CAST Risk Management & Mitigation 2 — Questions and Answers
Question 1: A project team discovers a critical defect two days before release. The defect affects only 2% of users in a non-critical workflow. Which risk response is MOST appropriate?
- Cancel the release immediately
- Accept the risk and release with a known issues note (Correct answer)
- Transfer the risk to the QA manager
- Avoid the risk by removing the workflow entirely
Correct answer: Accept the risk and release with a known issues note
Accepting the risk is appropriate when the impact is low and the cost of mitigation outweighs the benefit, especially close to release.
Question 2: Which metric is MOST useful for tracking residual risk after mitigation actions have been applied?
- Defect density before testing
- Risk exposure post-mitigation (Correct answer)
- Number of test cases executed
- Total lines of code changed
Correct answer: Risk exposure post-mitigation
Risk exposure post-mitigation measures the remaining risk level after controls are applied, directly tracking residual risk.
Question 3: In risk-based testing, which factor determines the PRIORITY order in which risks should be tested first?
- Alphabetical order of the risk name
- The combination of likelihood and impact (Correct answer)
- The number of test cases associated with the risk
- The experience level of the tester assigned
Correct answer: The combination of likelihood and impact
Risk priority in risk-based testing is determined by multiplying (or combining) likelihood and impact to produce a risk level.
Question 4: A software team uses a risk register to track identified risks. What information should a risk register entry typically contain?
- Only the risk description and owner
- Risk ID, description, probability, impact, mitigation plan, and owner (Correct answer)
- Only the mitigation plan and test cases
- Risk ID and the date it was identified
Correct answer: Risk ID, description, probability, impact, mitigation plan, and owner
A complete risk register entry includes identification, assessment (probability and impact), mitigation strategy, and accountability (owner).
Question 5: Which technique involves creating a diagram that shows the sequence of events leading to a risk materializing?
- Risk matrix
- Fault tree analysis (Correct answer)
- SWOT analysis
- Pareto chart
Correct answer: Fault tree analysis
Fault tree analysis uses a top-down logical diagram to map failure modes and their contributing causes.
Question 6: A tester is asked to focus testing efforts on components that have changed recently. This practice BEST exemplifies which risk mitigation approach?
- Risk avoidance
- Risk transfer
- Risk-based test prioritization (Correct answer)
- Risk acceptance
Correct answer: Risk-based test prioritization
Targeting recently changed components reduces the risk of regression defects escaping, which is a core risk-based test prioritization strategy.
Question 7: Which of the following BEST describes a 'risk appetite' in a software testing context?
- The total number of defects the team is willing to find
- The level of risk an organization is willing to accept in pursuit of its objectives (Correct answer)
- The budget allocated for risk mitigation activities
- The maximum number of open risks allowed in the register
Correct answer: The level of risk an organization is willing to accept in pursuit of its objectives
Risk appetite is the threshold of risk an organization deliberately accepts, balancing opportunity against potential harm.
CAST Risk Management & Mitigation 2
A project team discovers a critical defect two days before release.
The defect affects only 2% of users in a non-critical workflow.
Which risk response is MOST appropriate?