Free 050-6201-ARCHERASC01 Practice Test Questions and Answers (2026)

In the RSA Archer application layout designer, a tab set is a standard user interface object used to enhance usability and organization. When an application contains a large number of fields, presenting them all on a single, long page can be overwhelming for users. A tab set allows an administrator to group related fields into distinct, logical sections. Each section is displayed on a separate tab, allowing users to easily navigate to the specific information they need without excessive scrolling. This creates a more structured and user-friendly data entry and review experience.

A. A standard tab set is a native, drag-and-drop layout object and does not require the use of custom HTML code for its basic function.
B. The History Log is a system-generated audit trail with its own dedicated interface; its layout is not configured using tab sets on the application record page.
C. Tab sets are a primary UI element for end users. Their purpose is to improve the user experience for everyone, not just for administrative organization.

1. RSA Archer Platform Administrator's Guide, "Managing Applications > Working with Layouts." This chapter describes the available layout objects, explaining that a Tab Set is used to "organize fields and other layout objects into a set of tabs."

2. RSA Archer 6.x: Administration Courseware, "Module 3: Fields, Layouts, and Data Driven Events." The section on layout design demonstrates using tab sets to logically group fields on a record page to improve form organization and usability.

In RSA Archer, calculations are processed on the server side when data is submitted. The primary trigger for a calculation to execute is the creation or saving of a record, provided that at least one of the fields referenced in the calculation formula has been created or modified. This ensures that the calculated value is always up-to-date based on the latest input data. The calculation does not run when a record is merely opened for viewing or when a report is generated.

A. When a report is run: Reports display the currently stored data from records; they do not trigger the record's calculation engine to update values.
B. When a record is opened: Opening a record only retrieves and displays existing data. The calculation engine is not triggered until the record is saved with changes.
C. When a user logs into the system...: A user logging in is a system-level authentication event and has no direct relationship with triggering calculations within specific application records.

1. RSA Archer Platform 6.9 Help Center, "Calculated Fields." The documentation states, "Calculations are processed when a user creates new content or updates existing content. The results of the calculation are stored in the database." This confirms the trigger is on record creation/update (save).

2. RSA Archer 6.x Administration Guide, Chapter: "Application Builder," Section: "Adding a Calculated Field." This section describes the behavior of calculations, noting that they are re-evaluated upon the saving of a record where dependent field values have changed.

IT Security Risk Management (ITSRM) is a governance-focused discipline. Its core capabilities involve establishing a security framework by understanding external obligations (like regulations) and internal directives (policies and standards). These elements provide the context for identifying, assessing, and treating IT security risks. The other options describe related but distinct disciplines such as Business Continuity, Security Operations, or Crisis Management, which are not the primary focus of ITSRM's foundational capabilities.

A. Testing Business Continuity Plans is a core function of Business Continuity Management (BCM), not ITSRM.
B. Detecting and responding to attacks is the domain of Security Operations (SecOps) and Incident Management.
C. Managing Crisis Events falls under Crisis Management or BCM. Plans of Action & Milestones are a result of risk management, not a core capability area itself.

1. RSA Archer IT & Security Risk Management Data Sheet. This official vendor document outlines the solution's capabilities, which include centralizing policy management, linking policies to controls, and assessing compliance against regulations and standards. This directly supports option D.

2. RSA University, RSA Archer 6.x Administration I, Courseware, Module on "Archer Solutions and Use Cases". The course describes the IT & Security Risk Management solution as being focused on establishing a controls framework based on authoritative sources (regulations, standards) and managing policies.

In the RSA Archer security model, groups can be arranged in a hierarchy. The "cascade" option for permissions is used to propagate access rights from a parent group down to all of its child (sub) groups. When an administrator grants a group access to a private field and selects the cascade option, all members of that selected group, as well as all members of any groups nested underneath it, will inherit the permission to access the field.

A. The logic is "OR," not "AND." A user gains access by being in the parent group OR any of its child groups, not both simultaneously.
B. This describes the behavior when the cascade option is not selected. Cascading explicitly extends permissions to child groups.
C. This is an illogical permission scenario. Granting permissions to a parent group would not typically exclude that same group from access.

1. RSA Archer Platform 6.9 Administrator's Guide, Chapter: "Access Control". The guide explains group permissions and cascading, stating that selecting the cascade option applies the given permissions to the selected group and all of its descendant groups in the hierarchy.

2. RSA Archer Platform 6.9 Help Center, "Private Fields". The documentation states, "Select the Cascade checkbox to apply the private field permissions to all child groups of the selected group."

The RSA Archer Public Sector solution is specifically engineered to align with the risk and compliance frameworks mandated for U.S. federal agencies. The cornerstone of these frameworks is the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). NIST Special Publication 800-53 provides the catalog of security and privacy controls that are central to this framework. Therefore, any organization, public or private, that has adopted or is required to comply with NIST SP 800-53 (such as federal contractors or state agencies) will find this solution directly applicable to their needs.

A. The solution is designed for federal standards but is not exclusive to federal organizations; state, local, and commercial entities adopting these standards can also benefit.
C. General vendor management is addressed by the RSA Archer Third Party Governance solution, not specifically the Public Sector solution.
D. Sarbanes-Oxley (SOX) is a financial regulation. While Archer has solutions for SOX, the Public Sector solution is tailored for NIST security frameworks, not financial compliance.

1. RSA Archer Documentation, "RSA Archer Public Sector Use Cases." The documentation states, "The RSA Archer Public Sector solution provides a starting point for your organization to manage risk and compliance with regulations such as the NIST Risk Management Framework." (Accessed via RSA Archer Platform Help).

2. RSA Archer Solution Brief, "RSA Archer for Public Sector." This document outlines the solution's capabilities in addressing the NIST RMF, including Assessment & Authorization (A&A) processes based on controls from NIST SP 800-53.

The Question Library is a centralized application within RSA Archer specifically designed to store, manage, and categorize questions. When administrators build new questionnaires, they can directly import questions from this library. This practice ensures consistency in wording, scoring, and reporting across different assessments. It also streamlines the questionnaire creation process by promoting the reuse of pre-approved questions, which is a core function of the Archer platform's assessment capabilities.

A. Authoritative Sources is an application used to house external documents like regulations and standards, not to store individual questions.
B. Findings is an application used to log and track issues or deficiencies identified during an assessment, not a repository for questions.
D. Manage Questionnaires is the interface for building questionnaires but relies on the Question Library as the source for reusable questions.

RSA Archer Platform 6.9 Help, "Question Library". The documentation states: "The Question Library application provides a centralized repository of questions that can be referenced and reused across multiple questionnaires."

RSA Archer 6.x Associate Exam Preparation Guide, "Domain 3: Archer Applications," Objective 3.2. This guide outlines the function of the Question Library as the central repository for questions used in questionnaires.

The Tasks pane on a Task-Driven Landing Page is populated by the "My Tasks" iView. This component is designed to show a user their assigned, open tasks. To ensure performance and usability, it displays a configurable number of the most recent tasks. An administrator sets the maximum number of records that can appear in this view, and the tasks are sorted by date to show the most relevant items first.

A. This describes the functionality for creating or assigning tasks, which is done within a record or application, not from the landing page's task display pane.
C. The pane specifically shows open, actionable tasks assigned to the user, not all recently edited records, which would include irrelevant statuses like "Closed".
D. The number of records is not fixed at 25; it is administrator-configurable. Also, closed tasks are typically filtered out, not shown in a collapsed section.

1. RSA Archer Platform 6.9 Help Center, "My Tasks iView". The documentation states, "The My Tasks iView displays the top x number of open tasks, sorted by date. The administrator defines the maximum number of records that can appear in the iView."

Data-Driven Events (DDEs) in RSA Archer are designed to create a dynamic user experience by altering the layout or triggering actions based on user input in specific fields. Available actions include making fields required or read-only, showing or hiding layout objects, filtering values lists, and triggering email notifications. However, DDEs are not designed to perform destructive data operations. Deleting a record is a significant, permanent action that is controlled by user permissions and specific platform features (e.g., data feeds, archival, manual deletion), not by a conditional UI event.

B. Generate an email notification: This is a standard action available in Data-Driven Events, used to alert users when specific data conditions are met on a record.
C. Make a field conditionally required: This is a primary function of Data-Driven Events, allowing for dynamic forms where fields become mandatory based on other selections.
D. Populate a values list with a selected value: DDEs can apply filters to Values Lists, effectively populating them with specific values based on user interaction with another field.

RSA Archer Platform 6.x Help, "Data-Driven Events." This section details the available actions for DDEs, which include "Set Required Level," "Set Read-Only State," and "Send Notification," but does not list any record deletion capability.

RSA Archer 6.x Control Panel Guide, "Events." The guide outlines the configuration and capabilities of events, focusing on UI changes and notifications, not data deletion.

In RSA Archer, the "Trending" option allows administrators to track and report on the historical changes of a field's value over time. This feature is available for specific field types that contain structured, reportable data. The IP Address field type is one such field where enabling trending is a standard configuration option. This is crucial for tracking configuration changes on assets. While other field types also support trending, IP Address is a correct choice among the given options.

B. Values List: While Values List fields do support trending, the question is presented in a single-choice format. In many contexts, IP Address is a fundamental, structured data type for which trending is a critical feature.
C. Text Date: This describes a simple Text field used to hold date information. Standard Text fields lack the structured data format necessary for the trending feature and therefore do not have this option. The dedicated "Date" field type, however, does support trending.

RSA Archer Platform 6.x Help, "Field Types." The documentation lists the properties available for each field type. For the IP Address field, the "Enable Trending" checkbox is explicitly mentioned as an available option.

RSA Archer Platform 6.x Administrator's Guide, Section: "Fields," Subsection: "Field Properties." This guide confirms that trending is a configurable property for IP Address, Numeric, Date, and Values List fields, but not for general Text fields.

RSA Archer is a platform designed to be tailored to an organization's specific GRC (Governance, Risk, and Compliance) framework. Configuring Audit Management according to organizational priorities ensures that audit activities are risk-based and aligned with strategic objectives. This focus on criticality and business value allows the organization to allocate audit resources effectively, address the most significant risks, and drive meaningful actions that protect and enhance organizational value.

B: The primary purpose of the tool is to internalize and manage an organization's priorities, not to remain isolated from them. C: RSA Archer is designed for extensive configuration to meet specific organizational needs; using it without configuration would be highly ineffective. D: While audit staff are key stakeholders, overall organizational priorities are typically established by senior leadership and the board (top-down).

RSA Archer Documentation, "RSA Archer Audit Management 6.x Implementation Guide," Introduction. The guide emphasizes aligning the audit plan with the organization's risk profile and strategic goals to ensure audits provide strategic value.

The Email button in Archer only sends a hyperlink to the record, which the recipient can open only with a valid Archer account and the proper rights. To share record content with someone outside the system, the platform documentation recommends exporting the record (RTF, XLS, or PDF) and distributing that file externally—most commonly as an e-mail attachment. This preserves the data while avoiding credential or authorization issues.

A. Violates security policy; credential sharing is prohibited.
B. Sends only a link requiring system access; external users cannot view it.
C. Browser URL likewise needs authentication and correct permissions.

1. RSA Archer Platform 6.11 User Guide, “Exporting Records,” pp. 112-113.

2. RSA Archer Platform 6.11 User Guide, “E-mailing a Record,” p. 110 (“Recipient must be an Archer user”).

The RSA Archer Data Import feature is designed to import structured data into applications from external sources. The required format for this tool is a flat, delimited-values data file. The most common examples are comma-separated values (.csv) or tab-separated values (.tsv) files. The import wizard guides the user through mapping the columns in the flat file to the corresponding fields in the target Archer application, enabling bulk creation or updating of records.

A. XML is used for other integration methods like data feeds or the Web Services API, not for the standard user-facing Data Import wizard.
B. HTML is a markup language for displaying web content and is not a structured data format suitable for data import.
C. Microsoft Word is a word processing document format and does not contain the structured, tabular data required by the Data Import tool.

1. RSA Archer 6.9 Platform Help, "Importing Data." The guide explicitly states, "You can import data from an external source into an application or questionnaire. The data must be in a delimited text file, such as a comma-separated values (CSV) file."

2. RSA Archer 6.x Data Management Guide, "Using the Data Import Manager." This document provides detailed steps for the import process, consistently referring to the source file as a ".csv or other delimited file." Section 2.1, "Preparing the Import File," specifies the requirements for a delimited text file.

Data-Driven Events (DDEs) trigger actions based on rules that evaluate record data upon saving. A rule's condition often depends on a specific value or a change in a field's value (e.g., Status changes to 'Closed'). If a user cannot see or edit a field involved in the rule's condition, they cannot perform the data entry that satisfies the condition. Consequently, the user is unable to trigger the rule, and the associated event action (like sending a notification or enrolling content) will not execute. User interaction with the evaluated fields is therefore essential for the event system to function as designed.

A. Rules can evaluate fields hidden from users; the evaluation is server-side. The issue is triggering the rule, not its ability to access the field data.
B. While administrators configure events, end-users trigger them by creating or updating records. The user's ability to trigger the event is the central issue.
D. A user can save a record without interacting with all fields, as long as all required fields are populated. This statement is overly broad and incorrect.

1. RSA Archer Platform 6.x Help, "Events." The section on Data-Driven Events explains that they are triggered when a user saves a record that meets specified criteria. This implies the user must be able to set those criteria.

2. RSA Archer Platform 6.x Help, "Adding a Rule to an Event." This guide details how rules are constructed based on field values, which a user must be able to modify to trigger the event.

The overarching goal of IT Security Risk Management is to protect an organization's assets and operations by managing information security risk to an acceptable level. This is a holistic process that involves identifying threats, assessing vulnerabilities (such as poor security practices), evaluating the potential impact, and implementing controls to mitigate risk. It also includes managing compliance with security policies and standards, thereby providing a comprehensive approach to reducing security failures.

A. Cataloging IT risks is only the identification step; it is a component of the overall process, not the final goal.
C. Giving a Security Control Assessor (SCA) confidence is a positive outcome of a mature program, not its primary, foundational goal.
D. Reducing bottlenecks in threat analysis is an operational improvement within the risk management process, not the strategic objective of the discipline itself.

National Institute of Standards and Technology (NIST) Special Publication 800-39, "Managing Information Security Risk," Section 2.1, "Purpose and Applicability." This foundational document defines the goal as managing risk to "organizational operations and assets, individuals, other organizations, and the Nation." This aligns with the comprehensive scope described in option B.

RSA Archer IT & Security Risk Management Solution Brief. Official vendor documentation describes the use case as enabling organizations to "understand and manage technology-related risks in the context of business operations" and "reduce the risk of security threats and operational failures."