Free PECB DORA Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB DORA Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What does digital operational resilience enable a financial entity to sustain through disruptions?

   1. A.Its network's security after financial services have ceased
   2. B.The provision and quality of its financial servicesCorrect answer: B
   3. C.Its financial services only after the disruption has ended
   4. D.Its usual service levels only while all suppliers are available

   Explanation: DORA states: "support the continued provision of financial services and their quality, including throughout disruptions". The definition focuses on continued financial services and quality through disruptions, not only after recovery or while every supplier is available.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 3(1)

2. 2For a financial entity subject to DORA Article 5, who bears ultimate responsibility for managing ICT risk?

   1. A.The management bodyCorrect answer: A
   2. B.The external ICT auditor
   3. C.The critical service provider
   4. D.The competent authority

   Explanation: DORA states: "bear the ultimate responsibility for managing the financial entity’s ICT risk". The management body retains ultimate responsibility; auditors, suppliers and supervisors do not take over that responsibility.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 5(2)(a)

3. 3Which situation illustrates ICT risk before it materializes?

   1. A.A system weakness has already caused service downtime
   2. B.A network failure has already impaired transaction processing
   3. C.A network-related circumstance could compromise services if it occursCorrect answer: C
   4. D.An incident has already caused unauthorised data disclosure

   Explanation: DORA states: "any reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security". The potential circumstance is risk before materialization; the other choices describe realised disruptions or incidents.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 3(5)

4. 4How must members of the management body maintain their ability to assess ICT risk under Article 5?

   1. A.Review ICT knowledge after major disruptions and supplier changes
   2. B.Maintain sufficient ICT knowledge through regular relevant trainingCorrect answer: B
   3. C.Acquire ICT knowledge only when a supervisory review is scheduled
   4. D.Rely on providers to maintain the management body's ICT knowledge

   Explanation: The source states: "actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk". The management body must keep sufficient ICT knowledge and skills up to date, including regular training commensurate with the risk.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 5(4)

5. 5Which system fits DORA's definition of a legacy ICT system?

   1. A.A supported system still in use and suitable for software fixes
   2. B.An unsupported system removed from all operational use
   3. C.A new system still in use with current supplier support
   4. D.An unsupported system still in use supporting the entity's functionsCorrect answer: D

   Explanation: DORA states: "an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT third-party service provider, but that is still in use and supports the functions of the financial entity". Continued use and the stated end-of-life, upgrade or support conditions distinguish the legacy system from a supported or retired system.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 3(3)

6. 6What is the management body's budget responsibility under Article 5?

   1. A.Allocate and periodically review an appropriate resilience budgetCorrect answer: A
   2. B.Allocate a budget once and review it only after a major incident
   3. C.Approve the budget only for contracted ICT services
   4. D.Delegate the entire resilience budget to each ICT provider

   Explanation: The source states: "allocate and periodically review the appropriate budget to fulfil the financial entity’s digital operational resilience needs". The body must allocate and periodically review an appropriate budget for resilience resources, including security awareness and training.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 5(2)(g)

7. 7Under DORA, which example represents an information asset worth protecting?

   1. A.A collection of customer information worth protectingCorrect answer: A
   2. B.A server used to process customer information
   3. C.A software application used to display customer information
   4. D.A router used to transmit customer information

   Explanation: DORA states: "a collection of information, either tangible or intangible, that is worth protecting". The collection of information is the information asset; the server, application and router are hardware or software rather than the information itself.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 3(6)

8. 8What must the management body do with ICT internal audit plans under Article 5?

   1. A.Review plans only after their audits have been completed
   2. B.Approve and periodically review plans, audits and material changesCorrect answer: B
   3. C.Approve plans while leaving material changes to the provider
   4. D.Review material changes only when a regulator directs it

   Explanation: The source states: "approve and periodically review the financial entity’s ICT internal audit plans, ICT audits and material modifications to them". The management body approves and periodically reviews the specified plans, audits and material modifications; the other choices omit part of that duty or add unsupported conditions.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 5(2)(f)

9. 9A financial entity lists the hardware and software it uses. Which item is an ICT asset under DORA?

   1. A.A set of customer account records worth protecting
   2. B.A server used in the entity's network and information systemsCorrect answer: B
   3. C.A collection of transaction data worth protecting
   4. D.A document containing an approved information classification

   Explanation: DORA states: "a software or hardware asset in the network and information systems used by the financial entity". The server is hardware in the entity's systems. The other choices describe information rather than a software or hardware asset.

   Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 3(7)

10. 10What provider-related information must reporting channels enable the management body to receive under Article 5?

    1. A.Relevant changes only after they have been implemented
    2. B.Relevant changes only after affected contracts expire
    3. C.Relevant planned material changes regarding ICT providersCorrect answer: C
    4. D.Relevant planned changes only when a provider reports an incident

    Explanation: The source states: "any relevant planned material changes regarding the ICT third-party service providers". The required reporting channels include relevant planned material changes regarding ICT providers, without the extra conditions stated by the alternatives.

    Reference: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector — Article 5(2)(i)(ii)