Project Risk Management Technology & Digital Applications 5 — Questions and Answers
Question 1: A project team is implementing a DevSecOps pipeline. Which risk management benefit does 'shifting security left' PRIMARILY provide?
- Reduces time spent in stakeholder meetings
- Identifies and remediates security vulnerabilities earlier in the development lifecycle (Correct answer)
- Eliminates the need for penetration testing
- Transfers security risk to the cloud provider
Correct answer: Identifies and remediates security vulnerabilities earlier in the development lifecycle
Shifting security left embeds security checks early in development, where defects are far cheaper to fix than post-deployment.
Question 2: A project's risk register includes: 'Probability: 0.4, Impact: $50,000.' What is the Expected Monetary Value (EMV) of this risk?
- $50,000
- $20,000 (Correct answer)
- $90,000
- $12,500
Correct answer: $20,000
EMV = Probability × Impact = 0.4 × $50,000 = $20,000.
Question 3: A project is migrating to a containerized environment using Docker and Kubernetes. Which risk is MOST specific to container orchestration?
- Vendor lock-in to a single database provider
- Misconfigured container permissions exposing sensitive workloads (Correct answer)
- Insufficient project budget for hardware
- Stakeholder resistance to agile methodologies
Correct answer: Misconfigured container permissions exposing sensitive workloads
Misconfigured RBAC and container security contexts are a leading source of breaches in Kubernetes environments.
Question 4: During a risk review, the team identifies that a critical project tool vendor has only one employee supporting integrations. This is BEST classified as:
- A positive risk opportunity
- A single point of failure (SPOF) and key person dependency risk (Correct answer)
- A regulatory compliance risk
- An accepted risk requiring no action
Correct answer: A single point of failure (SPOF) and key person dependency risk
Reliance on a single vendor employee creates a key person dependency SPOF—loss of that person can halt integration support.
Question 5: A project manager is assessing risks for a real-time data streaming system. Which failure mode warrants a specific risk entry for 'data loss at scale'?
- UI refresh rate delays
- Message queue overflow when consumers lag behind producers (Correct answer)
- Insufficient documentation of API endpoints
- Sponsor approval delays for change requests
Correct answer: Message queue overflow when consumers lag behind producers
When consumers cannot process messages fast enough, queue overflow can lead to dropped or lost messages at scale.
Question 6: A project team wants to reduce the risk of scope creep caused by uncontrolled feature additions to a digital platform. The BEST preventive control is:
- Issuing a risk transfer contract to the vendor
- Implementing a formal change control board (CCB) with documented approval workflows (Correct answer)
- Accepting all feature requests to maintain stakeholder satisfaction
- Running daily standups to track progress
Correct answer: Implementing a formal change control board (CCB) with documented approval workflows
A CCB enforces structured evaluation and approval of changes, preventing ad hoc scope additions that inflate risk.
Question 7: Which of the following BEST describes a 'residual risk' in a technology project after implementing encryption for data at rest?
- The original risk before encryption was applied
- The remaining risk of data exposure if encryption keys are compromised (Correct answer)
- A new risk introduced by the encryption implementation
- A risk that has been fully eliminated by the control
Correct answer: The remaining risk of data exposure if encryption keys are compromised
Residual risk is the remaining exposure after a control is applied—encryption reduces but does not eliminate risk if key management is weak.
Project Risk Management Technology & Digital Applications 5
A project team is implementing a DevSecOps pipeline.
Which risk management benefit does 'shifting security left' PRIMARILY provide?