The Open Group TOGAF Enterprise Architecture Combined Part 1 and Part 2 認定 OGEA-103 試験問題:

1. Please read this scenario prior to answering the question
You are employed as an Enterprise Architect, reporting to the Chief Enterprise Architect, at a technology company. The company uses the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice.
The nature of the business is such that the data and the information stored on the company systems is the company's major asset and is highly confidential. The company employees travel a lot for work and need to communicate over public infrastructure. They use message encryption, secure internet connections using Virtual Private Networks (VPNs), and other standard security measures. The company has provided computer security awareness training for all its staff. However, despite good education and system security, there is still a need to rely on third-party suppliers for infrastructure and software.
The Chief Security Officer (CSO) has noted an increase in ransomware (malicious software used in ransom demands) attacks on companies with a similar profile. The CSO recognizes that no matter how much is spent on education, and support, the company could be a victim of a significant attack that could completely lock them out of their important data.
A risk assessment has been completed and the company has looked for cyber insurance that covers ransomware. The price for this insurance is very high. The CTO recently saw a survey that said 1 out of 4 businesses that paid ransoms could not get their data back, and almost the same number were able to recover the data without paying. The CTO has decided not to get cyber insurance to cover ransom payment.
The Chief Technology Officer (CTO) is the sponsor of the EA project. The practice uses an iterative approach for its architecture development. This has enabled the decision makers to gain valuable insights into the different aspects of the business.
Refer to the scenario
You have been asked to describe the steps you would take to strengthen the current architecture to improve data protection.
Based on the TOGAF standard which of the following is the best answer?

A) You would run an assessment to identify the business continuity requirements and analyze thecurrent Enterprise Architecture for gaps. You would create a change request to start a further cycle of architecture work to address changes to mitigate such an attack. You would arrange a meeting of the Architecture Board to assess and approve the change request. Once approved you would create a new Request for Architecture Work to begin an ADM cycle to implement the changes.
B) You would hold an Architecture Compliance Review with the scope to examine the company's ability to respond to ransomware attacks. You would identify the departments involved and have them nominate representatives. You would then tailor checklists to address the requirement for increased business continuity and resilience. You would circulate to the nominated representatives for them to complete. You would then review the completed checklists, identifying and resolving issues. You would then determine and present your recommendations.
C) You would contact existing suppliers for technology that could enhance the company's capabilities to detect, react, and recover from an incident. You would perform an analysis and assessment of a simulated ransomware attack to evaluate the current Enterprise Architecture's resilience and recovery capabilities. Using the findings, you would prepare a gap analysis of the current Enterprise Architecture. You would prepare change requests to address identified gaps. You would add the changes implemented to the Architecture Repository.
D) You would ensure that the business value and cost of continuity measures are understood by key stakeholders and would ensure that the company has in place up-to-date processes for managing change to the current Enterprise Architecture. You recommend that mitigation for a ransomware attach be addressed at the infrastructure level with specific technology controls. Changes should be made to the baseline description of the Technology Architecture. The changes should be approved by the Architecture Board and a change request approved.

2. Please read this scenario prior to answering the question.
You are employed as an Enterprise Architect at a healthcare company. The company operates over 250 hospitals and is dedicated to transforming healthcare with new ideas and advancements. The company has multiple divisions including surgery centers, freestanding emergency departments, urgent care clinics, and physician practices. They also develop and supply a range of products and services, many with specialized systems and clinical needs.
The company's Enterprise Architecture (EA) department has been operating for several years and has mature, well-developed architecture governance and development processes following the TOGAF standard. The Chief Information Officer (CIO) is the sponsor of the Enterprise Architecture program.
Healthcare is a highly controlled sector, and the company must maintain robust security practices to keep patient information private and prevent data breaches. The company shares electronic health records with multiple providers and has standardized its medical coding for billing and reporting.
Many of the company's rivals have begun using Artificial Intelligence (AI) in their operations, and the indications are that this will be transformative for healthcare delivery. This is something the EA department has been interested in for a while, and they had recently submitted an Architecture Change Request which was approved. As a result, the CIO has approved a Request for Architecture Work to implement AI-based solutions in the company.
The project has been established and you have been assigned to work on it. Stakeholders, concerns, and business requirements have been identified. The stakeholders have made it clear that timely implementation of changes can be life-critical, and that changes should be focused on improving patient outcomes. They also have a concern about disruption due to the changes and require the systems to preserve clinical data access and maintain critical life-support systems during any outages.
The scope of what is inside and what is outside the architecture efforts has now been confirmed. Your task is to revisit and review the Architecture Principles, as they form part of the constraints on architecture work.
Question:
The EA team leader has asked you to explain which Architecture Principles are most relevant for this project.
Based on the TOGAF standard, which of the following is the best answer?
(Note: You should assume the company follows the example set of Architecture Principles that are provided in the TOGAF standard, ADM Techniques, Architecture Principles chapter.)

A) Compliance with the Law is critical for a company operating in one of the most heavily regulated industries. This principle provides the foundation for ensuring the initiative meets all legal requirements for patient data handling. Interoperability ensuring systems can exchange and use information is important for cross-provider data sharing. Control Technical Diversity will be vital for standardizing the AI implementations across multiple divisions that share electronic health records with standardized medical coding.
B) Responsive Change Management emphasizes implementing changes in a timely manner to meet user needs and limiting downtime during change. Primacy of Principles makes it clear that the set of principles applies equally to all divisions and clinical departments. This will ensure that the regulatory requirements across the company are met. Maximize Benefit to the Enterprise will ensure that decisions are made to provide maximum benefit to the company.
C) Common Vocabulary and Data Definitions is essential for standardized medical coding and cross- provider data sharing. This ensures the solutions will properly interpret clinical data consistently across divisions. Data Security is critical to protect patient information aligned with the regulations. It ensures data integrity and system availability for critical care. Requirements-Based Change ensures changes respond to business and clinical needs, supporting changes being driven by clinical requirements.
D) Common Use Applications promotes standardization across divisions for the solutions, aligning with the company's existing practice of standardized medical coding. Information Management is Everybody's Business is relevant because clinical staff, administrative personnel, and IT teams all need to collaborate on information management decisions. Data is Accessible is highly relevant to the healthcare industry. This is needed for users to perform their functions and leads to efficiency and effectiveness.

3. You are working as an Enterprise Architect within an Enterprise Architecture (EA) team at a large government agency with multiple divisions. The agency has a well-established EA practice and follows the TOGAF standard as its method for architecture development. The government has mandated that the agency prepare for an "AI-first" world.
The agency wants to determine the impact and role of AI in its future services. The CIO has approved a Request for Architecture Work to explore the use of AI in services. Some leaders are concerned about reliance on AI, security, and employees' need to acquire new skills.
The EA team leader seeks suggestions on managing the risks associated with a new architecture for the AI- first project. Based on the TOGAF standard, which of the following is the best answer?

A) Create an organization map to show the links between different agency parts. Hold a meeting to teach stakeholders to interpret the models. Manage risks as part of Security Architecture development.
B) Identify key stakeholders and develop a Communication Plan that addresses their needs. Ensure the architecture addresses risk management and summarizes features of the architecture.
C) Conduct an analysis of stakeholders, documenting their concerns and recording them in the Architecture Vision document. Risks should be recorded in the Architecture Requirements Specification and reviewed regularly.
D) Separate stakeholders into groups and categorize them. Develop models for each group and verify that their concerns are addressed in Phase G, Implementation Governance.

4. Which of the following best describes the need for the ADM process to be governed?

A) To permit the architecture domains to be integrated
B) To enable a fast response to market changes
C) To enable development of reference architectures
D) To verify that the method is being applied correctly

5. Please read this scenario prior to answering the question
Your role is that of a senior architect, reporting to the Chief Enterprise Architect, at a medium-sized company with 400 employees. The nature of the business is such that the data and the information stored on the company systems is their major asset and is highly confidential.
The company employees travel extensively for work and must communicate over public infrastructure using message encryption, VPNs, and other standard safeguards. The company has invested in cybersecurity awareness training for all its staff. However, it is recognized that even with good education as well as system security, there is a dependency on third-parly suppliers of infrastructure and software.
The company uses the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice. The CTO is the sponsor of the activity.
The Chief Security Officer (CSO) has noted an increase in ransomware (malicious software used in ransom demands) attacks on companies with a similar profile. The CSO recognizes that no matter how much is spent on education, and support, it is likely just a matter of time before the company suffers a significant attack that could completely lock them out of their information assets.
A risk assessment has been done and the company has sought cyber insurance that includes ransomware coverage. The quotation for this insurance is hugely expensive. The CTO has recently read a survey that stated that one in four organizations paying ransoms were still unable to recover their data, while nearly as many were able to recover the data without paying a ransom. The CTO has concluded that taking out cyber insurance in case they need to pay a ransom is not an option.
Refer to the scenario
You have been asked to describe the steps you would take to improve the resilience of the current architecture?
Based on the TOGAF standard which of the following is the best answer?

A) You would monitor for technology changes from your existing suppliers that could improve resilience.
You would prepare and run a disaster recovery planning exercise for a ransomware attack and analyze the performance of the current Enterprise Architecture. Using the findings, you would prepare a gap analysis of the current Enterprise Architecture. You would prepare change requests to address identified gaps. You would add the changes implemented to the Architecture Repository.
B) You would ensure that the company has in place up-to-date processes for managing change to the current Enterprise Architecture. Based on the scope of the concerns raised you recommend that this be managed at the infrastructure level. Changes should be made to the baselinedescription of the Technology Architecture. The changes should be approved by the Architecture Board and implemented by change management techniques.
C) You would request an Architecture Compliance Review with the scope to examine the company's resilience to ransomware attacks. You would identify the departments involved and have them nominate representatives. You would then tailor checklists to address the requirement for increased resilience. You would circulate to the nominated representatives for them to complete. You would then review the completed checklists, identifying and resolving issues. You would then determine and present your recommendations.
D) You would determine business continuity requirements, and undertake a gap analysis of the current Enterprise Architecture. You would make recommendations for change requirements to address the situation and create a change request. You would manage a meeting of the Architecture Board to assess and approve the change request. Once approved you would produce a new Request for Architecture Work to activate an ADM cycle to carry out a project to define the change.

質問と回答：