DORA Foundation

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 2: DORA requirements for an ICT risk framework

   What is the register of information that financial entities must maintain, and at which levels is it kept?

   1. A record of all contractual arrangements on the use of ICT services, kept at entity, sub-consolidated and consolidated levels.
   2. A record of the ICT assets classified as critical, kept by each business unit, consolidated yearly, and given to the auditor.
   3. A record of the incidents reported during the year, kept at entity level, and filed with the annual financial statements.
   4. A record of the vulnerabilities detected during testing, kept by the tester, and shared with the competent authority.

2. Domain 1: Fundamental concepts of ICT risk and resilience

   A financial entity is identified as an essential entity under the national rules transposing Directive (EU) 2022/2555. How does DORA position itself in relation to that Directive?

   1. DORA suspends the whole of the Directive for the financial sector, so none of the obligations arising from it can reach the entity.
   2. DORA counts as a sector-specific Union legal act for the purposes of Article 4 of that Directive, so its rules apply instead.
   3. DORA applies where the entity has no obligation under the Directive, which the competent authority then assesses case by case.
   4. DORA and the Directive apply cumulatively in full, so the entity has to run two separate frameworks and two incident channels.

3. Domain 2: DORA requirements for an ICT risk framework

   For which ICT services must a financial entity put exit strategies in place, and what must those strategies allow?

   1. For services supporting critical or important functions, allowing the entity to leave without disrupting its business or harming clients.
   2. For each service contracted with a provider that is established outside the Union, allowing full repatriation of the data within thirty days.
   3. For services whose annual cost exceeds the threshold set in the procurement policy, allowing the price to be renegotiated.
   4. For services provided by an intra-group provider, allowing the group to reallocate the function to another of its subsidiaries.

4. Domain 1: Fundamental concepts of ICT risk and resilience

   Chapter II of DORA is not applied in identical terms by every financial entity. Which factors govern how demanding its implementation is for a given entity?

   1. The annual turnover of the entity, its balance sheet total and its headcount, measured against the thresholds for microenterprises.
   2. The size and overall risk profile of the entity, and the nature, scale and complexity of its services, activities and operations.
   3. The number of ICT third-party service providers under contract, their location and their size, which drive the exposure of an entity.
   4. The supervisory category assigned by the competent authority, which grades every entity as low, medium or high risk each year.

5. Domain 2: DORA requirements for an ICT risk framework

   Why does Article 24(1) require certain financial entities to establish, maintain and review a testing programme as part of their framework?

   1. To assess preparedness for handling incidents, identify weaknesses and gaps, and implement corrective measures promptly.
   2. To obtain an attestation from the competent authority, presented to its clients, its counterparts and its auditors.
   3. To demonstrate to the provider that its services meet the levels agreed, as set out in the contractual arrangement.
   4. To replace the internal audit of the framework, which becomes unnecessary once the programme is in operation.

6. Domain 1: Fundamental concepts of ICT risk and resilience

   During a large scale outage of one data centre, a bank keeps its payment service running and then returns to normal operation. Which concept of the Regulation does that behaviour illustrate?

   1. Security of network and information systems, understood as the protection of those systems against unauthorised access.
   2. ICT concentration risk, understood as the dependency created by relying on one provider for a critical service.
   3. Business impact analysis, understood as the assessment in advance of the effects of severe business disruptions.
   4. Digital operational resilience, understood as the ability to keep delivering services throughout disruptions.

7. Domain 2: DORA requirements for an ICT risk framework

   The ICT risk management framework must include a digital operational resilience strategy. What is that strategy required to set out?

   1. The inventory of ICT assets classified as critical, the supplier that operates each of them, and the class given to each one.
   2. The remuneration policy for ICT staff, aligned with the measured performance of the systems that they administer.
   3. The templates used to report major incidents, the deadlines that apply to each report, and the channel used to send them.
   4. How the framework is to be implemented, including the risk tolerance level and clear information security objectives.

8. Domain 1: Fundamental concepts of ICT risk and resilience

   A security team receives intelligence that a criminal group is preparing a campaign against institutions of its type, although nothing has happened yet. How does the Regulation classify that situation?

   1. As an ICT-related incident, since the information reached the entity and had to be logged as one.
   2. As a major ICT-related incident, since a campaign aimed at the sector would have a high adverse impact.
   3. As a cyber threat, since it describes a potential circumstance that has not yet materialised anywhere.
   4. As an operational or security payment-related incident, since payment services are the likely target.

9. Domain 2: DORA requirements for an ICT risk framework

   When a financial entity restores backup data using its own systems, what does DORA require of the systems used for that restoration?

   1. That they be operated by a provider in the Union, under a written contract, and with full rights of audit and access.
   2. That they be located in a different Member State, so that a national disruption cannot affect the two sites at once.
   3. That they be physically and logically segregated from the source system, and protected from unauthorised access.
   4. That they be certified by an accreditation body, tested in advance, and kept under the access rules of the live data.

10. Domain 1: Fundamental concepts of ICT risk and resilience

    An entity records that an unpatched remote access gateway could be used by a criminal group to reach its customer database. In risk terms, what is the unpatched gateway?

    1. The vulnerability, because it is the weakness that would have to be exploited.
    2. The threat, because it is what could cause harm to the operations of the entity.
    3. The asset, because it is the item of value that the entity is trying to protect.
    4. The impact, because it is the consequence that the entity would have to absorb.

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.