A newly appointed security manager asks how the organization's enterprise architecture repository can help the information security program. Which answer BEST describes its value?
Select an answer to reveal the explanation.
Short Explanation
An enterprise architecture repository is like a map that shows which roads connect which towns. When you can trace a business process down to the data, apps and servers behind it, you know exactly what's at stake when something breaks. The trap is mistaking it for a vulnerability list or a risk register.
Full Explanation
An enterprise architecture describes the organization in layers, typically business, data or information, application and technology, and the relationships among them. For information security, that layered and connected view is valuable because it shows which applications and technology components support which business processes and which data flows between them. The security manager can use it to identify critical assets, understand dependencies, scope risk assessments and business impact analyses, and evaluate the effect of proposed changes. A vulnerability list is produced by vulnerability management processes and tools; an architecture repository may reference components, but it is not designed to track technical weaknesses or remain current at that level. The repository does not replace a risk register; risks require assessment, ownership, treatment decisions and monitoring that an architecture model does not provide, although the two can be linked. Incident records belong in incident management systems; tracking incidents per application is a separate function with different data and workflow. Exam caveat: the value depends on the repository being maintained; an outdated model can mislead risk scoping. Operational check: confirm that the architecture repository identifies owners and business processes for critical applications and that risk assessments reference it when defining scope.