INT 6200 Module 1 Knowledge Check |
Questions and Answers | 2026 Updated |
100% Correct.
1. A multinational retailer is consolidating 14 regional ERP instances into a single
global platform. Leadership wants a framework that explicitly separates 'why, how,
what, who, where, and when' architectural artifacts so that each stakeholder group
can be mapped to a distinct cell. Which framework is BEST suited to this
requirement?
A. TOGAF Architecture Development Method (ADM)
B. The Zachman Framework
C. ITIL 4 Service Value Chain
D. NIST Cybersecurity Framework 2.0
Answer: B. The Zachman Framework
Rationale: The Zachman Framework is a taxonomy that organizes architectural artifacts
by interrogatives (what, how, where, who, when, why) and stakeholder perspectives, making
it ideal for mapping stakeholders to distinct cells. TOGAF ADM is a process methodology,
not an interrogative taxonomy; ITIL 4 addresses service management; NIST CSF 2.0
addresses cybersecurity risk, not architectural artifact classification.
2. During a data governance assessment, an analyst discovers that the 'customer
lifetime value' metric is calculated differently by Marketing, Finance, and Sales.
Which DAMA-DMBOK data management knowledge area PRIMARILY governs
resolving this inconsistency?
A. Data Storage and Operations
B. Data Security
C. Data Architecture
D. Data Governance
Answer: D. Data Governance
Rationale: Data Governance is the DAMA-DMBOK knowledge area responsible for
defining policies, standards, and decision rights-including metric definitions and business
glossary ownership-that eliminate conflicting calculations across domains. Data Storage
and Operations handles physical persistence, Data Security handles protection, and Data
Page 1 of 51
,Architecture defines structural blueprints, none of which resolve definitional conflicts.
Page 2 of 51
,3. An organization must deploy a workload that processes protected health
information and requires the highest level of isolation, customer-managed encryption
keys, and dedicated hardware. Which cloud deployment model BEST satisfies these
requirements?
A. Public cloud, multi-tenant IaaS
B. Community cloud with shared tenancy
C. Private cloud (single-tenant) with customer-managed HSM
D. Hybrid cloud using public PaaS for the workload
Answer: C. Private cloud (single-tenant) with customer-managed HSM
Rationale: A single-tenant private cloud with customer-managed hardware security
modules (HSM) provides the isolation and key control required for regulated PHI
workloads. Public multi-tenant and community clouds share infrastructure, and public
PaaS abstracts key management, all of which fail the isolation and key-control
requirements.
4. In ITIL 4, a service desk agent receives a report that the payroll application is
unavailable for all users. According to the service value chain, which activity should
be engaged FIRST to restore service?
A. Plan
B. Engage
C. Obtain/Build
D. Deliver and Support
Answer: D. Deliver and Support
Rationale: The 'Deliver and Support' value chain activity encompasses incident
management and service restoration, which is the immediate priority when a live service is
down. 'Engage' handles stakeholder interaction, 'Plan' sets strategy, and 'Obtain/Build'
creates new components-none of which directly restores an unavailable production service.
Page 3 of 51
, 5. An organization is mapping controls to NIST CSF 2.0. The newly added 'Govern'
function primarily addresses which of the following?
A. Detecting anomalous network traffic
B. Establishing cybersecurity risk strategy, roles, and policy
C. Restoring systems after a ransomware event
D. Identifying assets and vulnerabilities
Answer: B. Establishing cybersecurity risk strategy, roles, and policy
Rationale: NIST CSF 2.0 introduced the Govern (GV) function to address organizational
cybersecurity strategy, risk appetite, roles, responsibilities, and policy-the 'how we manage'
layer. Detection, recovery, and identification correspond to the Identify, Detect, and
Recover functions, not Govern.
6. A U.S. company collects personal data from EU residents and also from California
residents. To satisfy both GDPR and CCPA/CPRA with a single operational process,
which mechanism BEST addresses the 'right to deletion' for both regimes?
A. Maintaining a 7-year immutable data retention policy
B. Implementing a verifiable consumer request workflow with downstream processor
notifications
C. Relying solely on consent banners at the point of collection
D. Encrypting all personal data at rest and claiming exemption
Answer: B. Implementing a verifiable consumer request workflow with downstream
processor notifications
Rationale: Both GDPR Article 17 and CCPA/CPRA grant deletion rights that require a
verifiable request intake process and propagation of deletion to downstream processors
and third parties. A long retention policy conflicts with deletion rights, consent banners do
not fulfill deletion requests, and encryption does not extinguish the legal obligation to
delete.
Page 4 of 51
Questions and Answers | 2026 Updated |
100% Correct.
1. A multinational retailer is consolidating 14 regional ERP instances into a single
global platform. Leadership wants a framework that explicitly separates 'why, how,
what, who, where, and when' architectural artifacts so that each stakeholder group
can be mapped to a distinct cell. Which framework is BEST suited to this
requirement?
A. TOGAF Architecture Development Method (ADM)
B. The Zachman Framework
C. ITIL 4 Service Value Chain
D. NIST Cybersecurity Framework 2.0
Answer: B. The Zachman Framework
Rationale: The Zachman Framework is a taxonomy that organizes architectural artifacts
by interrogatives (what, how, where, who, when, why) and stakeholder perspectives, making
it ideal for mapping stakeholders to distinct cells. TOGAF ADM is a process methodology,
not an interrogative taxonomy; ITIL 4 addresses service management; NIST CSF 2.0
addresses cybersecurity risk, not architectural artifact classification.
2. During a data governance assessment, an analyst discovers that the 'customer
lifetime value' metric is calculated differently by Marketing, Finance, and Sales.
Which DAMA-DMBOK data management knowledge area PRIMARILY governs
resolving this inconsistency?
A. Data Storage and Operations
B. Data Security
C. Data Architecture
D. Data Governance
Answer: D. Data Governance
Rationale: Data Governance is the DAMA-DMBOK knowledge area responsible for
defining policies, standards, and decision rights-including metric definitions and business
glossary ownership-that eliminate conflicting calculations across domains. Data Storage
and Operations handles physical persistence, Data Security handles protection, and Data
Page 1 of 51
,Architecture defines structural blueprints, none of which resolve definitional conflicts.
Page 2 of 51
,3. An organization must deploy a workload that processes protected health
information and requires the highest level of isolation, customer-managed encryption
keys, and dedicated hardware. Which cloud deployment model BEST satisfies these
requirements?
A. Public cloud, multi-tenant IaaS
B. Community cloud with shared tenancy
C. Private cloud (single-tenant) with customer-managed HSM
D. Hybrid cloud using public PaaS for the workload
Answer: C. Private cloud (single-tenant) with customer-managed HSM
Rationale: A single-tenant private cloud with customer-managed hardware security
modules (HSM) provides the isolation and key control required for regulated PHI
workloads. Public multi-tenant and community clouds share infrastructure, and public
PaaS abstracts key management, all of which fail the isolation and key-control
requirements.
4. In ITIL 4, a service desk agent receives a report that the payroll application is
unavailable for all users. According to the service value chain, which activity should
be engaged FIRST to restore service?
A. Plan
B. Engage
C. Obtain/Build
D. Deliver and Support
Answer: D. Deliver and Support
Rationale: The 'Deliver and Support' value chain activity encompasses incident
management and service restoration, which is the immediate priority when a live service is
down. 'Engage' handles stakeholder interaction, 'Plan' sets strategy, and 'Obtain/Build'
creates new components-none of which directly restores an unavailable production service.
Page 3 of 51
, 5. An organization is mapping controls to NIST CSF 2.0. The newly added 'Govern'
function primarily addresses which of the following?
A. Detecting anomalous network traffic
B. Establishing cybersecurity risk strategy, roles, and policy
C. Restoring systems after a ransomware event
D. Identifying assets and vulnerabilities
Answer: B. Establishing cybersecurity risk strategy, roles, and policy
Rationale: NIST CSF 2.0 introduced the Govern (GV) function to address organizational
cybersecurity strategy, risk appetite, roles, responsibilities, and policy-the 'how we manage'
layer. Detection, recovery, and identification correspond to the Identify, Detect, and
Recover functions, not Govern.
6. A U.S. company collects personal data from EU residents and also from California
residents. To satisfy both GDPR and CCPA/CPRA with a single operational process,
which mechanism BEST addresses the 'right to deletion' for both regimes?
A. Maintaining a 7-year immutable data retention policy
B. Implementing a verifiable consumer request workflow with downstream processor
notifications
C. Relying solely on consent banners at the point of collection
D. Encrypting all personal data at rest and claiming exemption
Answer: B. Implementing a verifiable consumer request workflow with downstream
processor notifications
Rationale: Both GDPR Article 17 and CCPA/CPRA grant deletion rights that require a
verifiable request intake process and propagation of deletion to downstream processors
and third parties. A long retention policy conflicts with deletion rights, consent banners do
not fulfill deletion requests, and encryption does not extinguish the legal obligation to
delete.
Page 4 of 51
