICT disruptions affecting critical or important functions. Business continuity, testing, and third-party oversight all build on it.

Question 41Preparation for and planning of DORA project implementation

Under DORA, which role is ultimately responsible for managing and mitigating ICT risk across the entire financial entity, including its contractual arrangements with ICT third-party providers?

  1. The internal audit function
  2. The management body Correct answer.
  3. The ICT third-party service provider
  4. The outsourced data centre operator

Explanation

DORA places ultimate responsibility for ICT risk management on the management body, which must define and approve the risk strategy and bear accountability for all ICT-related arrangements, including third-party dependencies. Delegation to committees or providers does not transfer this accountability.

Question 42Preparation for and planning of DORA project implementation

When scoping a DORA implementation programme, which set of elements must the ICT risk management framework address?

  1. Identification, protection and prevention, detection, response and recovery, learning and evolving, plus communication Correct answer.
  2. Only the entity's internal network perimeter
  3. Solely the outsourcing register and exit plans
  4. Only incident reporting to the competent authority

Explanation

DORA structures the ICT risk management framework around five pillars: identification, protection and prevention, detection, response and recovery, and learning and evolving, supported by communication. A programme scoping exercise must cover all pillars, not just one control area.

Question 43Preparation for and planning of DORA project implementation

A lead manager is drafting the project charter for a DORA implementation. Which element most directly establishes the authority to commit budget and assign cross-functional resources?

  1. A RACI chart listing every employee in the ICT function
  2. A vendor comparison matrix for incident reporting tools
  3. A signed mandate from the management body with a named accountable executive and approved budget Correct answer.
  4. A glossary of ICT terms used across the entity

Explanation

A formal mandate from the management body, naming an accountable executive and approving the budget, creates the governance authority needed to commit funds and assign resources across functions. Supporting artefacts like RACI charts or glossaries help execution but do not confer that authority.

Question 44Preparation for and planning of DORA project implementation

Which document maintained under DORA provides the authoritative record of all contractual arrangements with ICT third-party providers, including those supporting critical or important functions?

  1. The incident log
  2. The data protection impact assessment
  3. The business continuity plan
  4. The register of information Correct answer.

Explanation

DORA requires entities to maintain a register of information on all contractual arrangements with ICT third-party providers, with specific detail on those supporting critical or important functions. It is the authoritative inventory used for supervision and reporting.

Question 45Preparation for and planning of DORA project implementation

In DORA's proportionality principle, which factors determine how sophisticated an entity's ICT risk management framework must be?

  1. Only the number of employees in the ICT department
  2. The size, business and risk profile, and the nature, scale and complexity of the entity's services Correct answer.
  3. The number of ICT providers headquartered in the same member state
  4. Only the entity's annual net revenue

Explanation

DORA applies proportionality based on the entity's size, business and risk profile, and the nature, scale and complexity of its services. This lets smaller or less complex entities apply simpler arrangements while still meeting the substantive requirements.

Question 46Preparation for and planning of DORA project implementation

Which governance body within a financial entity is expected to approve and periodically review the ICT business continuity policy under DORA?

  1. The management body Correct answer.
  2. The data protection officer
  3. The procurement committee
  4. The external auditor

Explanation

The management body approves and reviews the ICT business continuity policy as part of its overall accountability for the ICT risk management framework. Other functions may draft or advise, but approval rests with the management body.

Question 47Preparation for and planning of DORA project implementation

A DORA programme needs a documented description of how the entity would restore critical operations after a severe ICT disruption. Which planning artefact fulfils this need?

  1. The register of information
  2. The change management log
  3. The ICT business continuity plan Correct answer.
  4. The ICT risk appetite statement

Explanation

The ICT business continuity plan sets out how critical operations are maintained and restored after disruption, including recovery objectives and dependencies. It translates the continuity policy into operational arrangements.

Question 48Preparation for and planning of DORA project implementation

What is the primary purpose of establishing a DORA implementation roadmap with sequenced workstreams?

  1. To coordinate dependencies, milestones and owners so that regulatory obligations are met in a controlled order Correct answer.
  2. To eliminate the need for a register of information
  3. To replace the need for a formal governance mandate
  4. To satisfy the requirement to notify every ICT incident to the authority

Explanation

A roadmap sequences workstreams, makes dependencies visible and assigns owners and milestones so obligations are delivered in a controlled order. It complements governance and documentation requirements rather than replacing them.

Question 49Preparation for and planning of DORA project implementation

During DORA planning, a manager must decide how to treat a legacy core banking platform supported by a provider whose contract lacks the required audit and access rights. What is the most appropriate planning response?

  1. Delegate the decision to the provider's account manager
  2. Exclude the platform from the register of information because it predates DORA
  3. Terminate the platform immediately without a transition plan
  4. Renegotiate the contract to include required clauses and record a remediation milestone with an interim risk acceptance Correct answer.

Explanation

Legacy arrangements must be brought into line with DORA's contractual requirements; the practical planning route is to renegotiate the contract, log a remediation milestone and, where needed, document interim risk acceptance with mitigation. Existing contracts are not grandfathered out of scope.

Question 50Preparation for and planning of DORA project implementation

A lead manager is building the resource plan for DORA implementation. Which combination best reflects the cross-functional effort typically required?

  1. Only the internal audit team and external counsel
  2. Only the ICT operations team
  3. ICT, risk, compliance, legal, procurement, business lines and internal audit in defined roles Correct answer.
  4. Only the data protection officer and marketing

Explanation

DORA implementation spans ICT, risk, compliance, legal, procurement, business lines and internal audit, each with defined responsibilities across governance, contracts, continuity and reporting. Narrowing the effort to one function leaves obligations uncovered.