Project Risk Management Technology & Digital Applications 3 — Questions and Answers
Question 1: A project team uses version control (Git) for all deliverables. A developer accidentally force-pushes to the main branch, overwriting peer-reviewed code. Which risk control was MISSING?
- Risk acceptance policy
- Branch protection rules and merge permissions (Correct answer)
- A project communications plan
- A Monte Carlo model for code quality
Correct answer: Branch protection rules and merge permissions
Branch protection rules prevent unauthorized force-pushes and are a technical control that mitigates code-loss risk.
Question 2: Which of the following BEST describes a 'zero-day vulnerability' in the context of project risk management?
- A risk with zero probability assigned during qualitative analysis
- A software flaw unknown to the vendor that attackers can exploit immediately (Correct answer)
- A risk that has a zero-day response time requirement
- A legacy system bug documented on day zero of the project
Correct answer: A software flaw unknown to the vendor that attackers can exploit immediately
A zero-day vulnerability is an unknown software flaw exploitable before the vendor can issue a patch, posing significant unplanned risk.
Question 3: A project's technology stack depends on an open-source library that has not been maintained for two years. This BEST represents which type of risk?
- Positive risk
- Technical debt and dependency risk (Correct answer)
- Regulatory compliance risk
- Resource availability risk
Correct answer: Technical debt and dependency risk
Relying on an unmaintained library creates dependency risk—security vulnerabilities and compatibility issues may emerge without vendor support.
Question 4: A risk workshop identifies that automated testing tools may fail to detect edge-case bugs before deployment. The BEST risk response is to:
- Transfer risk by hiring a QA contractor
- Accept the risk and deploy on schedule
- Supplement automated tests with targeted exploratory testing (Correct answer)
- Avoid the risk by removing automated testing entirely
Correct answer: Supplement automated tests with targeted exploratory testing
Supplementing automated tests with exploratory testing addresses gaps that automated tools cannot reliably detect.
Question 5: A project manager wants to quantify the financial impact of a system integration failure. Which tool is MOST appropriate?
- SWOT analysis
- Expected Monetary Value (EMV) analysis (Correct answer)
- Fishbone diagram
- Stakeholder register
Correct answer: Expected Monetary Value (EMV) analysis
EMV analysis multiplies probability by monetary impact, providing a quantified financial estimate of the risk.
Question 6: During a digital project, the team discovers that the selected encryption algorithm is scheduled for deprecation by a standards body within 18 months. This risk is BEST described as:
- An unknown-unknown risk
- A known risk requiring proactive mitigation planning (Correct answer)
- A positive risk to be exploited
- An accepted residual risk
Correct answer: A known risk requiring proactive mitigation planning
Since the deprecation timeline is known, this is a known risk that should be logged and mitigated before the standard is retired.
Question 7: A project team migrates data to a new platform. During testing, 3% of records are found to be corrupted. Which risk response strategy was MOST LIKELY absent?
- Risk avoidance
- Data validation and integrity checks during migration (Correct answer)
- Risk transfer through insurance
- Stakeholder communication planning
Correct answer: Data validation and integrity checks during migration
Data validation and integrity checks during migration detect corruption early, preventing downstream failures.
Project Risk Management Technology & Digital Applications 3
A project team uses version control (Git) for all deliverables.
A developer accidentally force-pushes to the main branch, overwriting peer-reviewed code.
Which risk control was MISSING?