Question 1 01 A smartphone maker and an enterprise software vendor each ship substantially modified versions regularly, free of charge and without new hardware. What does Article 13(10) let them do?
Address and remediate vulnerabilities for the latest version, while the other vulnerability handling duties continue End all vulnerability handling for earlier versions, including coordinated disclosure and information sharing Shorten the declared support period to match the release cadence of the latest version Nothing in the enterprise case, because applying an upgrade there requires testing and configuration effort from users
Question 2 02 How does a partner operator sign in to the partner console?
As the admin of the partner's own CVD Portal tenant With a dedicated partner-only login separate from any tenant account By signing in to one of the client tenants they operate Only through the phone-sized confirm pages linked from notification emails
Question 3 03 A server manufacturer replaces defective RAM with a better-performing module. The server runs faster but stays inside the intended use covered by the risk assessment. What is the outcome?
A substantial modification, because the repair changed the server's measured performance Not a substantial modification, since the product stays within the assessed intended use A substantial modification, because any hardware replacement restarts the conformity assessment Not a substantial modification, provided the manufacturer records the replacement in the technical documentation within 14 days
Question 4 04 What does creating a client from the console send to the client's founder?
A shared password for the partner's own tenant An account activation link worded as an invitation A read-only export of the partner's compliance data with instructions to reply if they want an account Nothing, because the founder must register separately first
Question 5 05 How are the two parts of Annex I divided?
Part I is paperwork and Part II is marketing material Part I is product security by design and Part II is vulnerability handling after market Part I applies only to hardware and Part II only to software Part I is optional guidance while Part II is the one binding section for manufacturers
Question 6 06 A banking app talks to a self-hosted banking interface, which in turn calls the account management and ledger systems the app never touches directly. Which parts are remote data processing solutions?
All three, since the app's payment function cannot complete without any one of them The banking interface only, though the risks from the systems behind it still have to be assessed None of them, because a bank's back-office systems are regulated under DORA instead The ledger and account management systems only, since they are the systems that actually record the transaction
Question 7 07 A client ships a mobile app through an app store and a desktop application built with web technology but packaged for local installation. Which is in scope?
Only the mobile app, because app store distribution is what places software on the market Both, since each is supplied to the user and executes on the user's device Only the desktop application, because web technology inside a mobile app makes it a browser application Neither, until the client also supplies the backend those two applications are calling into
Question 8 08 A microcontroller ships in a general-purpose variant and in a variant adding secure boot and key storage. How are they classified?
Both are default products because the underlying silicon is identical Both are Class I, since every microcontroller is named in Annex III The general-purpose part is default and the security variant is Class I, because function decides the tier Neither can be classified until a notified body has physically inspected every individual unit on the customer's own site
Question 9 09 A client is uneasy about seeing a third-party software line on their invoice. Which billing model best addresses that, and why?
Wholesale, because the platform cost is bundled into one price the partner charges Client-direct, because the client then sees the full platform price itemised Wholesale, because it removes the Declaration of Conformity fee from the invoice Neither, since every invoice must itemise third-party software separately
Question 10 10 A client insists on paying CVD Portal directly and paying the partner only for advisory work. Which billing choice fits, and where is it set?
Wholesale billing, set once for the whole partner account Client-direct billing, chosen per client in the console Wholesale billing, chosen per client in the console There is no supported way to let a client pay the platform directly
Question 11 11 An open-source project begins charging for a hosted, supported version. What changes under the CRA?
Nothing, open-source software is always outside the scope of the CRA The entire open-source community around it becomes jointly liable It must immediately affix a CE mark to its public source-code repository Monetising it brings it into scope for the entity that monetises it
Question 12 12 Breaching the Annex I essential requirements can bring a fine of up to what?
5 million euro or 1 percent of annual turnover 10 million euro or 2 percent of annual turnover 15 million euro or 2.5 percent of annual turnover A fixed 50,000 euro, with no turnover-based alternative available
Question 13 13 How often can the cross-client review digest repeat, and who controls whether it is sent?
On every single client action, and only CVD Portal support can stop it Once a week at most, with no way to disable it No more than once in 20 hours, and the switch is one setting for the whole partner It is sent separately for each client rather than once per partner, so there is nothing to throttle
Question 14 14 A prospect asks whether the CRA applies to them, since they are based outside the EU. What is the correct guidance?
The CRA applies only to manufacturers established inside the EU The CRA applies if their product with digital elements is placed on the EU market, wherever they are based The CRA applies only once they open an EU office The CRA never reaches a non-EU manufacturer as long as they sell through an EU-based distributor who contractually takes on all of the compliance responsibility
Question 15 15 Which prospect is the BEST fit for a partner engagement?
A large manufacturer with a full in-house compliance team already in place A company whose products never reach the EU market A firm already fully certified against the CRA An SME making EU-market connected products with no disclosure process yet