DORA Lead Manager

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 1: Fundamental principles and concepts

   At a board meeting of a mid-sized Dutch bank, a director asks the compliance officer to state the highest administrative fine that DORA itself sets for a financial entity that breaches the Regulation's ICT risk management requirements, so that the figure can be quoted in the bank's risk register. What should the compliance officer reply?

   1. Up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.
   2. At least EUR 1 million, the floor DORA sets for the penalties adopted by Member States.
   3. Up to 1% of the average daily worldwide turnover of the preceding year, for each day of breach.
   4. None in DORA itself: the amounts are left to the rules adopted by each Member State.

2. Domain 2: Planning and implementation

   Case study 1 - Valdoria Banco Cooperativo (5 questions) Valdoria Banco Cooperativo is a medium-sized cooperative credit institution headquartered in Porto, Portugal, with 640 staff and a management body of 9 members. The management body approved the bank's DORA readiness programme on 12 February 2025. The project manager then ran a gap analysis of 41 DORA requirements, based on interviews with 22 staff and a review of 64 documents: 9 requirements were rated not met, 17 partially met and 15 met. The project sponsor asked that the gap report rank each gap by regulatory exposure and give a target closure date. The bank relies on 3 ICT third-party service providers for critical or important functions, including a company in Madrid, Spain, that hosts the core-banking platform. During the diagnosis, the chief risk officer (CRO) proposed that the risk management function should both own and operate the access controls of the core-banking platform; the head of internal audit objected. Training records show that only 2 of the 9 members of the management body attended any ICT risk training in the previous 24 months. The staff representatives' committee did not answer two requests for comments on the project and avoided taking any position on it. Question 3 of 5: Which position should the project manager take on the CRO's proposal for the access controls of the core-banking platform?

   1. Reject it in part: risk management may own the access controls but should leave their daily operation to IT.
   2. Reject it and leave the access controls with the platform's business and IT owners.
   3. Accept it: the second line manages risks and controls, so it can operate them.
   4. Reject it: the access controls should be operated by internal audit, which gives independent assurance to the board.

3. Domain 3: ICT risk and incident management

   A Latvian credit institution runs its loan-origination system on a third-party database product whose extended support ends in six months; the vendor offers custom support for two further years at extra cost. For this asset, the ICT asset register records the unique identifier, location, classification, owner, supported functions, RTO and RPO, exposure to external networks and links to other assets. What should the asset manager add for this asset?

   1. Its RTO, RPO and other continuity requirements, as recorded for each asset supporting a function.
   2. An unsupported date set at the end of extended support, as custom support does not count under the policy.
   3. Its exposure to external networks, including the internet, as the asset management policy requires.
   4. The end dates of the vendor's regular, extended and custom support, as the asset policy requires.

4. Domain 4: Resilience testing and third-party risk

   A Latvian investment firm with 7 employees and an annual turnover of EUR 1.6 million asks its consultant whether it must establish the full digital operational resilience testing programme that DORA describes, with tests by independent parties and yearly tests of systems supporting critical functions. What should the consultant advise?

   1. Prepare to run a threat-led penetration test every three years.
   2. Apply a risk-based approach combined with strategic planning of its ICT testing.
   3. Set up a full testing programme, testing critical systems at least once a year.
   4. Run the full programme at a proportionate scale, as DORA exempts microenterprises only from TLPT.

5. Domain 5: Review and improvement

   A Belgian bank designs a programme to develop the skills that its new security operations centre analysts need to triage alerts, investigate incidents and escalate them correctly. In the bank's training and awareness strategy, how should this programme be classified?

   1. As training.
   2. As awareness.
   3. As a competence evaluation.
   4. As cross-training.

6. Domain 1: Fundamental principles and concepts

   A multilateral trading facility in Malta, authorised as a trading venue, employs 6 people and has an annual turnover and balance sheet total of EUR 1.5 million each. Its compliance officer plans to use the lighter treatment that DORA gives microenterprises, such as reviewing the ICT risk management framework periodically rather than at least once a year. How should this plan be assessed?

   1. Agree, if the authority grants the microenterprise regime, which it may do for venues under the size thresholds.
   2. Agree: with 6 staff and EUR 1.5 million, the venue may review its framework periodically.
   3. Reject it: its type of entity is excluded from the microenterprise category, whatever its size.
   4. Reject it: an entity with more than 5 employees counts as a small enterprise under DORA.

7. Domain 2: Planning and implementation

   Case study 1 - Valdoria Banco Cooperativo (5 questions) Valdoria Banco Cooperativo is a medium-sized cooperative credit institution headquartered in Porto, Portugal, with 640 staff and a management body of 9 members. The management body approved the bank's DORA readiness programme on 12 February 2025. The project manager then ran a gap analysis of 41 DORA requirements, based on interviews with 22 staff and a review of 64 documents: 9 requirements were rated not met, 17 partially met and 15 met. The project sponsor asked that the gap report rank each gap by regulatory exposure and give a target closure date. The bank relies on 3 ICT third-party service providers for critical or important functions, including a company in Madrid, Spain, that hosts the core-banking platform. During the diagnosis, the chief risk officer (CRO) proposed that the risk management function should both own and operate the access controls of the core-banking platform; the head of internal audit objected. Training records show that only 2 of the 9 members of the management body attended any ICT risk training in the previous 24 months. The staff representatives' committee did not answer two requests for comments on the project and avoided taking any position on it. Question 4 of 5: How should the gap report rate the requirement on the management body's ICT knowledge and skills, given the training records?

   1. Partially met: the duty rests on the body collectively, and it has two trained members and a yearly CIO briefing.
   2. Not met: DORA sets a yearly session per member, and seven of nine missed it.
   3. Not met: seven of the nine members have had no ICT risk training for two years.
   4. Not met: at least half of the members must have ICT expertise, and only two of the nine have any training.

8. Domain 3: ICT risk and incident management

   After ransomware encrypted the claims database of a German insurer, the infrastructure team proposes to wipe the affected server and restore last night's backup onto it, arguing that this is the fastest way to resume claims processing. The insurer restores backups using its own systems. What should the ICT risk manager require?

   1. Rebuild the source server from a clean, patched image, verify the backup and then restore onto it.
   2. Restore onto separate systems kept apart from the compromised server.
   3. Activate a secondary processing site, as central securities depositories maintain.
   4. Restore through the backup provider's own recovery environment instead.

9. Domain 4: Resilience testing and third-party risk

   During its exit from a hosting contract, a Belgian insurer learns that the provider will charge a fee equal to six months of service to return the insurer's servers and hand its data back in a usable format; the contract is silent on the point. The insurer is now reviewing the exit procedures for its other critical arrangements. Which provision addresses this problem?

   1. Realistic exit cost estimates in each exit plan, as exit plans must be realistic and feasible.
   2. Procedures ensuring that its digital and physical assets are returned promptly and affordably, in a usable format.
   3. Clauses on the long-term ownership, safeguarding and accessibility of records such as audit trails.
   4. A transition period during which the provider keeps running the service while the insurer migrates.

10. Domain 5: Review and improvement

    An ICT internal audit at a Finnish insurer raised a critical finding on privileged access six months ago. No owner or deadline has been assigned, and the head of ICT plans to let the next yearly audit check whether the issue has been fixed. What should the head of internal audit require?

    1. Agree with the head of ICT: the next yearly audit will check whether the issue is fixed.
    2. Require the fix within the 90 days DORA allows for critical findings.
    3. A report to the management body, which approves the ICT audit plans.
    4. Assign an owner and a deadline, then verify the fix once it is made.

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.