Question 1 01 What does creating a client from the console send to the client's founder?
A shared password for the partner's own tenant An account activation link worded as an invitation A read-only export of the partner's compliance data with instructions to reply if they want an account Nothing, because the founder must register separately first
Question 2 02 A prospect is weighing three ways to reach CRA compliance. Which is the strongest case a partner makes for the platform-plus-service option?
It is the cheapest of the three no matter how the engagement is scoped It removes the need for the manufacturer to make any classification decisions It covers the whole obligation set in one place, and the partner supplies the judgment around it It replaces the need for a Declaration of Conformity entirely
Question 3 03 A manufacturer pays an independent maintainer to build a feature, which is then released openly to everyone under the project's licence. Who carries what?
The maintainer has placed the software on the market, since the work was paid for The manufacturer becomes the manufacturer of the project, because it commissioned and funded the code Both share manufacturer obligations for the project, in proportion to the funding provided The maintainer has not placed it on the market, and the manufacturer owes due diligence under Article 13(5) if it integrates it
Question 4 04 A prospect says, "We already run a bug bounty, so we are covered." What is the strongest response?
Agree that a bug bounty satisfies the CRA and move on to pricing A bug bounty is intake only, while the CRA requires a full handling process, ENISA reporting, and a documented conformity path Explain that bug bounties are banned under the CRA and must be shut down Suggest they hold off on any process work until an external auditor has reviewed the bug bounty in detail and formally confirms whether it satisfies the regulation
Question 5 05 Where does a manufacturer file an Article 14 report?
To the coordinating national CSIRT and to ENISA Only to the manufacturer's own internal legal team To the European Commission's press office To every affected customer individually before notifying any authority at all
Question 6 06 Which of the following is an Annex III Class I important product?
A hardware security module A smart meter gateway with secure cryptoprocessing A tamper-resistant secure-element smartcard A password manager
Question 7 07 A manufacturer issues a security update three years into a product's support period. For how long must that update stay available?
Ten years from the day the product was first placed on the market Until the support period ends, after which it may be withdrawn At least 10 years from when it was issued, or the rest of the support period if longer For as long as the manufacturer keeps selling any version of the product anywhere in the Union
Question 8 08 The maximum penalty for non-compliance with the CRA essential requirements is which of the following?
Up to 15 million euro or 2.5 percent of global annual turnover, whichever is higher A fixed fine of 5,000 euro per product One percent of the manufacturer's EU-only revenue There are no financial penalties, only a market withdrawal order
Question 9 09 A vendor sells a security suite whose SIEM, intrusion detection and analytics modules are also available on separate subscriptions. How should the modules be classified?
As one product, taking the highest class any module reaches, which is Class II here Separately, so the SIEM is Class I, the intrusion detection Class II, and the analytics module default As one default product, since the suite as a whole has no single core functionality Separately, but all three land in Class II because they are sold together as a single security suite
Question 10 10 Which statement about a client's tenant under the partner program is correct?
Clients share one merged tenant with the partner A client has no workspace until the partner grants one per task Each client is a normal tenant with its own portal and workspace The partner's branding permanently replaces the client's own dashboard and removes their access
Question 11 11 An open-source project begins charging for a hosted, supported version. What changes under the CRA?
Nothing, open-source software is always outside the scope of the CRA The entire open-source community around it becomes jointly liable It must immediately affix a CE mark to its public source-code repository Monetising it brings it into scope for the entity that monetises it
Question 12 12 A company buys off-the-shelf microcontroller modules and connectivity parts, writes its own firmware, and sells the assembled agricultural monitor under its own name. How is that treated?
As a substantial modification of the microcontroller modules, so only the changed parts need assessing As distribution of the suppliers' products, with the suppliers remaining the manufacturers of what is inside As two products, the modules under their suppliers and the firmware under the assembling company As a new product with digital elements, making the company its manufacturer for the whole monitor
Question 13 13 A manufacturer signs up through a link of the form /p/ followed by a partner's slug. What happens?
They are logged straight into that partner's own tenant They land on the client's public disclosure portal with no account created They see the partner's brand and their new account is linked to that partner They receive a one-time discount on their first invoice but no other connection to the partner is recorded
Question 14 14 Publisher A sells a paid edition of its free operating system that bundles technical assistance. Publisher B gives away a command line tool and separately offers optional paid training and installation consultancy. Who is placing software on the market?
Both, because both earn revenue that depends on the existence of the software Neither, since support and consultancy are services rather than software Only publisher B, because consultancy is priced per engagement while a paid edition is a licence fee Only publisher A, whose paid edition bundles the support into the product
Question 15 15 A client decides they no longer want a consultant working in their tenant. What can they do?
Nothing until the partner agrees to end the engagement Only downgrade their plan, which indirectly ends all access Contact CVD Portal support and wait for the seat to be closed manually Revoke the seat themselves from their own settings