DORA

DORA Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex DORA scenarios: Oversight Framework mechanics, cross-border ICT concentration risk, and TLPT programme design.

11 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 11

Under the DORA Oversight Framework, which body/bodies can be designated as Lead Overseer for a critical ICT third-party service provider?

A randomly selected financial entityThe World BankOnly the ICT provider's own internal audit functionOne of the European Supervisory Authorities (EBA, EIOPA, or ESMA), designated based on the criticality assessment

Question 2 of 11

What power does a Lead Overseer generally have with respect to a designated critical ICT third-party provider under DORA?

Powers including requesting information, conducting investigations/inspections, and issuing recommendationsThe power to directly set the provider's product pricesThe power to nationalise the providerNo powers at all — oversight is purely advisory with no consequences

Question 3 of 11

Which of the following are relevant when a financial entity assesses concentration risk arising from reliance on a small number of critical ICT third-party providers?

Select all that apply.

The potential impact of a service disruption on the financial entity and, at scale, on financial stabilityThe substitutability of the providerThe provider's office interior designThe number of financial entities relying on the same provider sector-wide

Question 4 of 11

Under Article 30's key contractual provisions, what exit strategy consideration must be addressed for critical/important functions?

The financial entity must always exit within 24 hours regardless of impactNo exit provisions are required for any functionProvisions enabling an orderly exit, including transition periods and continuity of service during migration to an alternative provider or back in-houseExit clauses are optional if the provider agrees informally

Question 5 of 11

How does DORA's TLPT requirement relate to frameworks such as TIBER-EU?

They are entirely unrelated and incompatibleTIBER-EU was abolished when DORA entered into forceDORA's TLPT provisions are designed to be consistent with, and can build on, existing frameworks like TIBER-EU used across the EUTLPT only applies outside the EU

Question 6 of 11

A financial entity relies on a single cloud provider for a function later classified as 'critical or important.' What DORA-driven risk should its board specifically evaluate?

Whether the provider's logo meets brand guidelinesOnly the provider's marketing spendNone — critical function classification has no bearing on ICT risk oversightConcentration risk and the adequacy of exit/substitutability arrangements for that critical or important function

Question 7 of 11

Which of the following are typical components of a mature ICT third-party risk management lifecycle under DORA?

Select all that apply.

Ignoring the relationship once signedDocumented exit and contingency planningOngoing monitoring throughout the relationshipPre-contractual due diligence and risk assessment

Question 8 of 11

What is the general relationship between DORA and sector-specific EU financial regulation already addressing ICT/operational risk (e.g. existing EBA guidelines)?

DORA has no relationship to prior guidanceDORA repeals all other EU financial regulation entirelyDORA only applies to entities with no prior ICT risk obligationsDORA establishes a harmonised framework intended to consolidate and, in relevant respects, supersede fragmented prior ICT risk requirements across financial services legislation

Question 9 of 11

Under DORA, competent authorities can require a financial entity to temporarily suspend the use of an ICT service, in serious cases, where necessary to protect the integrity of the financial system.

TrueFalse

Question 10 of 11

Why might 'sub-outsourcing' by an ICT third-party provider be a specific area of DORA-related contractual and oversight focus?

Risk and dependency can extend through the supply chain, so contracts and oversight need visibility into material sub-outsourcing arrangementsDORA only concerns itself with the financial entity's own employeesSub-outsourcing has no bearing on operational resilienceSub-outsourcing is banned outright under DORA

Question 11 of 11

How should a globally active financial group approach DORA compliance alongside similar operational resilience requirements in non-EU jurisdictions (e.g. UK operational resilience rules)?

Only comply with the jurisdiction with the lowest requirementsIgnore non-EU requirements entirely once DORA appliesMap overlapping and divergent requirements to build a coherent group-wide programme, since specific triggers, thresholds, and reporting timelines can differ by jurisdictionAssume all frameworks are identical and apply a single unmodified policy

0 of 11 answered