The Open Group TOGAF Enterprise Architecture Part 2 : OGEA-102

Please read this scenario prior to answering the question
You are employed as an Enterprise Architect within a multinational company. The company has been very successful and has been buying companies around the world. This has led to a growing number of manufacturing divisions in various locations with a complex supply chain.
The top management recently expressed concerns about the company ' s effectiveness because of its multiple data centers and duplicate applications. The EA team has been working on a project to solve this issue. An analysis shows that supply chain issues have led to not enough products being produced to meet all the customer demand.
A strategic architecture has been defined to help meet customer demand and manage the supply chain more effectively. The strategic architecture involves combining different Enterprise Resource Planning (ERP) applications that are currently used separately in the company ' s production sites.
Each division has finished the Architecture Definition documentation to address their own specific manufacturing needs. The Enterprise Architects have agreed an overall strategy for the migration. They have defined a set of work packages that address the gaps found. They have defined the intermediate architectural states between the Baseline and Target architecture to add a new ERP environment into the company.
Because of the risks posed by this change from the current environment, the architects have recommended that a phased approach should be taken to implement the target architecture with several stages of change. They have created a draft roadmap with the implementation process estimated to take over two years.
The company has an established Enterprise Architecture (EA) practice and follows the TOGAF Architecture Development Method. The company also uses various management frameworks such as business planning, project/portfolio management, and operations management. The EA program is sponsored by the Chief Information Officer (CIO). In your role as an Enterprise Architect within the EA team, you work closely with the important stakeholders from the various divisions within the company.
Refer to the scenario
You have been assigned to plan the next steps for the migration. Which approach will you choose?
Based on the TOGAF standard which of the following is the best answer?

• A. You will focus on project selection. You make sure that the Implementation andMigration plan aligns with the other management frameworks in use in thecompany. Next, you assign a value to each work package, taking into accountthe resources available and how they fit into the overall strategy. Using thesework packages, you estimate resource requirements and timings. You thenselect which projects will be included in the Implementation and Migration Plan.
• B. You finalize the Architecture Definition documentation with updates to reflectthe implementation approach. You ensure that Implementation and MigrationPlan is consistent with the chosen approach.
  You identify the resourcesneeded to undertake the development projects. You would then produce anImplementation Governance Model to manage the lessons learned beforefinishing the plan. You ensure that the lessons learned are applied to theImplementation and Migration Plan.
• C. You estimate the business value for each project by applying the BusinessValue Assessment Technique to prioritize the migration projects and projectsteps. The assessment should focus on return on investment and criteria forevaluating performance to track the progress of the architecturetransformation. You would confirm and plan a series of Transition Architecturephases using a table of Architecture Definition Increments that lists theprojects. You then update the Implementation and Migration Plan.
• D. You conduct a series of Compliance Assessments to check that thearchitecture is being implemented as required by the contract. This is donenow to confirm that the implementation team is following the correctdevelopment process, and if not, so course correction is viable. This involvesusing monitoring tools and making sure that performance targets are beingachieved. If the targets are not met, you would then need to make adjustmentsto the performance requirements and update them in the Implementation andMigration Plan.

Please read this scenario prior to answering the question
Your role is that of a senior architect, reporting to the Chief Enterprise Architect, at a medium-sized company with 400 employees. The nature of the business is such that the data and the information stored on the company systems is their major asset and is highly confidential.
The company employees travel extensively for work and must communicate over public infrastructure using message encryption, VPNs, and other standard safeguards. The company has invested in cybersecurity awareness training for all its staff. However, it is recognized that even with good education as well as system security, there is a dependency on third-parly suppliers of infrastructure and software.
The company uses the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice. The CTO is the sponsor of the activity.
The Chief Security Officer (CSO) has noted an increase in ransomware (malicious software used in ransom demands) attacks on companies with a similar profile. The CSO recognizes that no matter how much is spent on education, and support, it is likely just a matter of time before the company suffers a significant attack that could completely lock them out of their information assets.
A risk assessment has been done and the company has sought cyber insurance that includes ransomware coverage. The quotation for this insurance is hugely expensive. The CTO has recently read a survey that stated that one in four organizations paying ransoms were still unable to recover their data, while nearly as many were able to recover the data without paying a ransom. The CTO has concluded that taking out cyber insurance in case they need to pay a ransom is not an option.
Refer to the scenario
You have been asked to describe the steps you would take to improve the resilience of the current architecture?
Based on the TOGAF standard which of the following is the best answer?

• A. You would request an Architecture Compliance Review with the scope to examine the company ' s resilience to ransomware attacks. You would identify the departments involved and have them nominate representatives. You would then tailor checklists to address the requirement for increased resilience. You would circulate to the nominated representatives for them to complete. You would then review the completed checklists, identifying and resolving issues. You would then determine and present your recommendations.
• B. You would ensure that the company has in place up-to-date processes for managing change to the current Enterprise Architecture. Based on the scope of the concerns raised you recommend that this be managed at the infrastructure level. Changes should be made to the baseline description of the Technology Architecture. The changes should be approved by the Architecture Board and implemented by change management techniques.
• C. You would monitor for technology changes from your existing suppliers that could improve resilience.
  You would prepare and run a disaster recovery planning exercise for a ransomware attack and analyze the performance of the current Enterprise Architecture. Using the findings, you would prepare a gap analysis of the current Enterprise Architecture. You would prepare change requests to address identified gaps. You would add the changes implemented to the Architecture Repository.
• D. You would determine business continuity requirements, and undertake a gap analysis of the current Enterprise Architecture. You would make recommendations for change requirements to address the situation and create a change request. You would manage a meeting of the Architecture Board to assess and approve the change request. Once approved you would produce a new Request for Architecture Work to activate an ADM cycle to carry out a project to define the change.

You are working as an Enterprise Architect within the Enterprise Architecture (EA) team at a healthcare and life sciences company. The EA team is developing a secure system for researchers to share clinical trial information easily across the organization and with external partners.
Due to the highly sensitive nature of the information, each architecture domain must consider privacy and safety concerns. The healthcare division has been directed to minimize disruptions to clinical trials while introducing the new system gradually.
How would you identify the work packages for introducing the new system? Based on the TOGAF standard, which of the following is the best answer?

• A. Use a Consolidated Gaps, Solutions, and Dependencies Matrix to classify each solution, group them into work packages, then regroup into Capability Increments. Document in an Architecture Definition Increments Table.
• B. Use a Consolidated Gaps, Solutions, and Dependencies Matrix to create work packages and sequence them into Capability Increments. Document in a Transition Architecture State Evolution Table.
• C. Draw up an Implementation Factor Catalog to indicate actions and constraints. Use a Consolidated Gaps, Solutions, and Dependencies Matrix, then group similar activities into work packages and identify dependencies.
• D. Identify Solution Building Blocks for development or procurement, then use a CRUD matrix to rank and select the most cost-effective work packages. Schedule the rollout sequentially across regions.

Please read this scenario prior to answering the question
You are employed as an Enterprise Architect at a technology company, reporting directly to the Chief Enterprise Architect. The company supplies personnel and delivers cloud- based solutions to numerous government agencies.
The nature of the business is such that the data and the information stored on the company systems is the company ' s major asset and is highly confidential. The company employees work remotely and need constant access to the company systems, which is done by the public infrastructure. They use message encryption, secure internet connections using Virtual Private Networks (VPNs), and other standard security measures. The company provides computer security awareness training for all its staff.
The Chief Security Officer (CSO) has noted an increase in distributed denial of service (DDoS) attacks on companies with a similar profile. The CSO understands that even with thorough preparation, a major attack could stop employees from being able to do their jobs. This could lead to a large financial loss, damage to the company ' s reputation with customers, and employees being unable to work.
A risk assessment has been completed and the company has looked for cyber insurance that covers such attacks. The price for this insurance is very high. The CTO has decided not to get cyber insurance to cover such attacks.
The company follows the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice. The Chief Technology Officer (CTO) is the sponsor of the activity. The practice uses an iterative approach for its architecture development.
This has enabled the decision makers to gain valuable insights into the different aspects of the business Please read this scenario prior to answering the question You have been asked to describe the steps you would take to strengthen the current architecture to improve data protection.
Based on the TOGAF standard which of the following is the best answer?

• A. You would hold an Architecture Compliance Review with the scope to examinethe company ' s ability to respond to such attacks. You would identify thedepartments involved and have them nominate representatives. You wouldthen tailor checklists to address the requirement for increased businesscontinuity and resilience. You would circulate the checklists to the nominatedrepresentatives for them to complete. You would review the completedchecklists, identifying and resolving issues. You would then determine andpresent your recommendations to the Architecture Board.
• B. You would run a planning exercise to assess the business continuityrequirements and analyze the current Enterprise Architecture for gaps. Youcreate a formal change request related to business resilience and maintainingcritical business functions. You would arrange a meeting of the ArchitectureBoard to assess and approve the change request. Once approved you wouldcreate a new Request for Architecture Work to begin an ADM cycle toimplement the changes.
• C. You would request technology updates from existing suppliers that improve thecompany ' s capabilities to detect, react, and recover from an incident. Youwould run a simulated ransomware attack to evaluate the current EnterpriseArchitecture ' s resilience and recovery capabilities. Using the findings, youwould perform a gap analysis of the current Enterprise Architecture, andprepare change requests to address identified gaps. You would document thechanges implemented and add to the Architecture Repository.
• D. You would ensure that business value and cost of continuity measures areunderstood by key stakeholders, and that the company has in place up-to-dateprocesses for managing change to the current Enterprise Architecture. Yourecommend that DDoS mitigation be addressed at the infrastructure level toensure effective, scalable protection. Changes should be made to the baselinedescription of the Technology Architecture. The changes should be approvedby the Architecture Board and implemented by change managementtechniques.

Please read this scenario prior to answering the question
You are working as the Chief Enterprise Architect within a law firm specializing in personal injury cases.
Many of the firm ' s competitors have improved their litigation strategies, and efficiency by streamlining their processes using Artificial Intelligence {Al).
The CIO has approved a Request for Architecture Work to examine the use of Machine Learning in defining a new Al-driven litigation and finance process for the firm. This process would instruct the lawyers and analysts as to what tasks and portfolio they should work on. The key objectives are to increase task profitability, maximize staff utilization, and increase individual profitability.
The CIO has emphasized that the architecture should enable the fast implementation of continuous Machine Learning. The solution will need to be constantly measured for delivered value and be quickly iterated to success.
Some of the partners have expressed concerns about letting the Al make the decisions, others about the risks associated with use of it for the type of service they deliver. The CIO wants to know if these concerns can be addressed, and how risks will be covered by a new architecture enabling Al and Machine Learning.
Refer to the scenario
You have been asked to respond to the CIO recommending an approach that would enable the development of an architecture that addresses the concerns of the CIO and the concerns of the partners.
Based on the TOGAF standard which of the following is the best answer?

• A. You recommend that all possible models be created for each candidate architecture that will enable the Al and Machine Learning solution. This ensures that all the necessary data and detail is addressed. A formal review should be held with the stakeholders to verify that their concerns have been properly addressed by the models. Agility will be considered during Phase G Implementation Governance.
• B. You recommend that an analysis of the stakeholders is undertaken resulting in documenting the stakeholders and their concerns in a Stakeholder Map. The concerns and relevant views should then be defined for each group and recorded in the Architecture Vision document. The requirements will include risk mitigation through regular assessments. This will also allow a supervised agile implementation of the continuous Machine Learning.
• C. You recommend that a Communications Plan be created to address the key stakeholders, the most powerful and influential partners. This plan should include a report that summarizes the key features of the architecture reflecting their requirements. You will check with each key stakeholder that their concerns are being addressed. Risk mitigation and agility will be explicitly addressed as a component of the architecture being developed.
• D. You recommend creation of a set of business models that can be applied uniformly across all architecture projects. The stakeholders will be trained to understand the business models to ensure they can see that their concerns are being addressed. Risk will be addressed once the Security Architecture is developed, which will happen later to avoid slowing down the agility required by the CIO.