QuestionQ23

The TOGAF Standard, Version 9.2

You are acting as the Chief Architect.

You have been asked to recommend the approach to use in the Preliminary Phase to ensure that the Corporate Board’s concern is addressed.

Based on TOGAF 9, which of the following is the best answer?

  • A You evaluate the implications of the Board's concern in terms of regulatory and security policy requirements. You then update the AGEX security policy to reflect the concern, ensuring that this policy is communicated across the organization. You allocate a security architecture team to ensure that security considerations are included in ongoing architecture planning. You then assess the security implications and agreements within the AGEX businesses and their suppliers.
  • B You evaluate the implications of the Board's concern in terms of regulatory requirements and their impact on business goals and objectives. Based on this understanding, you then issue a Request for Architecture Work to commence an architecture development project to develop a solution that will address the Board's concern. You allocate a security architect to oversee the implementation of the solution in the ERP system that is being developed.
  • C You start by clarifying the intent that the Board has for raising this concern. This enables you to understand the implications of the concern in terms of regulatory requirements and the potential impact on current business goals and objectives. You propose that a security architect or security architecture team be allocated to develop comprehensive security architecture.
  • D You evaluate the implications of the Board's concern by examining the potential impacts on business goals and objectives. Based on your understanding, you then update the current AGEX security policy to include an emphasis on the Board's concern. In addition, you allocate a security architect to ensure that security considerations are included in the architecture planning for all domains.
Explanation

The Preliminary Phase establishes the security context and the architecture capability needed to address security concerns. It requires understanding applicable regulatory requirements and their effect on business objectives, then identifying a security architect or security architecture team to develop the comprehensive security architecture. Initiating a specific architecture project or only revising policy is premature or incomplete without first clarifying the concern and establishing the required security capability.

Community Discussion

No comments yet. Be the first to start the discussion!