Scenario
Your role is that of an Enterprise Architect, reporting to the Chief Enterprise Architect, at a technology company.
The company uses the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice. The Chief Technology Officer (CTO) is the sponsor of the activity. The EA practice uses an iterative approach for its architecture development. This has enabled the decision-makers to gain valuable insights into the different aspects of the business.
The nature of the business is such that the data and the information stored on the company systems is the company's major asset and is highly confidential. The company employees travel a lot for work and need to communicate over public infrastructure. They use message encryption, secure internet connections using Virtual Private Networks (VPNs), and other standard security measures. The company has provided computer security awareness training for all its staff. However, despite good education and system security, there is still a need to rely on third-party suppliers for infrastructure and software.
The Chief Security Officer (CSO) has noted an increase in ransomware (malicious software used in ransom demands) attacks on companies with a similar profile. The CSO recognizes that no matter how much is spent on education and support, the company could be a victim of a significant attack that could completely lock them out of their important data.
A risk assessment has been completed, and the company has looked for cyber insurance that covers ransomware. The price for this insurance is very high. The CTO recently saw a survey that said 1 out of 4 businesses that paid ransoms could not get their data back, and almost thesame number were able to recover the data without paying. The CTO has decided not to get cyber insurance to cover ransom payment.
You have been asked to describe the steps you would take to strengthen the current architecture to improve data protection.
Based on the TOGAF standard, which of the following is the best answer?

• A. You would assess business continuity requirements and analyze the current Enterprise Architecture for gaps. You would recommend changes to address the situation and create a change request. You would engage the Architecture Board to assess and approve the change request. Once approved, you would create a new Request for Architecture Work to begin an ADM cycle to implement the changes.
• B. You would ensure that the company has in place up-to-date processes for managing change to the current Enterprise Architecture. Based on the scope of the concerns raised, you recommend that this be managed at the infrastructure level. Changes should be made to the baseline description of the Technology Architecture. The changes should be approved by the Architecture Board and implemented by change management techniques.
• C. You would monitor for technology updates from your existing suppliers that could enhance the company's capabilities to detect, react, and recover from an IT security incident. You would prepare and run a disaster recovery planning exercise for a ransomware attack and analyze the performance of the current Enterprise Architecture. Using the findings, you would prepare a gap analysis of the current Enterprise Architecture. You would prepare change requests to address identified gaps. You would add the changes implemented to the Architecture Repository.
• D. You would request an Architecture Compliance Review with the scope to examine the company's ability to respond to ransomware attacks. You would identify the departments involved and have them nominate representatives. You would then tailor checklists to address the requirement for increased resilience. You would circulate to the nominated representatives for them to complete. You would then review the completed checklists, identifying and resolving issues. You would then determine and present your recommendations.

Please read this scenario prior to answering the question
You are employed as an Enterprise Architect working at a vehicle manufacturing company. The company specializes in buses and coaches. You are part of an Enterprise Architecture (EA) team that has responsibilities across multiple divisions of the company. EA provides the company with a comprehensive framework to develop and manage their manufacturing infrastructure, processes for component production, and design and testing systems.
The company has a corporate strategy that focuses on switching to electric power for its vehicles. It has invested heavily in a new standardized design, production efforts, and major components to use across all its product range. The company has multiple manufacturing plants in North America, Europe, and in Asia.
Customer demand has caused a backlog of orders because many customers want to have more environmentally friendly public transportation. There are not enough electronic components available, which is making it hard to produce products and meet customer demand. To address this issue, the company has started making the battery packs themselves and has hired new suppliers.
The EA team is working on a project to improve the process and systems to design, produce, and test the battery pack. As part of putting the new battery pack into production, changes to the assembly processes need to be made. A trial has been completed at a single location. The Chief Engineer, sponsor of the project, and the Architecture Board have approved the plan to roll out these changes to all plants.
Preliminary Architecture Contracts are being developed to detail the work needed to put in place the new processes for each location. The EA team leader has called a meeting to discuss the contracts. It is emphasized that the Architecture Contract will serve as the key connection between architecture and implementation organizations.
The company mixes internal teams with a few third-party contractors at the locations.
The Chief Engineer is worried that the implementation and deployment will not be consistent and of satisfactory quality.
The company has an established EA practice. It uses the TOGAF standard as the foundation for its work including the internal EA framework. Additionally, the company uses various management frameworks such as business planning, project management, and operations management.
Refer to the scenario
The EA team leader asks you how you would address the Chief Engineer ' s concern.
Based on the TOGAF standard, which of the following is the best answer?

• A. The contracts must be checked to ensure they can be used to direct andcontrol the implementation teams. For contracts issued to third-partycontractors, they must be enforceable legal contracts. For internaldevelopment teams, a memorandum of understanding with the ArchitectureBoard is needed.
  The Architecture Board must review all deviations from theArchitecture Contract and decide whether to grant a dispensation to allow theimplementation organization to customize the process to meet their localneeds.
• B. The contracts must specify goals, measures, acceptance terms, and risks.Third-party contracts must be legally enforceable. It is advisable to establish aschedule of compliance reviews at key points in the implementation process.The Architecture Board must review all deviations from the ArchitectureContract and consider whether to grant a dispensation to allow the process tobe customized for local needs. Ensure that all dispensations are time-boundrather than indefinite.
• C. The contracts must be used to manage the architecture governance processesacross the locations.Monitoring tools must be put in place to assess theperformance of each completed battery pack at each location. If a deviationfrom the contract is needed, the Architecture Board should allow theArchitecture Contract to be modified for the location. In such cases they shouldissue a new Request for Architecture Work to implement a modification to theArchitecture Definition.
• D. The contracts must be checked to ensure they have flexibility. For changesundertaken by internal teams, a memorandum of understanding between theArchitecture Board and the implementation organization is needed. If acontract is issued to a contractor, it must be a fully enforceable legal contract. Ifa deviation from the Architecture Contract is found, the Architecture Boardmust grant a dispensation to allow the implementation organization tocustomize the process to meet their local needs.

Please read this scenario prior to answering the question
You are employed as an Enterprise Architect within a multinational company. The company has been very successful and has been buying companies around the world. This has led to a growing number of manufacturing divisions in various locations with a complex supply chain.
The top management recently expressed concerns about the company ' s effectiveness because of its multiple data centers and duplicate applications. The EA team has been working on a project to solve this issue. An analysis shows that supply chain issues have led to not enough products being produced to meet all the customer demand.
A strategic architecture has been defined to help meet customer demand and manage the supply chain more effectively. The strategic architecture involves combining different Enterprise Resource Planning (ERP) applications that are currently used separately in the company ' s production sites.
Each division has finished the Architecture Definition documentation to address their own specific manufacturing needs. The Enterprise Architects have agreed an overall strategy for the migration. They have defined a set of work packages that address the gaps found. They have defined the intermediate architectural states between the Baseline and Target architecture to add a new ERP environment into the company.
Because of the risks posed by this change from the current environment, the architects have recommended that a phased approach should be taken to implement the target architecture with several stages of change. They have created a draft roadmap with the implementation process estimated to take over two years.
The company has an established Enterprise Architecture (EA) practice and follows the TOGAF Architecture Development Method. The company also uses various management frameworks such as business planning, project/portfolio management, and operations management. The EA program is sponsored by the Chief Information Officer (CIO). In your role as an Enterprise Architect within the EA team, you work closely with the important stakeholders from the various divisions within the company.
Refer to the scenario
You have been assigned to plan the next steps for the migration. Which approach will you choose?
Based on the TOGAF standard which of the following is the best answer?

• A. You will focus on project selection. You make sure that the Implementation andMigration plan aligns with the other management frameworks in use in thecompany. Next, you assign a value to each work package, taking into accountthe resources available and how they fit into the overall strategy. Using thesework packages, you estimate resource requirements and timings. You thenselect which projects will be included in the Implementation and Migration Plan.
• B. You estimate the business value for each project by applying the BusinessValue Assessment Technique to prioritize the migration projects and projectsteps. The assessment should focus on return on investment and criteria forevaluating performance to track the progress of the architecturetransformation. You would confirm and plan a series of Transition Architecturephases using a table of Architecture Definition Increments that lists theprojects. You then update the Implementation and Migration Plan.
• C. You conduct a series of Compliance Assessments to check that thearchitecture is being implemented as required by the contract. This is donenow to confirm that the implementation team is following the correctdevelopment process, and if not, so course correction is viable. This involvesusing monitoring tools and making sure that performance targets are beingachieved. If the targets are not met, you would then need to make adjustmentsto the performance requirements and update them in the Implementation andMigration Plan.
• D. You finalize the Architecture Definition documentation with updates to reflectthe implementation approach. You ensure that Implementation and MigrationPlan is consistent with the chosen approach.
  You identify the resourcesneeded to undertake the development projects. You would then produce anImplementation Governance Model to manage the lessons learned beforefinishing the plan. You ensure that the lessons learned are applied to theImplementation and Migration Plan.

Please read this scenario prior to answering the question
You are employed as an Enterprise Architect working within the Enterprise Architecture (EA) team at an electric vehicle manufacturer. The company focuses on designing, manufacturing, and advancing battery technology for sustainable transportation. The goal of the company is to build the best technology and software platform to support self-driving cars.
An architecture to support strategy has been completed defining a long-term Target Architecture with a roadmap over five years. This has identified the need for a portfolio of projects over the next two years. The portfolio includes development of an advanced driver assistance system using data gathered from multiple vehicles on the road.
The design of the presentation and accessibility of different types of data that the company plans to offer through its platform is challenging. It is important for the application portfolio to work securely with third- party cloud services, and V2X (Vehicle-to-Everything) service providers across many countries in order to effectively manage large amounts of data. Stakeholders are particularly concerned about the security of V2X.
Regulations in various markets mandate that user privacy must always be safeguarded, to prevent tracking and compiling of data that could reveal the drivers ' journey.
The company follows the TOGAF standard as the basis for its Enterprise Architecture practice and uses the purpose-based EA Capability model as described in the TOGAF Series Guide: A Practitioners ' Approach to Developing Enterprise Architecture Following the TOGAF ADM. The EA team reports to the Chief Information Officer (CIO), who is the sponsor of the EA program.
You have been assigned to lead the architecture development effort for the driver assistance system. A security resource plan and a vision for a security-specific architecture design have been completed. You have a meeting with the EA team leader to talk about the progress of your work.
Refer to the scenario
You have been asked how you will address risk and security at this stage of the architecture project.
Based on the TOGAF standard which of the following is the best answer?

• A. Data quality is a key factor in risk management. The datasets that need to be safeguarded should be identified. For each dataset, ownership and responsibility for the quality of data should be assigned. A security classification will be defined and applied to each dataset. The dataset owner will then be able to authorize processes that are trusted for a certain activity on the dataset under specific circumstances.
• B. A qualitative risk assessment should be carried out for the data assets exchanged with the service providers. This will deliver a set of priorities, high to medium to low, based on identified threats, the likelihood of occurrence, and the impact. Using the priorities, a Business Risk Model can then be developed detailing the risk strategy including classifications to determine what mitigation is sufficient.This model can then used to determine the risk strategy for the company.
• C. A trust framework should be established with the third parties required for the travel assistance systems.
  This will describe the relationship with each party and establish the foundation for secure cloud operations. Digital certificates should be a key part of the framework and will be used to create trust between the parties. Regular monitoring for legal and regulatory changes across all the countries should occur to keep the trust framework in compliance.
• D. Since data is being shared across multiple service providers, a security federation should be established.
  This includes contractual arrangements, and a definition of the responsibility areas for the data exchanged, as well as security implications. Assets with the same security criteria should be grouped together so they can be managed under one security policy. A risk assessment should be carried out to determine the risks relevant to specific data assets.

Please read this scenario prior to answering the question
You are part of the Enterprise Architecture (EA) team at a company, employed as an Enterprise Architect.
The company creates and sells goods targeted at the consumer market, which are sold to retail organizations worldwide.
The EA team has operated successfully for several years and has well developed processes based on the TOGAF standard. The EA team ' s responsibilities include architecting product development processes and customer experience. The Enterprise Architecture practice at the company is sponsored by the Chief Technology Officer.
The company uses Agile product management techniques and Agile development practices. The EA team works with the product management teams, supporting and enabling the Agile development teams. The company routinely implements architecture and solution sprints that run in parallel, with the EA team developing Minimum Viable Architecture (MVA) deliverables.
The company is starting a digital transformation project where it will expand its offerings from physical products to also Include digital products and digital services. This includes enabling each of its product lines to offer digital products or services associated with their existing physical products.
You have been asked to work on a specific product line, which is experimenting with new direct-to-consumer digital products using a third-party platform. A Minimum Viable Architecture approach was taken for this experiment, including a shallow architecture development iteration with a focus on the Application Architecture, followed by a quick and minimal Implementation.
Customer feedback shows that the direct-to-consumer digital products are missing their revenue targets and are not reaching the target customers. The feedback is also saying that the customers do not find much value in these direct-to-consumer digital products. The product manager is seeking advice on how to tackle these problems, while making sure that the products stay within the guardrails set by the EA team.
Refer to the scenario
How will you gather information to address the missed revenue targets and inability to reach the intended target customers?
Based on the TOGAF standard which of the following is the best answer?

• A. You would start with the target Application Architecture, revising it to better align with the overall digital transformation plan. You would write a new Statement of Architecture Work including a detailed project description and a work plan. This should be submitted for review by the EA team leader. Once approved by the EA team leader, you would start a full ADM cycle to gather all the necessary information to address the issues raised.
• B. You would revise the target architecture for ADM Phase B and create new architecture models to address the issues raised. The models should identify different groups of customers, what they find valuable, how much it costs to serve them, and the resulting revenue. You would examine the customer value by using value stream mapping to breakdown the activities for the direct-to-consumer products.
  You would investigate different target Business Architecture alternatives.
• C. You would start with the baseline Business Architecture and develop new architecture models to address the concerns raised. You use modeling techniques to identify customer segments, determine what is necessary to meet the customer ' s needs, and how to attract the target audience. In addition, including value streams and information maps would help. You would investigate different alternatives that would enhance the value proposition for the target audience.
• D. You would start another iteration of ADM Phases B-C. This would include development of a description in the Architecture Definition Document of how the product architecture needs to operate to achieve the business goals, and how the application will support the needs of the business as well as the customers. The Data Architecture should identify tools for data capture that would help with analysis of the concerns raised.