DORA

DORA Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Implementing DORA in practice: incident classification thresholds, third-party contracts, and resilience testing programmes.

13 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 13

Under Article 34, which factors help determine whether an ICT-related incident or cyber threat is classified as 'major' or 'significant'?

Select all that apply.

The number of clients/financial counterparts affectedThe geographical spread and economic impactThe duration and service downtime causedThe office's interior paint colour

Question 2 of 13

Article 19-type reporting obligations under DORA generally require financial entities to report major ICT-related incidents to whom?

A private consultancy of the entity's choosingNo one — reporting is voluntaryThe general public via press release onlyThe relevant competent authority, following defined timelines and templates

Question 3 of 13

What is the purpose of Article 30's provisions on key contractual provisions for ICT third-party arrangements?

To ensure contracts include specific elements such as service descriptions, locations of data processing, and termination rightsTo set the third party's marketing strategyTo eliminate the need for any written contractTo require the third party to acquire the financial entity

Question 4 of 13

Under Article 29, what is a 'preliminary assessment of ICT concentration risk' primarily concerned with?

Office real estate costsEmployee parking allocationThe risk of overreliance on a single or a small number of critical ICT third-party providers across the sector or entityCurrency exchange rates

Question 5 of 13

Under DORA, financial entities remain fully responsible for compliance with their ICT risk management obligations even when they outsource ICT functions to third parties.

TrueFalse

Question 6 of 13

Article 44 introduces threat-led penetration testing (TLPT). Which entities are generally subject to this more advanced testing?

No entity is ever required to perform TLPTAll financial entities regardless of size or systemic importance, with no exceptionsEntities identified based on criteria (e.g. systemic importance) as required to perform TLPT, generally at a defined minimum frequencyOnly ICT third-party providers, never financial entities themselves

Question 7 of 13

What role do 'independent testers' typically play in a threat-led penetration test under DORA-aligned frameworks (e.g. TIBER-EU)?

They have no defined roleSimulating real-world threat actor tactics, techniques and procedures against live production systems in a controlled mannerOnly reviewing marketing materialsSetting the entity's annual budget

Question 8 of 13

Under Article 6, what must the ICT risk management framework be reviewed and, where necessary, updated?

Never — it is set once and never revisitedOnly when a new CEO is appointedAt least once a year, and following major ICT-related incidents or supervisory findingsOnly if requested by a competitor

Question 9 of 13

What is the significance of maintaining a 'register of information' on contractual arrangements with ICT third-party providers?

It has no regulatory significanceIt replaces the need for any contractIt is only used for internal marketing purposesIt supports supervisory oversight, including identifying critical ICT third-party providers and concentration risk across the sector

Question 10 of 13

Article 10 requires financial entities to have mechanisms to promptly detect anomalous activities. What is this primarily aimed at supporting?

Simplifying payroll processingReducing electricity costsIncreasing advertising reachEarly detection of ICT-related incidents and potential single points of failure

Question 11 of 13

Which elements would typically be part of a financial entity's ICT business continuity policy under DORA?

Select all that apply.

Response and recovery plansBackup policies and restoration/recovery proceduresCrisis communication plansA list of unrelated office supplies

Question 12 of 13

Proportionality is a recurring theme in DORA — smaller and less complex financial entities may apply certain requirements in a manner proportionate to their size, nature, scale and complexity.

TrueFalse

Question 13 of 13

What is a key difference between an 'ICT-related incident' and an 'ICT-related incident' classified as 'major' under DORA's framework?

Major incidents are always caused by insidersMajor incidents meet specific classification thresholds (e.g. impact, duration, criticality) triggering regulatory notification obligations that ordinary incidents may notMajor incidents only refer to hardware failuresThere is no difference — all incidents are treated identically

0 of 13 answered