Risk Management & Mitigation Flashcards

A team uses exploratory testing to uncover unknown risks in a newly integrated third-party API. This approach is MOST aligned with which risk management concept?

Answer: Unknown-unknown risk discovery

Exploratory testing is a key technique for surfacing unknown risks ('unknown-unknowns') that structured test cases cannot anticipate.

Which of the following risk mitigation actions DIRECTLY reduces the IMPACT of a risk rather than its probability?

Answer: Implementing a rollback mechanism for failed deployments

A rollback mechanism limits the damage when a deployment fails without preventing the failure itself, directly reducing impact.

During a sprint retrospective, the team notes that integration risks were consistently underestimated. Which improvement would MOST directly address this?

Answer: Include integration risk assessment as a formal step in sprint planning

Formalizing integration risk assessment during sprint planning ensures these risks are identified and mitigated before integration work begins.

A risk is described as having a 30% probability of occurrence and an impact rating of 4 on a 5-point scale. What is its risk exposure value?

Answer: 1.2

Risk exposure = Probability × Impact = 0.30 × 4 = 1.2, expressing the expected weighted impact of the risk.

Which CAST testing principle states that testing effort should be concentrated where the probability and consequences of failure are greatest?

Answer: Risk-based testing

Risk-based testing is the principle of allocating more testing effort to areas with higher failure probability and higher consequence of failure.

A software company requires that all payment features pass security penetration testing before release. This is BEST described as which type of risk control?

Answer: Preventive control

Requiring penetration testing before release is a preventive control that stops security risks from reaching production.

After a major production incident, the team conducts a 'lessons learned' session to update the risk register. This activity BEST supports which risk management process?

Answer: Risk identification for future projects

Post-incident lessons learned feed historical risk data back into future risk identification, improving the team's risk awareness and register accuracy.