PMI Risk Management Professional (PMI-RMP) — Questions and Answers

Question 1: Which technique involves reviewing project documents such as plans, contracts, and lessons learned to identify risks from inconsistencies and gaps?

Brainstorming
Document analysis (Correct answer)
Delphi technique
SWOT analysis

Correct answer: Document analysis

Document analysis reviews project documentation to find risks indicated by inconsistencies, gaps, or misalignment.

Question 2: Stakeholders are people or organizations who are actively involved in the project or _________________________.

perform qualitative risk analysis
prevent future problems
monitor and control risks
may affect or be affected by the project (Correct answer)

Correct answer: may affect or be affected by the project

According to project management best practices, stakeholders are defined as individuals or organizations who are actively involved in the project, or whose interests may be positively or negatively affected by the project's execution or completion. This broad definition ensures that all parties with a vested interest are identified and considered. Effectively managing these diverse stakeholders is crucial for overall project success.

Question 3: A project manager wants to capture the overall effect of uncertainty on the entire project rather than on a single event. Which term best describes this?

Secondary risk
Residual risk
Overall project risk (Correct answer)
Individual project risk

Correct answer: Overall project risk

Overall project risk reflects the effect of uncertainty on the project as a whole, arising from all sources including individual risks.

Question 4: You declined a proposed change request due to the risk it entailed. Where should the rejected change request be documented and saved?

Project document updates
Change request log (Correct answer)
Project archives
Lessons learned

Correct answer: Change request log

All change requests, regardless of their disposition (approved, deferred, or rejected), must be formally documented in a change request log. This log provides a comprehensive historical record of all proposed changes, the rationale for their outcome, and ensures proper configuration management and traceability. It is a critical component of integrated change control.

Question 5: During risk identification, why is broad stakeholder participation valuable?

It speeds up approval
It captures diverse perspectives and more risks (Correct answer)
It reduces documentation
It eliminates the need for analysis

Correct answer: It captures diverse perspectives and more risks

Diverse stakeholders surface risks that a small group might overlook.

Question 6: What does 'risk appetite' describe in risk management planning?

The schedule reserve available
The degree of uncertainty an organization is willing to accept in anticipation of reward (Correct answer)
The cost of risk responses
The number of risks identified

Correct answer: The degree of uncertainty an organization is willing to accept in anticipation of reward

Risk appetite is the level of uncertainty an entity is willing to take on in anticipation of a reward.

Question 7: A new risk is discovered during project execution that was not in the risk register. What should the risk professional do first?

Cancel the affected work package
Immediately implement a workaround
Identify and analyze the risk, then record it in the register (Correct answer)
Spend the management reserve

Correct answer: Identify and analyze the risk, then record it in the register

Newly emerging risks should be identified, analyzed, and added to the register through the ongoing process.

Question 8: Risk thresholds help a project team by:

Guaranteeing project success
Eliminating all project uncertainty
Defining the point at which a risk requires escalation or active response (Correct answer)
Replacing qualitative analysis

Correct answer: Defining the point at which a risk requires escalation or active response

Thresholds provide clear, objective criteria that trigger action, ensuring risks are addressed before they breach acceptable limits.

Question 9: A key stakeholder consistently has a risk-averse attitude. How should the risk manager respond?

Remove them from the project
Force them to accept all risks
Tailor risk communication to address their concerns (Correct answer)
Ignore their preference

Correct answer: Tailor risk communication to address their concerns

Understanding and accommodating risk attitudes improves engagement and buy-in.

Question 10: Workarounds in risk management are best described as:

Reserve adjustments made during planning
Preventive actions taken before a risk occurs
Unplanned responses to risks that were not previously identified or accepted (Correct answer)
Planned responses to identified risks

Correct answer: Unplanned responses to risks that were not previously identified or accepted

Workarounds are unplanned responses developed to deal with unanticipated or passively accepted risks that occur.

Question 11: A response to an unplanned risk that has occurred but had no pre-planned response is called what?

A trigger condition
A contingency plan
A workaround (Correct answer)
A fallback plan

Correct answer: A workaround

A workaround is an unplanned response to an occurring risk that had no contingency plan.

Question 12: A risk that is the result of a previously identified risk's response is referred to as a:

Unidentified Risk
Primary Risk
Residual Risk
Secondary Risk (Correct answer)

Correct answer: Secondary Risk

A secondary risk is a new risk that arises as a direct consequence of implementing a risk response. For example, if a project team decides to outsource a task to mitigate a schedule risk, a secondary risk might be a loss of control over quality or intellectual property. These newly created risks must also be identified, analyzed, and managed.

Question 13: A threat is outside the project manager's authority and affects the wider organization. The appropriate response is to:

Accept it
Transfer it
Escalate it (Correct answer)
Mitigate it

Correct answer: Escalate it

Escalation is used when a threat is beyond the project's scope or the PM's authority and must be addressed at a higher level.

Question 14: A construction project identifies an opportunity to generate significant positive press by partnering with a local non-profit to build a community park on an adjacent, unused parcel of land owned by the client. The project team lacks expertise in park design and community engagement. They form a joint venture with the non-profit, agreeing to provide construction resources in exchange for the non-profit managing the design, public relations, and long-term maintenance. What opportunity response strategy does this joint venture represent?

Escalate
Exploit
Accept
Share (Correct answer)

Correct answer: Share

The 'Share' strategy involves allocating ownership of an opportunity to a third party who is best able to capture the benefit for the project. In this scenario, the project team partners with a non-profit that has the specific expertise needed, and they share in the benefits (positive press for the project, a new park for the community). This is a classic example of forming a partnership or joint venture to capitalize on an opportunity.

Question 15: During qualitative risk analysis, what two parameters are most commonly used to prioritize individual project risks?

Probability and impact (Correct answer)
Detectability and manageability
Cost and schedule
Urgency and proximity

Correct answer: Probability and impact

Qualitative analysis prioritizes risks primarily by assessing their probability of occurrence and impact on objectives.

Question 16: You learn that a new external regulation has been discovered, increasing the risk of completing your project on time and within budget. You make a decision about how you will deal with any risks that arise. Which of the following responses is currently being used?

Avoidance
Enhancement
Acceptance (Correct answer)
Mitigation

Correct answer: Acceptance

Risk acceptance is a strategy where the project team acknowledges the existence of a risk but decides not to take any proactive action to change the project plan or reduce its impact. In this scenario, the project manager learns about the regulation and decides how to 'deal with any risks that arise,' implying a passive approach where the consequences will be handled if the risk occurs.

Question 17: An Ishikawa diagram is most useful during risk identification for what purpose?

Calculating contingency reserves
Assigning risk owners
Identifying underlying causes that could lead to risk events (Correct answer)
Prioritizing risks by probability

Correct answer: Identifying underlying causes that could lead to risk events

The Ishikawa (fishbone) diagram is a cause-and-effect tool that helps trace potential root causes of risks.

Question 18: Why should the risk manager identify stakeholders' communication preferences?

To ensure risk information is received and acted upon (Correct answer)
To avoid risk responses
To shorten the WBS
To reduce the team size

Correct answer: To ensure risk information is received and acted upon

Matching communication to preferences increases the chance information is used.

Question 19: While executing a project to consolidate two corporate data centers, the project team discovers that the combined infrastructure could support a new, high-demand cloud service offering for the company's clients. This opportunity represents a significant new revenue stream but falls far outside the project's charter, budget, and the project manager's authority. Which of the following is the MOST appropriate response?

Actively Accept the opportunity by creating a contingency plan for its development.
Use the Share strategy by finding an external partner to develop the service.
Escalate the opportunity to senior management or the portfolio review board. (Correct answer)
Use the Exploit strategy to redirect project funds and pursue the new service.

Correct answer: Escalate the opportunity to senior management or the portfolio review board.

The 'Escalate' strategy is used when an opportunity is outside the scope of the project or exceeds the project manager's authority. The correct course of action is to communicate the opportunity to the appropriate level of management (e.g., program manager, portfolio manager, or sponsor) who has the authority to authorize a new project or initiative to pursue it.

Question 20: Which opportunity response strategy seeks to ensure the opportunity definitely happens by removing all uncertainty about its occurrence?

Share
Enhance
Escalate
Exploit (Correct answer)

Correct answer: Exploit

Exploit aims to make the opportunity's realization certain by eliminating the uncertainty of whether it occurs.

Question 21: Pareto diagram

Explains the 80-20 principle (Correct answer)
Is used in sensitivity analysis
Identifies the cause of the risk
Is used to identify risks

Correct answer: Explains the 80-20 principle

A Pareto diagram is a specialized bar chart that illustrates the Pareto principle, also known as the 80-20 rule. This principle suggests that roughly 80% of problems or effects come from 20% of the causes. The diagram visually ranks causes by frequency or impact, helping to identify the 'vital few' factors that contribute most significantly to an overall problem, thereby explaining the 80-20 principle in a practical context.

Question 22: A project involves regulatory compliance. The organization's risk appetite for compliance risks is near-zero. This means:

Compliance risks are excluded from the risk register
Even minor compliance risks require immediate attention and robust response plans (Correct answer)
Compliance risks are transferred automatically
Compliance risks can be accepted without response

Correct answer: Even minor compliance risks require immediate attention and robust response plans

Near-zero appetite means the organization will not tolerate compliance deviations, requiring strong controls and immediate escalation for any such risk.

Question 23: A project manager identifies a risk that is beyond the project's scope and their authority to manage effectively. The risk, if it occurs, would impact multiple departments across the entire organization. The project manager documents the risk and formally communicates it to the program manager and the steering committee for resolution. Which threat response strategy is being implemented?

Accept
Transfer
Escalate (Correct answer)
Mitigate

Correct answer: Escalate

The 'Escalate' strategy is appropriate when a threat is outside the project's boundaries or the project manager's authority. The risk is moved to a higher level within the organization (e.g., program management, portfolio management, or senior leadership) that has the capability and authority to manage it.

Question 24: A project team discovers that a new software algorithm could significantly improve the final product's performance, a key project objective. To guarantee this benefit is realized, the project manager allocates top talent and additional funding to integrate the algorithm, making its successful implementation a primary focus. Which opportunity response strategy is the project manager using?

Exploit (Correct answer)
Share
Accept
Enhance

Correct answer: Exploit

The 'Exploit' strategy is used to ensure that an opportunity is fully realized. By dedicating top resources and funding, the project manager is taking aggressive and decisive action to make the opportunity's probability 100%, which is the core of the Exploit strategy. 'Enhance' only seeks to increase the probability or impact, not guarantee it. 'Accept' involves no proactive action, and 'Share' would involve a third party.

Question 25: What is a key benefit of using a hierarchical Risk Breakdown Structure during risk identification?

It prompts team members to consider risks in every defined category systematically (Correct answer)
It prevents duplicate entries from appearing in the risk register
It ensures every risk has a numerical probability assigned
It automatically prioritizes risks by their potential financial impact

Correct answer: It prompts team members to consider risks in every defined category systematically

A hierarchical RBS serves as a prompt during brainstorming and workshops, ensuring the team considers risks across all defined categories systematically.

Question 26: Technical performance measurement compares technical accomplishments against what?

The cost baseline
The procurement plan
The schedule of planned technical achievements (Correct answer)
The communications plan

Correct answer: The schedule of planned technical achievements

Technical performance measurement compares actual technical achievements to the planned schedule of accomplishments to reveal risk.

Question 27: A risk response plan to mitigate potential supply chain delays for a construction project has been approved. The assigned risk owner is the procurement manager. During the Implement Risk Responses process, what is the procurement manager's primary responsibility?

To re-evaluate the probability and impact of the risk.
To identify new risks that may arise from the response.
To report the risk status to the project sponsor.
To execute the specific actions outlined in the risk response plan. (Correct answer)

Correct answer: To execute the specific actions outlined in the risk response plan.

The Implement Risk Responses process is focused on taking action. The risk owner's primary duty is to ensure the agreed-upon response plan is executed as intended. While they may also be involved in monitoring and reporting, the core of this process is the execution of the plan.

Question 28: To perform a quantitative cost risk analysis using a simulation, the risk analyst requires estimates for the cost of specific work packages. Since these estimates are uncertain, they are best represented as a range of possible values. Which of the following is an essential input for this type of analysis?

Risk response audit reports
Probability distributions (Correct answer)
Risk breakdown structure
Stakeholder risk appetite

Correct answer: Probability distributions

Quantitative simulations like Monte Carlo require uncertain inputs (like cost or duration estimates) to be represented by probability distributions (e.g., triangular, beta, uniform). These distributions model the range and likelihood of possible values for each uncertain variable.

Question 29: A project manager facilitates a session where experts answer questionnaires anonymously over multiple rounds, with feedback summarized between rounds to build consensus. Which technique is being used?

Delphi technique (Correct answer)
Brainstorming
Focus group
Nominal group technique

Correct answer: Delphi technique

The Delphi technique uses anonymous, iterative expert questionnaires with controlled feedback to reach consensus and reduce bias.

Question 30: Which document defines how and when risk information will be communicated to stakeholders?

Project charter
Risk management plan / communications plan (Correct answer)
Work breakdown structure
Procurement plan

Correct answer: Risk management plan / communications plan

The risk and communications plans specify reporting frequency, format, and audience.

Question 31: Which of the following is a significant limitation of relying solely on checklists for risk identification?

They can stifle creative thinking and fail to identify project-specific risks. (Correct answer)
They are only useful for identifying threats, not opportunities.
They require a highly experienced facilitator to be effective.
They are too time-consuming for agile projects.

Correct answer: They can stifle creative thinking and fail to identify project-specific risks.

The primary disadvantage of using checklists is that they can provide a false sense of security and limit out-of-the-box thinking. Teams may focus only on the items listed and overlook unique or emerging risks that are not on the standardized list. Therefore, checklists are best used as a supplement to other techniques, not as the sole tool for risk identification.

Question 32: A project sponsor states the project can tolerate a cost overrun of up to 10% but no more. This is an example of:

Risk threshold (Correct answer)
Risk avoidance
Risk appetite
Risk transfer

Correct answer: Risk threshold

A specific, measurable boundary (10% cost overrun) represents a risk threshold, which operationalizes risk tolerance for a particular objective.

Question 33: During structured interviews for risk identification, what is the PRIMARY benefit over simple brainstorming?

It removes all cognitive bias
It captures detailed, in-depth perspectives from individual stakeholders (Correct answer)
It eliminates the need for a risk register
It guarantees statistical accuracy

Correct answer: It captures detailed, in-depth perspectives from individual stakeholders

Interviews allow deep, one-on-one exploration of experienced participants' knowledge that group settings may not surface.

Question 34: As a result of the Monitor Risks process, the project manager determines that a previously identified threat is now more likely to occur and its impact on the schedule is more severe than initially estimated. Which project document should be updated FIRST to reflect this new information?

The project charter
The issue log
The lessons learned register
The risk register (Correct answer)

Correct answer: The risk register

The risk register is a living document used to track and manage risks throughout the project lifecycle. [13] When monitoring activities reveal changes in a risk's probability, impact, or other attributes, the risk register is the primary document that must be updated to reflect the current assessment. [8]

Question 35: Which technique helps reveal stakeholders' hidden attitudes toward risk that they may not openly express?

Decision tree analysis
Stakeholder analysis (Correct answer)
Earned value analysis
Monte Carlo simulation

Correct answer: Stakeholder analysis

Stakeholder analysis surfaces underlying attitudes, interests, and influence regarding risk.

Question 36: Stakeholder engagement assessment matrices compare what?

Risk versus reward only
Cost versus schedule
Current versus desired engagement levels (Correct answer)
Scope versus quality

Correct answer: Current versus desired engagement levels

The matrix maps each stakeholder's current and desired engagement levels.

Question 37: In the context of a mature risk management framework, what is the primary purpose of establishing predefined risk categories?

To provide a structure for consistent risk identification and analysis across projects. (Correct answer)
To guarantee that all identified risks will be successfully mitigated.
To eliminate the need for qualitative and quantitative risk analysis.
To assign a single risk owner to each category for accountability.

Correct answer: To provide a structure for consistent risk identification and analysis across projects.

Establishing predefined risk categories (often within a Risk Breakdown Structure) is a core part of a risk management framework. Its main purpose is to ensure a systematic, consistent, and comprehensive approach to identifying and organizing risks, which helps improve the quality of risk analysis and communication.

Question 38: A project manager assigns each identified risk a probability score of 1-5 and an impact score of 1-5, then multiplies them. What technique is being used?

Monte Carlo simulation
Probability and impact matrix (Correct answer)
Decision tree analysis
Expected monetary value analysis

Correct answer: Probability and impact matrix

Multiplying probability and impact scores to prioritize risks is the core of the probability and impact matrix used in qualitative analysis.

Question 39: A risk manager is preparing a risk report for the project's steering committee, which includes senior executives. Which principle should guide the communication of risk information to this stakeholder group?

Provide a complete and unabridged risk register with all technical details to ensure full transparency.
Focus on presenting aggregated risk data and its potential impact on strategic business objectives. (Correct answer)
Use highly technical jargon to demonstrate the risk team's expertise and thorough analysis.
Schedule a lengthy, detailed presentation covering every identified risk and its mitigation plan.

Correct answer: Focus on presenting aggregated risk data and its potential impact on strategic business objectives.

When communicating with senior executive stakeholders, it is essential to tailor the message to their interests and level of detail required. Executives are primarily concerned with the project's alignment with strategic goals. Therefore, presenting a high-level, aggregated view of key risks and their potential business impact is the most effective approach. Providing excessive detail or technical jargon can be counterproductive.

Question 40: Which metric is commonly included in a risk report to convey overall project risk exposure?

Number of change requests
Expected monetary value (EMV) of threats and opportunities (Correct answer)
Earned value cost performance index
Number of team members

Correct answer: Expected monetary value (EMV) of threats and opportunities

EMV aggregates probability-weighted monetary impacts across all risks, providing a single figure that represents overall exposure.

Question 41: What technique compares the amount of contingency reserve remaining to the amount of risk remaining at a point in time?

Earned value analysis
Trend analysis
Reserve analysis (Correct answer)
Variance analysis

Correct answer: Reserve analysis

Reserve analysis compares remaining reserves against remaining risk to assess adequacy.

Question 42: Quantitative risk analysis is most justified on which type of project?

Projects with no identified risks
Projects already in closing
Large or complex projects where overall risk exposure must be quantified (Correct answer)
Small, low-complexity projects

Correct answer: Large or complex projects where overall risk exposure must be quantified

Quantitative analysis adds the most value on large or complex projects where numeric risk exposure informs decisions and reserves.

Question 43: A team groups risks by their root causes to determine which areas of the project are most exposed. What is this called?

Risk audit
Risk urgency assessment
Risk reassessment
Risk categorization (Correct answer)

Correct answer: Risk categorization

Risk categorization groups risks by sources, affected areas, or causes to reveal concentrations of exposure.

Question 44: Which best indicates successful stakeholder engagement in risk management?

Reduced stakeholder count
Fewer meetings
Active participation and timely risk reporting (Correct answer)
Lower documentation

Correct answer: Active participation and timely risk reporting

Engagement success shows as active involvement and prompt risk communication.

Question 45: Which of the following activities is a key component of a risk reassessment performed during the Monitor Risks process?

Developing the initial probability and impact scales.
Creating the initial risk management plan.
Identifying new risks that have emerged since the project started. (Correct answer)
Selecting the appropriate risk response strategies for the first time.

Correct answer: Identifying new risks that have emerged since the project started.

Risk reassessment is an iterative process performed throughout the project. A critical part of this activity is to identify any new risks that may have arisen due to changing project conditions. [3] It also involves re-evaluating existing risks and closing out those that are no longer relevant.

Question 46: During the planning of an international conference, the project team identifies the risk of low attendance from a specific region due to a minor, concurrent local holiday. The potential impact on revenue is small. The team documents the risk but decides not to spend resources on a targeted marketing campaign for that region. Instead, they create a small contingency fund to cover a potential revenue shortfall. This response is an example of:

Transfer
Passive Acceptance
Active Acceptance (Correct answer)
Mitigation

Correct answer: Active Acceptance

'Active Acceptance' involves acknowledging a risk and developing a contingency plan or allocating time, money, or resource reserves to be used if the risk occurs. By creating a contingency fund, the team has a deliberate plan, which distinguishes this from 'Passive Acceptance' where no action would be taken.

Question 47: A risk owner is responsible for executing the agreed-upon response, but who is typically assigned to carry out the specific actions of the response plan?

The project sponsor
The risk action owner (Correct answer)
The PMO director
The procurement manager

Correct answer: The risk action owner

The risk action owner is the person assigned to perform the specific risk response actions, distinct from the risk owner who monitors the risk.

Question 48: During the execution of a project, an unexpected severe thunderstorm causes minor flooding on the site, a risk that was not identified in the risk register. The project team immediately rents industrial water pumps to clear the area. This immediate, unplanned response is BEST described as a:

Risk acceptance
Secondary risk
Workaround (Correct answer)
Contingency plan

Correct answer: Workaround

A workaround is an unplanned response to an unanticipated problem or risk event. [5, 18] Since the risk of a thunderstorm causing flooding was not previously identified, the action taken is a workaround. A contingency plan, by contrast, is a planned response to an identified risk. [4]

Question 49: Which output is primarily updated as a result of performing qualitative risk analysis?

Project charter
Cost baseline
Stakeholder register
Risk register (Correct answer)

Correct answer: Risk register

Qualitative analysis updates the risk register with priority rankings, categorization, and watchlist items.

Question 50: What is the role of a risk owner in risk communication?

To eliminate all project risks
To write the project charter
To be responsible for monitoring the risk and reporting its status (Correct answer)
To approve the project budget

Correct answer: To be responsible for monitoring the risk and reporting its status

The risk owner is accountable for tracking their assigned risk and reporting updates to the risk manager and relevant stakeholders.

Question 51: What is the main benefit of involving stakeholders in defining risk thresholds early?

It avoids documentation
It sets a shared basis for prioritizing risks (Correct answer)
It shortens the schedule
It removes the risk register

Correct answer: It sets a shared basis for prioritizing risks

Agreed thresholds give everyone a consistent reference for risk prioritization.

Question 52: The outcomes of risk management planning are _______________.

documented in the risk management plan (Correct answer)
contributes to the management team's improvement.
risk management methodologies under controlled conditions
monitored residual risks

Correct answer: documented in the risk management plan

The risk management plan is the foundational document that details how risk management activities will be performed throughout the project. It outlines the methodologies, roles, responsibilities, and categories for risk management. Therefore, all outcomes, strategies, and approaches developed during risk management planning are formally documented within this plan.

Question 53: Which of the following is NOT a primary benefit of involving a diverse group of stakeholders in the risk identification process?

The identification of more creative and effective risk response strategies.
Guaranteed consensus on the probability and impact of every identified risk. (Correct answer)
Increased buy-in and ownership of the risk management process.
A more comprehensive and complete list of potential project risks.

Correct answer: Guaranteed consensus on the probability and impact of every identified risk.

Involving diverse stakeholders enhances risk identification by bringing different perspectives and expertise, which leads to a more comprehensive risk list and creative responses. It also fosters buy-in. However, it does not guarantee consensus. Stakeholders will likely have differing opinions on the probability and impact of risks due to their unique biases and risk tolerances, which is why risk analysis and prioritization are necessary subsequent steps.

Question 54: A stakeholder's measurement of acceptable variation around an objective is best described as a risk:

Capacity
Attitude
Appetite
Threshold (Correct answer)

Correct answer: Threshold

A risk threshold is the measurable level of exposure variation that is acceptable to a stakeholder.

Question 55: The risk owner should choose a suitable strategy for each individual risk based on _______________________, ensuring that the strategy is achievable, affordable, cost effective, and appropriate.

its characteristics and assessed priority (Correct answer)
appropriate project model
unbiased data
commitment to collecting high-quality risk data

Correct answer: its characteristics and assessed priority

To select an effective risk response strategy, the risk owner must thoroughly understand the specific characteristics of each individual risk, including its probability, impact, and proximity. The chosen strategy must be tailored to these unique attributes and the risk's assessed priority. This ensures the response is practical, efficient, and appropriate for addressing that particular risk.

Question 56: Which of the following is a key output of the Plan Risk Management process?

Risk Register
Risk Management Plan (Correct answer)
A list of prioritized risks
Risk Response Strategies

Correct answer: Risk Management Plan

The primary output of the Plan Risk Management process is the Risk Management Plan. This plan documents how risk management activities will be structured and performed throughout the project. The Risk Register, prioritized risks, and response strategies are outputs of later processes like Identify Risks, Perform Qualitative/Quantitative Risk Analysis, and Plan Risk Responses.

Question 57: A project manager for a highly innovative and unprecedented technology project needs to identify potential risks. Since there is no historical data and the team members' opinions are strongly influenced by a few dominant personalities, the project manager wants to gather expert judgment anonymously to avoid bias. Which risk identification tool is MOST appropriate for this situation?

SWOT Analysis
Brainstorming Session
Delphi Technique (Correct answer)
Checklist Analysis

Correct answer: Delphi Technique

The Delphi Technique is specifically designed to reach a consensus of experts anonymously. It uses multiple rounds of questionnaires and provides anonymized feedback to encourage honest opinions and prevent the influence of dominant personalities, which is the core problem described in the scenario. Brainstorming is a group activity that can be susceptible to groupthink. SWOT analysis focuses on internal/external factors but is not inherently anonymous. Checklist analysis relies on historical data, which is unavailable in this innovative project.

Question 58: Which process establishes the scope, criteria, and approach for managing risk on a project according to the PMI-RMP framework?

Monitor Risks
Plan Risk Management (Correct answer)
Perform Qualitative Risk Analysis
Identify Risks

Correct answer: Plan Risk Management

Plan Risk Management defines how risk activities will be structured and performed, producing the risk management plan.

Question 59: A risk manager wants to present probability-impact information visually to sponsors. Which tool is most appropriate?

Probability and Impact Matrix (Correct answer)
Pareto chart
Gantt chart
RACI matrix

Correct answer: Probability and Impact Matrix

The Probability and Impact Matrix visually maps each risk by likelihood and consequence, making it ideal for executive communication.

Question 60: Which of the following documents is the primary input for understanding stakeholder risk appetite and tolerance, which in turn guides the establishment of risk thresholds?

Issue Log
Stakeholder Engagement Plan (Correct answer)
Communications Management Plan
Risk Register

Correct answer: Stakeholder Engagement Plan

The Stakeholder Engagement Plan outlines the strategies for engaging stakeholders throughout the project lifecycle. A key component of this plan is the analysis of stakeholders, which includes understanding their expectations, influence, and attitudes toward risk, such as their risk appetite and tolerance. This information is then used to set appropriate risk thresholds within the Risk Management Plan.

Question 61: Which input best informs the assessment of stakeholder risk attitudes?

The cost baseline
The schedule network diagram
Interviews and the stakeholder register (Correct answer)
The procurement documents

Correct answer: Interviews and the stakeholder register

Interviews and the stakeholder register reveal individual risk attitudes.

Question 62: A project is underway to develop a new financial software product. The risk manager needs to understand the quantifiable level of risk the organization is willing to withstand for specific objectives, such as data security and system uptime. This quantifiable measure is best defined as:

Risk Tolerance (Correct answer)
Risk Threshold
Risk Appetite
Risk Attitude

Correct answer: Risk Tolerance

Risk tolerance refers to the specific, measurable amount of risk that an organization is willing to accept for a particular objective. It is more granular than risk appetite, which is the overall strategic level of risk the organization is willing to take on. Risk threshold is a specific trigger point for action, and risk attitude is a more general disposition towards risk.

Question 63: A stakeholder with high power but low interest in your project's risk approach is best managed using which strategy?

Manage closely
Keep informed
Monitor
Keep satisfied (Correct answer)

Correct answer: Keep satisfied

High-power, low-interest stakeholders should be kept satisfied without overwhelming them with detail.

Question 64: Which output of Monitor Risks captures the actual outcomes of project risks for future projects?

Project charter
Change requests
Lessons learned and organizational process asset updates (Correct answer)
Procurement statement of work

Correct answer: Lessons learned and organizational process asset updates

Lessons learned and updated organizational process assets capture risk outcomes for future use.

Question 65: A project is in its execution phase when an unexpected problem occurs for which no risk was identified in the risk register. The project team quickly implements a solution. How should this event and its solution be documented for risk management purposes?

A change request should be submitted to update the risk management plan.
The event should be logged in the issue log, not the risk register, as it has already occurred. (Correct answer)
The event should be added to the risk register as a closed risk.
The solution implemented is a workaround and should be documented in the risk register or lessons learned.

Correct answer: The event should be logged in the issue log, not the risk register, as it has already occurred.

A key distinction in project management is between a risk (an uncertain future event) and an issue (a current problem or event that has already occurred). Since the problem has already happened, it is an issue and should be recorded in the issue log. The risk register is forward-looking and tracks potential future events. The reactive solution is a workaround, and documenting it is important for knowledge management.

Question 66: What best describes a stakeholder's 'risk threshold'?

Their organizational title
Their reporting frequency
The level of risk exposure they will accept (Correct answer)
Their budget authority

Correct answer: The level of risk exposure they will accept

A risk threshold is the measure of acceptable variation around an objective.

Question 67: Engaging frontline staff in risk identification is valuable because they:

Approve the budget
Sign contracts
Have operational knowledge of emerging risks (Correct answer)
Set the schedule baseline

Correct answer: Have operational knowledge of emerging risks

Frontline staff often spot operational risks before management does.

Question 68: What does a 'watch list' represent in risk reporting?

Risks that have already occurred and become issues
Low-priority risks monitored but not actively managed (Correct answer)
Approved change requests
Stakeholders who need to review every risk

Correct answer: Low-priority risks monitored but not actively managed

A watch list contains lower-priority risks that are tracked passively and revisited if conditions change.

Question 69: After implementing a response, a new risk arises that is a direct consequence of that response. This is known as what?

Residual risk
Inherent risk
Overall project risk
Secondary risk (Correct answer)

Correct answer: Secondary risk

A secondary risk is a new risk created directly by the implementation of a risk response.

Question 70: What is the primary purpose of a risk register's 'risk owner' field?

To identify who is responsible for monitoring and responding to the risk (Correct answer)
To record who first identified the risk
To list the sponsor of the project
To assign blame if the risk occurs

Correct answer: To identify who is responsible for monitoring and responding to the risk

The risk owner is the person responsible for monitoring the risk and implementing the agreed response.

Question 71: A project is 60% complete. The project manager notes that the cost performance index (CPI) is 0.9 and several identified risks have occurred, consuming 75% of the contingency reserves. What is the MOST appropriate immediate action for the project manager to take during the Monitor Risks process?

Crash the schedule to try to improve the CPI.
Request additional funding from the sponsor immediately.
Analyze the remaining risks and the adequacy of the remaining reserves. (Correct answer)
Update the risk management plan to reduce the number of identified risks.

Correct answer: Analyze the remaining risks and the adequacy of the remaining reserves.

Reserve analysis is a key technique in the Monitor Risks process. It involves comparing the amount of contingency reserves remaining against the risk remaining in the project to determine if the reserves are still adequate. [7] Before escalating to request more funds, the project manager must first perform this analysis to understand the current risk exposure and justify any potential need for additional reserves.

Question 72: A stakeholder repeatedly misses risk review meetings. The best response is to:

Remove them as a stakeholder
Make all decisions without them
Adjust engagement approach to fit their availability (Correct answer)
Cancel the reviews

Correct answer: Adjust engagement approach to fit their availability

Adapting the engagement method keeps important stakeholders involved.

Question 73: A project team is in the early stages of identifying risks. They want to perform a comprehensive analysis that considers both internal project factors and external environmental factors, as well as their positive (opportunities) and negative (threats) aspects. Which of the following tools provides the best framework for this type of broad-spectrum analysis?

Cause-and-Effect Diagram
Assumption Analysis
SWOT Analysis (Correct answer)
Root Cause Analysis

Correct answer: SWOT Analysis

SWOT Analysis is a tool used to identify risks by examining the project from four perspectives: Strengths, Weaknesses, Opportunities, and Threats. Strengths and Weaknesses are internal to the organization, while Opportunities and Threats are external. This structure directly addresses the scenario's requirement to analyze internal and external positive and negative factors.

Question 74: A project manager is reviewing the project charter and initial planning documents. They are specifically looking for factors that are considered to be true, real, or certain without proof, as well as limitations placed on the project team. The purpose of this review is to uncover risks related to these items being incorrect or restrictive. This activity is an example of which risk identification technique?

Documentation Reviews
Checklist Analysis
SWOT Analysis
Assumption and Constraint Analysis (Correct answer)

Correct answer: Assumption and Constraint Analysis

Assumption and Constraint Analysis is a technique where the team systematically reviews the project's assumptions and constraints to identify risks. An assumption being proven false is a significant source of risk. Likewise, constraints limit the team's options and can introduce risks. While this is a form of Documentation Review, Assumption and Constraint Analysis is the more specific and accurate name for the described activity.

Question 75: Outsourcing a complex software module to a specialized vendor with a fixed-price contract to reduce a threat is an example of:

Transfer (Correct answer)
Escalate
Accept
Avoid

Correct answer: Transfer

A fixed-price contract transfers the cost-overrun threat to the vendor, making it a Transfer strategy.

Question 76: A project team identifies a risk that a new manufacturing process might have a higher-than-expected defect rate. To address this, the team decides to conduct a small-scale pilot run of the process, implement additional quality control checkpoints, and provide extra training to the machine operators. These actions BEST exemplify which threat response strategy?

Mitigate (Correct answer)
Escalate
Avoid
Transfer

Correct answer: Mitigate

The 'Mitigate' strategy aims to reduce the probability of a risk's occurrence and/or its impact on project objectives to an acceptable threshold. The pilot run, added quality checks, and training are all proactive steps designed to decrease the likelihood and severity of the high defect rate.

Question 77: Two stakeholders disagree about a risk's priority. What is the risk manager's best first step?

Pick the higher-ranking stakeholder's view
Escalate immediately to the sponsor
Drop the risk from the register
Facilitate discussion to align understanding (Correct answer)

Correct answer: Facilitate discussion to align understanding

Facilitating dialogue often resolves differing risk perceptions before escalation.

Question 78: Which input provides the overall risk attitudes and tolerances of stakeholders?

Work breakdown structure
Quality metrics
Activity cost estimates
Enterprise environmental factors (Correct answer)

Correct answer: Enterprise environmental factors

Enterprise environmental factors include stakeholder risk appetites and tolerances that shape planning.

Question 79: Which of the following is a primary objective of the Perform Qualitative Risk Analysis process?

To prioritize identified individual project risks for subsequent analysis or action (Correct answer)
To identify and document all potential project risks
To develop detailed strategies for responding to high-priority risks
To determine the overall project risk exposure numerically

Correct answer: To prioritize identified individual project risks for subsequent analysis or action

The core purpose of qualitative risk analysis is to prioritize individual project risks. This is done by assessing their probability of occurrence and impact, which helps the team focus on the most critical risks. Determining numerical exposure is quantitative analysis, identifying risks is the 'Identify Risks' process, and developing strategies is the 'Plan Risk Responses' process.

Question 80: A stakeholder demands a risk be removed because it reflects poorly on their department. The risk manager should:

Keep the risk documented and address concerns transparently (Correct answer)
Hide the risk from reports
Reassign blame
Delete the risk as requested

Correct answer: Keep the risk documented and address concerns transparently

Risks must remain documented; integrity outweighs political pressure.

Question 81: Which tool uses categories such as PESTLE, TECOP, or VUCA to stimulate ideas about sources of individual project risk?

Decision trees
Affinity diagrams
Prompt lists (Correct answer)
Cause-and-effect diagrams

Correct answer: Prompt lists

Prompt lists are predetermined lists of risk categories (PESTLE, TECOP, VUCA) that prompt teams to consider relevant risk sources.

Question 82: A software development project requires a specialized data encryption module. Rather than developing the module in-house, which carries significant technical and security risks, the project manager decides to procure a certified, third-party component and sign a service-level agreement that includes warranties and financial penalties for failure. Which strategy does this action represent?

Accept
Mitigate
Avoid
Transfer (Correct answer)

Correct answer: Transfer

The 'Transfer' strategy shifts the ownership and/or negative impact of a threat to a third party. By purchasing a component with warranties and a service-level agreement, the financial and performance-related consequences of the risk are shifted to the vendor.

Question 83: What is the primary purpose of implementing risk responses in the project lifecycle?

To perform quantitative analysis
To identify new risks
To close the project
To ensure agreed-upon responses are executed as planned (Correct answer)

Correct answer: To ensure agreed-upon responses are executed as planned

Implement Risk Responses ensures that the responses planned during Plan Risk Responses are actually carried out.

Question 84: A project team repeatedly identifies superficial problems as risks. For example, they list 'schedule delays' as a risk. The risk manager wants to guide the team to identify the fundamental conditions that would cause a schedule delay, such as 'lack of skilled resources' or 'unrealistic productivity estimates.' Which technique is focused on digging deeper than the symptoms to find the underlying causes of potential risks?

Interviews
Brainstorming
SWOT Analysis
Root Cause Analysis (RCA) (Correct answer)

Correct answer: Root Cause Analysis (RCA)

Root Cause Analysis (RCA) is a systematic process used to identify the underlying, fundamental causes of a problem or risk, rather than just addressing the surface-level symptoms. By asking 'why' repeatedly (a common RCA method), the team can move from a symptom like 'schedule delays' to a root cause like 'inadequate resource planning process,' which is a more useful risk to manage.

Question 85: A project is experiencing risk information overload. What is the best corrective action?

Prioritize and filter risk reporting using agreed-upon thresholds (Correct answer)
Expand the risk register indefinitely
Delegate all communication to the sponsor
Stop identifying new risks

Correct answer: Prioritize and filter risk reporting using agreed-upon thresholds

Applying risk thresholds ensures that only actionable, significant risks are escalated and communicated, reducing information noise.

Question 86: Which document feeds risk-related lessons into organizational process assets at project close?

The risk register and risk report (Correct answer)
The project budget only
The procurement contract
The communications plan

Correct answer: The risk register and risk report

Final versions of the risk register and risk report capture lessons learned for organizational process assets.

Question 87: How does effective stakeholder engagement reduce secondary risks?

It removes all uncertainty
It guarantees zero issues
It eliminates the need for contingency
Early buy-in reduces resistance that creates new risks (Correct answer)

Correct answer: Early buy-in reduces resistance that creates new risks

Engaged stakeholders are less likely to introduce resistance-driven risks.

Question 88: Typically, the organization specifies risk-rating rules in advance of the project and includes them in __________________.

organizational impact assessment (Correct answer)
organizational risk register
organizational process assets
organizational environmental factors

Correct answer: organizational impact assessment

Risk-rating rules, which define how an organization assesses the probability and impact of risks, are crucial for consistent risk evaluation. These rules are typically established as part of the organization's overall framework for evaluating potential impacts, often referred to as its 'organizational impact assessment' methodology. This ensures a standardized approach to determining risk severity across all projects.

Question 89: During a risk identification workshop, a project team has identified a significant risk: "The new user interface may have a high defect rate." The risk manager now wants the team to explore the underlying reasons for this potential issue to uncover more specific, actionable risks. Which tool would be most effective for this purpose?

Cause-and-Effect (Ishikawa) Diagram (Correct answer)
Delphi Technique
Probability and Impact Matrix
Assumption and Constraint Analysis

Correct answer: Cause-and-Effect (Ishikawa) Diagram

A Cause-and-Effect Diagram, also known as an Ishikawa or Fishbone Diagram, is the ideal tool for this scenario. It helps teams brainstorm and visually organize the potential causes of a specific problem or risk event (the 'effect'), grouping them into categories like Manpower, Method, Machine, etc. This directly supports the goal of exploring the underlying reasons for the high defect rate. The other tools serve different purposes: Delphi gathers expert opinion, the P&I Matrix is for analysis (not identification of causes), and Assumption Analysis reviews foundational beliefs.

Question 90: Which threat response strategy involves shifting both the impact and ownership of a risk to a third party?

Escalate
Mitigate
Transfer (Correct answer)
Avoid

Correct answer: Transfer

Transfer moves the negative impact and response ownership to a third party, often via insurance or contracts.

Question 91: A project manager is running a project to develop a new mobile application. An opportunity is identified where a new, unproven programming language could potentially reduce development time by 15%. However, the team lacks expertise, and the potential benefits are not significant enough to warrant dedicated training or hiring. The team decides to take no proactive steps but documents the opportunity in the risk register to be revisited if other schedule delays occur. This is an example of which opportunity response strategy?

Enhance
Share
Accept (Correct answer)
Exploit

Correct answer: Accept

The 'Accept' strategy acknowledges the existence of an opportunity but involves a decision not to take any proactive action. This can be a valid choice when the potential benefits do not justify the cost or effort of a more aggressive response. By documenting the opportunity for future consideration, the team is performing passive or active acceptance, but not actively pursuing it like in Enhance or Exploit strategies.

Question 92: A team reviews the assumptions log to test whether each assumption is valid and complete. This is an example of which technique?

Assumption and constraint analysis (Correct answer)
Interviewing
Prompt lists
Document analysis

Correct answer: Assumption and constraint analysis

Assumption and constraint analysis explores the validity of assumptions and constraints to identify risks from their inaccuracy or instability.

Question 93: In a decision tree analysis, a node represented by a square typically indicates what?

A chance (probabilistic) event
A decision point (Correct answer)
The end payoff
A risk trigger

Correct answer: A decision point

In decision trees, square nodes represent decisions while circular nodes represent chance events.

Question 94: When tailoring risk communication, the risk manager should consider stakeholder:

Only the schedule
Culture, location, and language preferences (Correct answer)
Only their job title
Only the project budget

Correct answer: Culture, location, and language preferences

Effective communication accounts for cultural, linguistic, and locational factors.

Question 95: A project manager is reviewing weekly performance reports. For the last three consecutive weeks, the Schedule Performance Index (SPI) has been declining from 0.95 to 0.88 to 0.81. This observation is an example of which tool or technique used in Monitor Risks?

Reserve analysis
Risk audit
Technical performance measurement
Trend analysis (Correct answer)

Correct answer: Trend analysis

Trend analysis is a data analysis technique that uses historical results to forecast future outcomes. [11] By examining project performance data over time, such as the declining SPI, a project manager can identify patterns or trends that may indicate increasing risk and predict future performance if no corrective actions are taken. [14, 6]

Question 96: The project manager wishes to use the risk rating rule. Which of the following answers the same question?

Risk probability and impact matrix
Enterprise environmental factors
Organizational process assets (Correct answer)
Risk management plan

Correct answer: Organizational process assets

Organizational Process Assets (OPAs) are the plans, processes, policies, procedures, and knowledge bases specific to and used by the performing organization. Risk rating rules, including definitions of probability and impact, and the probability and impact matrix, are typically established within an organization's standard operating procedures and stored as OPAs for consistent application across projects.

Question 97: During risk monitoring, a previously identified risk has not occurred and its triggers are no longer relevant. What is the appropriate action?

Re-perform quantitative analysis
Escalate the risk to the sponsor
Increase the contingency reserve
Close the risk and update the risk register (Correct answer)

Correct answer: Close the risk and update the risk register

Risks that are no longer relevant should be closed and documented in the risk register.

Question 98: Which distribution is most commonly used in three-point estimating with optimistic, most likely, and pessimistic values?

Binomial distribution
Poisson distribution
Triangular or PERT (beta) distribution (Correct answer)
Uniform distribution

Correct answer: Triangular or PERT (beta) distribution

Three-point estimates feed triangular or PERT/beta distributions in quantitative analysis.

Question 99: Which risk identification tool examines the project from the perspectives of Strengths, Weaknesses, Opportunities, and Threats?

Checklist analysis
Root cause analysis
Assumption analysis
SWOT analysis (Correct answer)

Correct answer: SWOT analysis

SWOT analysis identifies internal strengths/weaknesses and external opportunities/threats, surfacing both positive and negative risks.

Question 100: A risk manager is facilitating a periodic review to examine and document the effectiveness of the risk response planning and the performance of the risk owners in executing their assigned responsibilities. What is this activity called?

Variance Analysis
Risk Audit (Correct answer)
Risk Reassessment
Status Meeting

Correct answer: Risk Audit

A risk audit is a formal process used to assess the effectiveness of the risk management process, including the planning of responses and the performance of risk owners. [15, 25] It evaluates how well the risk management plan is working, rather than just reassessing individual risks.

Question 101: A risk manager is preparing an executive dashboard. Which presentation style is most appropriate for senior leadership?

Detailed technical analysis with raw data tables
High-level summary with key risk indicators and trend arrows (Correct answer)
Full risk register printout
Probability distributions for every risk

Correct answer: High-level summary with key risk indicators and trend arrows

Executives need concise, visual summaries with trend information rather than detailed technical data.

Question 102: In a PMI-RMP context, what is the primary difference between a risk and an issue in reporting?

Issues are only tracked by the sponsor
Risks are always more costly than issues
Risks are never documented in writing
A risk is an uncertain future event; an issue is a problem that has already occurred (Correct answer)

Correct answer: A risk is an uncertain future event; an issue is a problem that has already occurred

Risks are potential future events with uncertainty, while issues are risks that have materialized and require immediate action.

Question 103: Which of the following best describes the concept of risk categorization in project risk management?

Assigning a probability and impact rating to each identified risk
Ranking risks from highest to lowest priority for response planning
Grouping risks by their source, area of impact, or other useful classification (Correct answer)
Documenting risks in the risk register with owner assignments

Correct answer: Grouping risks by their source, area of impact, or other useful classification

Risk categorization involves grouping risks by characteristics such as their source, affected area, or phase to facilitate analysis and response planning.

Question 104: A risk that remains after planned responses have been implemented is called:

Emergent risk
Secondary risk
Residual risk (Correct answer)
Trigger risk

Correct answer: Residual risk

Residual risk is the exposure that remains after risk responses have been carried out.

Question 105: A project team is faced with a critical decision: either build a new component in-house or outsource it. Building in-house has a 60% chance of success with a profit of $500,000, and a 40% chance of failure with a loss of $200,000. Using Expected Monetary Value (EMV) analysis, what is the EMV of the 'build in-house' option?

$220,000 (Correct answer)
$80,000
$300,000
$380,000

Correct answer: $220,000

The EMV is calculated by multiplying the probability of each outcome by its value and summing the results. For the 'build in-house' option: EMV = (0.60 * $500,000) + (0.40 * -$200,000) = $300,000 - $80,000 = $220,000.

Question 106: A stakeholder's risk attitude shifts from accepting to averse mid-project. The risk manager should:

Replace the stakeholder
Restart the project
Ignore the change
Update the stakeholder analysis and adjust engagement (Correct answer)

Correct answer: Update the stakeholder analysis and adjust engagement

Risk attitudes change, so analysis and engagement must be revisited.

Question 107: Which document defines the methodology, roles, and timing for risk activities?

Stakeholder register
Scope statement
Risk management plan (Correct answer)
Project charter

Correct answer: Risk management plan

The risk management plan describes how risk management activities will be structured and performed.

Question 108: What is the main reason a project uses Monte Carlo simulation instead of a single deterministic estimate?

It models combined uncertainty to produce a range of probable outcomes (Correct answer)
It replaces qualitative risk analysis entirely
It guarantees the project will finish on budget
It eliminates the need for a risk register

Correct answer: It models combined uncertainty to produce a range of probable outcomes

Monte Carlo captures combined uncertainty, yielding a probability distribution rather than one number.

Question 109: Which of the following statements provides the most accurate distinction between the 'Mitigate' and 'Avoid' threat response strategies?

Mitigation is a passive strategy that uses contingency reserves, while Avoidance is an active strategy.
Mitigation involves third parties through contracts, while Avoidance focuses on changing the project schedule.
Avoidance aims to eliminate the cause of a threat entirely, while Mitigation seeks to reduce its probability or impact. (Correct answer)
Avoidance is only used for risks with high financial impact, while Mitigation is used for schedule risks.

Correct answer: Avoidance aims to eliminate the cause of a threat entirely, while Mitigation seeks to reduce its probability or impact.

The core difference lies in their objective. The 'Avoid' strategy seeks to eliminate the risk altogether, often by changing the project plan, scope, or objectives so the threat can no longer have an impact. In contrast, 'Mitigate' accepts that the risk will still exist but takes proactive steps to reduce its likelihood of occurring or the severity of its impact if it does.

Question 110: An influential stakeholder becomes resistant after a risk response increases project cost. What should the risk manager do?

Wait for them to comply
Bypass the stakeholder
Cancel the risk response
Engage them to explain trade-offs and rebuild support (Correct answer)

Correct answer: Engage them to explain trade-offs and rebuild support

Active engagement and transparency on trade-offs help restore stakeholder support.

Question 111: Which of the following is typically a top-level category in a standard Risk Breakdown Structure?

Technical risks (Correct answer)
Change requests
Schedule variance
Cost overrun

Correct answer: Technical risks

Technical risks is a common top-level RBS category, alongside external, organizational, and project management risks, representing a major source of project uncertainty.

Question 112: A missed activity completion date may necessitate budget and schedule adjustments and trade-offs. What can be done to reduce control over the head?

human resources requirements must be met
management through exception procedures and other techniques can be considered (Correct answer)
the project's chosen life cycle and the processes that will be used in each phase
needs and techniques for communication among stakeholders can be done

Correct answer: management through exception procedures and other techniques can be considered

Management by exception is a technique where the project manager only intervenes when actual project results deviate significantly from planned results. By focusing only on critical variances, this approach reduces the need for constant, detailed oversight. This allows the project manager to delegate routine monitoring and concentrate on high-priority issues, thereby reducing control overhead.

Question 113: A project manager is preparing a high-level presentation for the steering committee. The presentation needs to provide a snapshot of the overall project risk exposure and a summary of the top five threats and opportunities. Which of the following is true regarding the documents used?

The risk register is used for opportunities, while the risk report is used exclusively for threats.
The risk register is a detailed log of all risks, while the risk report summarizes this information for stakeholder communication. (Correct answer)
The risk report is the primary input for creating the detailed risk register.
The risk register and risk report are identical documents used for this purpose.

Correct answer: The risk register is a detailed log of all risks, while the risk report summarizes this information for stakeholder communication.

The risk register is a comprehensive document that lists and tracks all identified individual risks and their details. The risk report, on the other hand, is a summary-level document that provides an overview of overall project risk and key individual risks, tailored for communication with stakeholders like a steering committee. The risk report is derived from the detailed information in the risk register.

Question 114: How does risk appetite influence the selection of risk response strategies?

It has no influence on response strategies
It only affects opportunity responses
It determines the number of risks in the register
It determines how aggressively the team pursues mitigation versus acceptance (Correct answer)

Correct answer: It determines how aggressively the team pursues mitigation versus acceptance

A low risk appetite drives more aggressive mitigation or avoidance, while a higher appetite may allow acceptance of risks that others would transfer or mitigate.

Question 115: A risk audit is primarily used to evaluate what during Monitor Risks?

The accuracy of the project schedule
The financial health of the vendor
The quality of stakeholder communication
The effectiveness of risk responses and the risk management process (Correct answer)

Correct answer: The effectiveness of risk responses and the risk management process

Risk audits examine and document the effectiveness of risk responses and the overall risk process.

PMI Risk Management Professional (PMI-RMP)

The PMI-RMP certification validates advanced expertise in risk management, covering risk strategy and planning, identification, analysis, response, and monitoring/closing for complex projects and programs.

115

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

pmi.org — Exam format, retake policy, test dates, test delivery, renewal, score validity, exam information · verified Oct 2026