CAST Risk Management & Mitigation 3 — Questions and Answers
Question 1: When performing a FMEA (Failure Mode and Effects Analysis), what does the Risk Priority Number (RPN) represent?
- The total cost of fixing all failures
- Severity × Occurrence × Detectability (Correct answer)
- The number of test cases required per failure mode
- Impact × Likelihood only
Correct answer: Severity × Occurrence × Detectability
RPN = Severity × Occurrence × Detectability, providing a composite score to prioritize failure modes requiring corrective action.
Question 2: A project manager asks the test team to stop testing a low-risk module to focus on a high-risk integration. This is an example of which risk response strategy?
- Risk avoidance
- Risk transfer
- Risk acceptance through reallocation
- Risk mitigation through prioritization (Correct answer)
Correct answer: Risk mitigation through prioritization
Reallocating testing resources from low-risk to high-risk areas is a mitigation strategy that reduces overall project risk exposure.
Question 3: Which type of risk specifically arises from NOT performing sufficient testing on a software component?
- Product risk
- Project risk
- Quality risk (Correct answer)
- Residual risk
Correct answer: Quality risk
Quality risk refers to the potential that a product does not meet its quality requirements due to insufficient testing or defect escape.
Question 4: In the context of risk management, what does 'risk transference' mean in software projects?
- Moving a risk to a later sprint for reassessment
- Shifting the financial or operational consequence to a third party such as a vendor or insurer (Correct answer)
- Assigning a risk to a different tester
- Converting a product risk into a project risk
Correct answer: Shifting the financial or operational consequence to a third party such as a vendor or insurer
Risk transference shifts the financial or operational burden of a risk to another party, such as through outsourcing or insurance.
Question 5: Which testing technique is MOST effective at identifying risks caused by interactions between integrated components?
- Unit testing
- Integration testing (Correct answer)
- Acceptance testing
- Regression testing
Correct answer: Integration testing
Integration testing specifically targets interface and interaction defects between components, which are a primary source of integration risk.
Question 6: A quality risk assessment reveals that a payment gateway has HIGH impact but LOW probability of failure. How should this risk be handled?
- Ignore it due to low probability
- Assign it low test priority
- Test it thoroughly because the impact justifies the effort (Correct answer)
- Document it and accept without testing
Correct answer: Test it thoroughly because the impact justifies the effort
High-impact risks warrant thorough testing regardless of low probability because a single failure can be catastrophic.
Question 7: Which document formally records the decisions made about risk responses and the person accountable for each risk?
- Test plan
- Risk register (Correct answer)
- Defect report
- Test summary report
Correct answer: Risk register
The risk register is the authoritative record of identified risks, their assessments, chosen responses, and assigned owners.
CAST Risk Management & Mitigation 3
When performing a FMEA (Failure Mode and Effects Analysis), what does the Risk Priority Number (RPN) represent?