The Open Group · TOGAF-RS
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture Practice Tests
This credential validates an individual's understanding of essential security and risk concepts in relation to the TOGAF® Architecture Development Method (ADM), including Enterprise Risk Management (ERM), Information Security Management (ISM), and Enterprise Security Architecture (ESA). It demonstrates knowledge of how IT security and risk standards such as ISO/IEC 27000, ISO 31000, and COBIT relate to the TOGAF standard.
Exam Details
Practice Questions
600
≈ 10 practice exams
Duration
180 minutes
Passing Score
Pass/Fail
Difficulty
FoundationalLast Updated
Jun 2026
Topics Covered
Security and Risk Concepts in TOGAF ADMEnterprise Security Architecture (ESA)Enterprise Risk Management (ERM)Information Security Management (ISM)IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT)Security as a Cross-Cutting ConcernTOGAF Architecture Content Metamodel and ISM/ERM Relationships
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture Practice Exam Preparation
Use this TOGAF-RS practice exam to prepare for The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture with realistic questions, detailed explanations, and focused study modes. The practice bank includes 600 questions for The Open Group TOGAF-RS, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Security and Risk Concepts in TOGAF ADM, Enterprise Security Architecture (ESA), Enterprise Risk Management (ERM), Information Security Management (ISM), and IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT). Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture is an awareness-level credential that validates foundational knowledge of how security and risk management integrate with the TOGAF® Architecture Development Method (ADM). It demonstrates that the holder understands the essential concepts of Enterprise Security Architecture (ESA), Enterprise Risk Management (ERM), and Information Security Management (ISM), and knows how these disciplines relate to each phase and artifact of the TOGAF ADM. The credential is part of the broader TOGAF Certification Portfolio built upon the TOGAF Standard, 10th Edition, and is designed to establish a common language between Security Architects and Enterprise Architects when developing risk-aware enterprise architectures.
The certification also covers how major IT security and risk standards — specifically the ISO/IEC 27000 family of standards, ISO 31000, and COBIT® — relate to and complement the TOGAF standard. Candidates learn why security and risk management must be treated as cross-cutting concerns that span the entire enterprise architecture lifecycle rather than being addressed in isolated phases. The credential is structured as a compact learning credential requiring approximately three hours of study, making it accessible as a standalone qualification or as a complement to broader TOGAF Enterprise Architecture certifications.
Who Should Take This Exam
This credential is designed for professionals who need a structured, foundational understanding of security and risk concepts in the context of enterprise architecture. Primary audiences include Enterprise Architects who want to incorporate security and risk practices into their TOGAF ADM work, Security Architects seeking to align their practice with enterprise architecture frameworks, and IT risk and compliance professionals who collaborate with architecture teams. It is equally relevant for individuals working with governance frameworks such as COBIT or standards like ISO/IEC 27001 and ISO 31000 who need to understand how these standards interact with the TOGAF methodology.
Because the credential is at the awareness level with no prerequisites, it is well-suited to those who are early in their enterprise architecture or security architecture careers, as well as experienced practitioners expanding their knowledge into adjacent disciplines. Program managers, IT auditors, and CISOs who need to communicate with architecture teams or evaluate security architecture outputs will also find the credential valuable.
Prerequisites
There are no formal prerequisites to sit for this credential. Candidates are not required to hold any prior TOGAF certification, though familiarity with the basic concepts of the TOGAF ADM — such as the architecture phases (Preliminary through Architecture Change Management) and core TOGAF terminology — will help candidates contextualize the security and risk content more effectively. No prior security certifications are required.
In practice, candidates will benefit from some exposure to enterprise IT environments and a general awareness of IT governance concepts. Those with experience in security operations, IT risk management, or enterprise architecture will find the material more immediately applicable. The Open Group offers a self-study option through its learning management system for candidates who wish to build prerequisite TOGAF knowledge before attempting this credential.
Exam Format
The assessment for this credential is delivered either through an Accredited Training Course (ATC) provider — in which case the assessment format is at the provider's discretion — or through The Open Group's own self-study online learning option, which includes a built-in assessment. The self-study path is available through The Open Group's online shop and learning management system. The credential requires a minimum of three hours of learning to be completed before the assessment is attempted. The Open Group awards a digital Open Badge via Credly and a certificate upon successful completion.
Where scenario-based questions are used, as is common across the TOGAF Certification Portfolio, each question presents a real-world scenario with four possible answers ranked from best to worst. Under this model, the best answer earns 5 points, the second-best 3 points, the third-best 1 point, and the worst answer 0 points. Specific details such as the total number of questions and a published numeric passing score are not publicly disclosed by The Open Group for this credential; candidates should confirm the precise assessment parameters with their chosen training provider or The Open Group's official exam portal. The overall credential is classified as a pass/fail award.
Skills Measured
- 1.Security and Risk Concepts in the TOGAF ADM: Understanding the essential principles of security and risk and how they map to each phase of the TOGAF Architecture Development Method, including how risk and security considerations are introduced, maintained, and governed throughout the architecture lifecycle.
- 2.Enterprise Security Architecture (ESA): Knowledge of what ESA is, how it is defined within the context of TOGAF, and how security architecture artifacts are developed, positioned, and maintained as part of an overall enterprise architecture practice.
- 3.Enterprise Risk Management (ERM): Understanding ERM concepts, including risk identification, assessment, and treatment approaches, and how ERM frameworks are applied within and aligned to the TOGAF ADM phases and architecture governance structures.
- 4.Information Security Management (ISM): Knowledge of ISM principles and how information security management functions relate to and integrate with TOGAF architecture development, including the roles of policies, controls, and management systems.
- 5.IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT): Understanding how the ISO/IEC 27000 family of information security standards, the ISO 31000 risk management standard, and the COBIT governance framework relate to and complement the TOGAF standard.
- 6.Security as a Cross-Cutting Concern: Understanding why security and risk management must be treated as concerns that span all architecture domains (Business, Data, Application, Technology) and all ADM phases rather than being addressed only within the Technology Architecture.
- 7.TOGAF Architecture Content Metamodel and ISM/ERM Relationships: Knowledge of how the TOGAF Architecture Content Metamodel relates to Information Security Management and Enterprise Risk Management, including which metamodel entities and relationships are relevant to security and risk artifacts.
Study Tips
- Use The Open Group's official self-study online course as your primary resource — it was authored to align precisely with the credential's learning outcomes and includes built-in quiz questions that mirror the assessment style.
- Download and read the official publication 'Integrating Risk and Security within a TOGAF® Enterprise Architecture' (Open Group document G152), which is the authoritative reference text for all topics covered in this credential.
- Map each chapter of G152 to a specific ADM phase and practice explaining how security and risk concerns are addressed in that phase — this reinforces the cross-cutting nature of security and helps anchor abstract concepts to familiar TOGAF structures.
- Study the relationship table between the TOGAF Architecture Content Metamodel and ISM/ERM concepts specifically, as this is a distinct knowledge area that candidates without a strong TOGAF background often underestimate.
- Review the key definitions and scope of ISO/IEC 27001, ISO 31000, and COBIT side by side, then practice articulating how each standard's concepts (e.g., risk appetite, information security controls, governance objectives) are referenced or incorporated within the TOGAF ADM.
- If you do not already hold a TOGAF Foundation certification, spend time reviewing the TOGAF ADM phase objectives and key deliverables before beginning this credential's material, as the course assumes baseline familiarity with TOGAF terminology.
- Practice with scenario-based questions if available from your ATC provider, focusing on selecting the 'best' architectural response to a security or risk situation rather than a technically correct but architecturally misaligned answer — the partial-credit scoring model rewards nuanced judgment.
Career Benefits
Earning this credential signals to employers that an architect or security professional understands how to embed risk and security thinking into enterprise architecture work from the outset, rather than treating them as compliance afterthoughts. It is particularly valued in organizations that have adopted TOGAF as their architecture framework and are seeking to align security governance with frameworks like ISO/IEC 27001 or COBIT. Roles that benefit directly from this credential include Enterprise Architect, Security Architect, IT Risk Manager, IT Governance Analyst, and Information Security Manager. Because it is an awareness-level credential, it is often pursued alongside or as preparation for higher-level TOGAF certifications rather than as a standalone career milestone.
The credential carries one point in The Open Group's TOGAF Certification Portfolio, contributing to broader TOGAF professional recognition. While salary data specific to this credential is not published, professionals who combine TOGAF certification with security and risk specialization are well positioned for senior architecture and governance roles. Industry demand for architects who can speak fluently across security, risk, and enterprise architecture continues to grow, particularly in regulated sectors such as financial services, healthcare, and government, where risk-aware architecture is a compliance requirement.
Sample Questions
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 10 full-length practice exams.
Preview — answers shown1. A risk engineer at Northwind Energy is conducting a formal risk assessment of a critical industrial control system used to manage natural gas compression. The assessment team needs to systematically identify every possible way the compression control system could fail, evaluate the severity and likelihood of each failure mode, and determine how each failure would affect downstream pipeline operations. Which IEC 31010 risk assessment technique is most appropriate for this structured, component-by-component failure analysis? (Select one!)
ABow-tie analysis
BDelphi technique
CMonte Carlo simulation
DFailure Mode and Effects Analysis (FMEA)
Explanation
Failure Mode and Effects Analysis (FMEA) is specifically designed for systematic identification of all possible failure modes within a system, assessment of the likelihood and severity of each failure, and determination of the downstream effects on connected components and operations. It is particularly well-suited for complex industrial control systems requiring comprehensive component-by-component analysis. The Delphi technique is a consensus-based expert judgment method used for gathering and converging structured expert opinions, not for systematic component failure analysis. Bow-tie analysis visualizes pathways from identified threat events through to consequences and is better suited for analyzing specific already-identified risk scenarios rather than comprehensively discovering all possible failure modes. Monte Carlo simulation applies probabilistic modeling to assess aggregate impacts across multiple risk variables and is not used for structural failure mode identification across individual components.
2. Litware Capital is evaluating whether to launch a new open banking platform that requires sharing customer financial transaction data with licensed third-party fintech application providers. The security team argues that the data sharing introduces unacceptable information security risks and recommends against the platform. The business development team insists the platform is essential for competitive survival and compliance with open banking regulatory mandates. How should an enterprise architect, guided by G152 principles, frame security's role in this architectural decision? (Select one!)
ABusiness revenue and open banking regulatory compliance objectives should take precedence over security concerns when the platform delivers measurable competitive and compliance advantages to the organization
BThe security architecture assessment should be deferred until the open banking business model and third-party contractual terms have been fully finalized by the business development team
CSecurity requirements should be presented as absolute constraints that block the open banking platform until every identified data sharing risk has been fully eliminated before proceeding
DSecurity should function as both a driver that governs the risks of sharing customer transaction data and an enabler that builds the trust infrastructure making the fintech partnership model commercially viable
Explanation
G152 establishes that security serves a dual role within enterprise architecture, functioning simultaneously as a driver and as an enabler. As a driver, security imposes necessary constraints to manage the real risks of sharing sensitive customer transaction data with external parties, addressing regulatory data protection obligations, breach notification requirements, and threat landscape pressures. As an enabler, security creates the consent mechanisms, technical safeguards, and trust infrastructure that make the open banking partnership model trustworthy and therefore commercially viable, directly facilitating new digital business models and competitive positioning. Presenting security as an absolute blocker requiring elimination of all risk before proceeding ignores the enablement dimension and contradicts G152's principle that security controls should be proportionate to risk rather than an unconditional veto on business activity. Deferring security assessment until business and contractual terms are finalized directly contradicts G152's instruction that security is a cross-cutting concern integrated from the earliest architecture phases, not a sequential review appended after business decisions have already been made. Subordinating security entirely to business objectives disregards the legitimate risk management obligations and stakeholder trust responsibilities that protect both the organization and its customers.
3. The security architect at Fabrikam Bank is contributing to a Phase A (Architecture Vision) engagement within the TOGAF ADM. The architecture team asks which activities the security architect should perform specifically during this phase. Which two activities represent the appropriate security architect contributions in Phase A? (Select two!)
Multiple correct answersADefine detailed security controls and technical specifications to populate the target-state security architecture
BIdentify and engage security-relevant stakeholders including the CISO, risk management, compliance, and business unit security contacts
CDevelop a high-level security vision statement that aligns security strategic direction with the stated business goals and requirements
DFinalize the organization's risk appetite statement and complete the security principles catalog for board endorsement
EConduct a full vulnerability assessment and gap analysis of the current-state security architecture
Explanation
Phase A (Architecture Vision) is the stage in the TOGAF ADM where high-level scope, stakeholders, and strategic direction are established. The security architect's appropriate contributions at this phase are identifying security-relevant stakeholders and articulating a high-level security vision aligned with business objectives. Stakeholder identification in Phase A must include the CISO and security leadership, risk management, compliance and legal functions, and business unit contacts whose security requirements will shape subsequent architecture work. The security vision provides the strategic direction for security integration throughout all remaining ADM phases. Defining detailed security controls and technical specifications belongs to Phase C (Information Systems Architecture) and Phase D (Technology Architecture), which operate at significantly greater levels of design detail than Phase A. The risk appetite statement and security principles catalog are Preliminary Phase deliverables established before any ADM cycle phases begin, not activities that occur within Phase A. A full vulnerability assessment and current-state gap analysis is more appropriate to Phase B (Business Architecture) or the current-state analysis conducted progressively through Phases B to D.
4. During a TOGAF ADM program kickoff at Fabrikam Global Services, the architecture governance board asks when Security Principles should be formally established and what components each principle must contain to be complete. A junior architect proposes that Security Principles should be deferred to Phase B when sufficient business context has been documented to make them meaningful. According to G152, which two statements are correct regarding Security Principles? (Select two!)
Multiple correct answersASecurity Principles are established during the Preliminary Phase, before ADM cycle phases begin, so they govern all subsequent architecture work from inception
BSecurity Principles are established during Phase A (Architecture Vision) to ensure they are directly aligned with the specific business case and stakeholder concerns being addressed
CEach Security Principle must contain four components: Name, Statement, Rationale, and Implications
DEach Security Principle requires only a Name and a Statement; rationale and implications are documented separately within the Architecture Requirements Specification
ESecurity Principles are established during Phase B (Business Architecture) to ensure they are grounded in fully documented business requirements and process models
Explanation
Security Principles are established in the Preliminary Phase, not during Phase A or Phase B. The Preliminary Phase sets the foundational governance framework for the entire ADM cycle, including all architecture principles that will guide every subsequent phase. Establishing security principles before ADM cycle phases begin ensures they constrain and inform architectural decisions from the outset rather than being applied retroactively. Each security principle must contain four mandatory components: Name (a short, memorable label), Statement (a declarative assertion of the principle's rule), Rationale (the business and risk justification for the principle), and Implications (the requirements and consequences the principle creates for architecture and the organization). Deferring security principles to Phase A or Phase B would mean that initial architecture vision and business architecture work proceeds without security governance in place, increasing the likelihood of misaligned decisions and costly corrections. Omitting rationale and implications from each principle would undermine its usefulness as a governance tool, as stakeholders need to understand why a principle exists and what it demands of the architecture program.
5. Wide World Importers operates a global supply chain and is implementing a new supplier collaboration portal that enables real-time visibility into production schedules and inventory levels across organizational boundaries. The CISO is concerned that aggressive security controls will impede supplier response times and damage business relationships. The architecture team consults G152 to determine the appropriate security design philosophy. Which approach best reflects G152 guidance on this scenario? (Select one!)
ASecurity controls should be maximized across all external information flows to ensure comprehensive protection, accepting that operational efficiency must be subordinated to security requirements
BExternal information flows to suppliers should be restricted to read-only access governed by contractual agreements, with security architecture focused exclusively on protecting internal systems
CThe organization should implement separate security frameworks for internal and external information flows, applying the TOGAF ADM only to internal architecture decisions
DSecurity should enable Boundaryless Information Flow by implementing controls that are proportionate to risk, aligned with business requirements, and transparent so they do not unnecessarily obstruct information sharing
Explanation
G152 explicitly supports The Open Group's vision of Boundaryless Information Flow, which enables information sharing across organizational and geographic boundaries while maintaining appropriate protection. The guiding principle is that security should act as an enabler of business capabilities, not an obstacle. Security controls should be proportionate to the actual risk rather than maximized regardless of operational impact, aligned with business requirements such as supplier collaboration and response-time efficiency, implemented consistently across organizational boundaries, and transparent in operation so they do not create unnecessary friction or harm business relationships. Maximizing controls without regard to proportionality contradicts G152's enablement philosophy and can destroy the business value the architecture is intended to deliver. Restricting external flows to read-only access imposes arbitrary constraints beyond what a risk assessment would warrant. Applying separate frameworks for internal and external architecture introduces the fragmentation that G152 specifically seeks to overcome through integrated EA and security disciplines.
More The Open Group Practice Exams
TOGAF® Business Architecture Foundation (OGBA-101)
OGBA-101 · 600 questions
TOGAF® Enterprise Architecture Foundation (OGEA-101)
OGEA-101 · 600 questions
TOGAF® Enterprise Architecture Part 2 Exam (OGEA-102)
OGEA-102 · 600 questions
TOGAF® Enterprise Architecture Leader
TOGAF EA Leader · 598 questions
TOGAF® Framework Digital Specialist
OG0-DS1 · 598 questions
The Open Group Certified: TOGAF® Framework Agile Specialist
TOGAF-Agile-Specialist · 589 questions
$17.99
One-time access to this exam
600 questions (10 practice exams' worth)
Unlimited timed exam simulations
Or $15/mo for all 253 exams
Detailed explanations
Free preview stays available