PfMP Portfolio Risk Management Practice Test 3 — 15 Questions

Question 1

Which THREE components are found in a Portfolio Risk Register?

Accepted Answer

Planned risk response.. The Portfolio Risk Register is a governance artifact that records each identified portfolio-level risk along with structured attributes, so option C (Risk description) is correct because every register entry must clearly state the risk event and its cause so it can be assessed and owned. Option D (Risk impact/severity score) is correct because each risk is rated for probability and impact (often using a qualitative scale or numeric score) to enable prioritization and escalation decisions across the portfolio. Option A (Planned risk response) is correct because the register documents the agreed response strategy — such as avoid, mitigate, transfer, or accept — along with the assigned risk owner and target date. Option B (Project team lunch menu) is incorrect because catering logistics are unrelated to risk governance, and option E (Personal salary data of project leads) is incorrect because HR compensation data is confidential and outside the scope of a risk register.

Answer

Project team lunch menu.

Answer

Personal salary data of project leads.

Question 2

Which TWO of the following are sources for identifying portfolio risks?

Accepted Answer

Project status reports.. Option B, project status reports, is a valid source for identifying portfolio risks because these reports surface schedule variances, budget overruns, resource constraints, and issue logs from individual projects that can aggregate into portfolio-level risk exposure. Option C, stakeholder interviews, is also correct because direct engagement with sponsors, program managers, and other stakeholders elicits qualitative risk information such as emerging threats, assumptions, dependencies, and concerns not yet captured in formal documentation. The remaining options do not belong: A (cafeteria menu), D (social media gossip channels), and E (office climate control settings) are unrelated to formal risk identification inputs and are not recognized sources under portfolio risk management practices such as those in PMI's Standard for Portfolio Management.

Answer

The cafeteria menu.

Answer

Social media gossip channels.

Answer

Office climate control settings.

Question 3

Which THREE of the following are quantitative analysis techniques?

Accepted Answer

Decision tree analysis.. Decision tree analysis (B) is a quantitative technique because it assigns monetary values and probabilities to branches to compute expected monetary value (EMV) for each alternative. Monte Carlo analysis (C) is quantitative because it runs repeated random simulations of cost or schedule variables to produce a probabilistic distribution of outcomes, such as a confidence level for completing within budget. Sensitivity analysis (D) is quantitative because it numerically varies one input at a time (e.g., a tornado diagram) to measure how much each variable affects the outcome. SWOT analysis (A) is a qualitative strategic assessment of strengths, weaknesses, opportunities, and threats, and brainstorming (E) is a qualitative group idea-generation technique, so neither relies on numerical modeling.

Answer

SWOT analysis.

Answer

Brainstorming.

Question 4

Which TWO are common triggers for a portfolio risk review?

Accepted Answer

A major milestone failure in a critical program.. Option C is correct because a major milestone failure in a critical program is a significant risk event that can invalidate the portfolio's assumptions, dependencies, and schedule baselines, so it should trigger a portfolio risk review to reassess exposure and re-prioritize. Option E is correct because a change in organizational strategy alters the portfolio's strategic alignment, investment criteria, and risk appetite, which requires a formal review of portfolio risks to ensure the portfolio still supports the new direction. Options A, B, and D are not valid triggers: monthly coffee supply, office desk layout, and the start of a new work week are routine or administrative matters with no material impact on portfolio risk, strategic alignment, or program performance.

Answer

Arrival of the monthly coffee supply.

Answer

Change in office desk layout.

Answer

The start of a new work week.

Question 5

Which TWO of the following are steps in the portfolio risk management process?

Accepted Answer

Risk monitoring.. Risk identification (E) is a core step in the portfolio risk management process because it is where risks that could affect portfolio objectives are systematically discovered and documented before they can be analyzed or addressed. Risk monitoring (A) is equally essential, as it continuously tracks identified risks, watches for new or changing risks, and verifies that risk responses remain effective throughout the portfolio lifecycle. Together, identification and monitoring form part of the standard iterative risk management cycle (identify, analyze, respond, monitor). The remaining options do not belong: project team hiring (B) is a resource management activity, office cleaning (C) is a facilities task, and annual holiday planning (D) is an administrative scheduling matter, none of which are steps in the portfolio risk management process.

Answer

Project team hiring.

Answer

Office cleaning.

Answer

Annual holiday planning.

Question 6

Which THREE are key elements of a portfolio risk management culture?

Accepted Answer

Accountability for risks.. A portfolio risk management culture requires clear accountability for risks, meaning named owners are responsible for identifying, assessing, and responding to risks throughout the portfolio lifecycle. Proactive communication is essential because risks must be surfaced early and shared across projects, programs, and governance bodies so mitigation can occur before issues escalate. Transparency in reporting is also key, as accurate, timely risk reporting to stakeholders and governance boards enables informed decisions and effective prioritization. Hiding risks until year-end undermines early mitigation and is the opposite of a healthy risk culture, while blaming staff for delays destroys psychological safety and discourages honest risk disclosure.

Answer

Hiding all risks until the end of the year.

Answer

Blaming staff for project delays.

Question 7

You are the portfolio manager for a financial services firm's digital transformation portfolio. Your portfolio risk management plan specifies a 95% confidence level and a one-year horizon for quantitative risk analysis. The CIO asks why the aggregate portfolio contingency reserve, calculated via Monte Carlo simulation, is significantly larger than the sum of the individual component contingency reserves. What is the most likely explanation for this difference?

Accepted Answer

The aggregate reserve accounts for portfolio-level risks and correlations between component risks that are not captured when summing individual reserves.. Aggregate portfolio risk is not simply the sum of component risks. It incorporates portfolio-level risks, shared risk drivers, and correlations among components. Positive correlations can amplify aggregate exposure, while negative correlations can reduce it. Monte Carlo simulation at the portfolio level captures these effects, so the aggregate contingency reserve can legitimately be larger than the sum of individual component reserves.

Answer

The sum of individual contingency reserves is calculated at a lower confidence level than the portfolio-level simulation.

Answer

Portfolio-level Monte Carlo simulation double-counts risks that appear in multiple components, inflating the aggregate reserve.

Answer

Monte Carlo simulation always overestimates reserve requirements because it assumes worst-case correlations among all risks.

Question 8

You are managing a portfolio of IT infrastructure projects. A new regulatory requirement is expected to increase the cost of compliance for all projects in the portfolio by 10-15% over the next fiscal year. Your portfolio sponsor asks you to update the portfolio risk register and recommend a response strategy. Which action best aligns with portfolio risk management principles?

Accepted Answer

Conduct a portfolio-level risk assessment to quantify the aggregate impact, then develop a coordinated response plan that may include renegotiating contracts, adjusting budgets, or rebalancing components.. Portfolio risk management requires assessing risks that affect multiple components at the portfolio level. A regulatory change impacting all projects should be quantified in aggregate, then addressed with a coordinated response that may include portfolio-wide mitigation, transfer, or avoidance strategies. This ensures efficient use of resources and alignment with strategic objectives, rather than fragmented project-level responses.

Answer

Escalate the risk to the portfolio governance board and recommend rebalancing the portfolio to include projects with lower compliance exposure.

Answer

Accept the risk because regulatory changes are external and cannot be mitigated, and increase the portfolio contingency reserve by 15%.

Answer

Instruct each project manager to include the regulatory risk in their individual project risk registers and manage it locally.

Question 9

Your portfolio includes a large infrastructure program and several smaller IT projects. A new regulatory requirement mandates that all projects comply with stricter data privacy controls within six months. You need to prioritize where to apply limited compliance resources. Which portfolio risk management action should you take FIRST?

Accepted Answer

Update the portfolio risk register to include the regulatory requirement and then reassess the portfolio's aggregate risk exposure.. The correct answer is to update the portfolio risk register and reassess aggregate risk exposure. This is the foundational step in portfolio risk management: identify and document the risk, then evaluate its impact across the portfolio. Only after this can you effectively prioritize compliance resources, potentially avoiding unnecessary schedule changes or escalations.

Answer

Immediately initiate a change request to extend all project deadlines by six months to accommodate compliance work.

Answer

Direct each project manager to handle compliance independently and report status monthly.

Answer

Escalate the regulatory requirement to the portfolio board for a decision on which projects to cancel.

Question 10

You are managing a portfolio of infrastructure projects. A new regulatory requirement is expected to increase costs for all projects using a specific technology. This risk has a high probability and high impact, but it is not yet reflected in any project risk register. As the portfolio manager, what should you do first?

Accepted Answer

Add the risk to the portfolio risk register and assess its aggregate impact across all affected projects.. The portfolio manager should first capture the emerging risk at the portfolio level and assess its aggregate impact. This allows for a coordinated, strategic response rather than isolated project actions. Only after understanding the portfolio-level exposure should specific responses, including escalation, be considered.

Answer

Direct each project manager to update their project risk registers and develop individual mitigation plans.

Answer

Ignore the risk until it materializes, as it is not yet in any project risk register and may not occur.

Answer

Immediately escalate to the portfolio board to request additional funding to cover the expected cost increases.

Question 11

During a quarterly portfolio risk review, you notice that two strategic initiatives have risks that are individually rated as low, but when combined, they could cause a critical shared supplier to fail. This situation is an example of:

Accepted Answer

Risk correlation. The correct answer is risk correlation. When two risks interact, their combined effect can be greater than the sum of their individual impacts. In portfolio management, understanding correlations is essential because risks across projects may not be independent. A portfolio manager must assess how risks correlate to accurately evaluate aggregate risk exposure and prioritize responses.

Answer

Risk appetite

Answer

Risk transference

Answer

Risk mitigation

Question 12

You are conducting a portfolio risk review with your team. The portfolio board has asked you to identify inputs that are essential for effective portfolio risk management. Which two of the following are considered key inputs to the portfolio risk management process? (Choose two.)

Accepted Answer

Portfolio management plan. The portfolio management plan and portfolio risk register are essential inputs to portfolio risk management. The plan provides the governance framework and risk approach, while the register documents current risks and responses. Together, they enable systematic identification, analysis, and response planning.

Answer

Portfolio performance reports

Answer

Individual project schedules

Answer

Resource breakdown structure

Question 13

You are the portfolio manager for a pharmaceutical R&D portfolio. A new regulatory guideline is expected to significantly increase the cost and timeline for all clinical trials in the portfolio. You need to assess the overall impact on the portfolio's strategic objectives. Which action should you take first?

Accepted Answer

Perform a portfolio-level risk analysis to evaluate the aggregate impact of the regulatory change on all projects and programs.. The correct answer is to perform a portfolio-level risk analysis first. This approach ensures that the portfolio manager understands the aggregate impact of the regulatory change on all components, enabling informed decisions that align with strategic objectives. It is consistent with PfMP best practices for portfolio risk management, which emphasize a holistic view and proactive assessment.

Answer

Schedule a meeting with the portfolio board to request additional funding to cover the expected cost increases.

Answer

Immediately cancel the lowest-priority projects to free up budget for potential increased costs.

Answer

Instruct each project manager to update their individual risk registers with the new regulatory requirement.

Question 14

Your organization's portfolio includes a large infrastructure program that is 70% complete. A new regulatory requirement is announced that will mandate significant design changes across all remaining deliverables. The program manager reports that the changes can be absorbed within the existing schedule float but will increase costs by 12%. As the portfolio manager, what is the most appropriate first action?

Accepted Answer

Direct the program manager to submit a change request to the portfolio change control board for evaluation of the impact on portfolio benefits.. Regulatory changes that affect multiple portfolio components are portfolio-level risks requiring formal change control. The portfolio manager must ensure the change is evaluated for its impact on strategic benefits, funding, and other components. Directing the program manager to submit a change request to the portfolio change control board is the correct first step, as it engages the appropriate governance body to assess and decide on the change.

Answer

Instruct the program manager to fast-track the remaining work to avoid the cost increase, using the schedule float.

Answer

Accept the cost increase and update the portfolio risk register to reflect the new regulatory risk.

Answer

Escalate the issue to the project management office (PMO) to revise the program's baseline and reallocate funds from other projects.

Question 15

You are developing a portfolio risk management plan. Which TWO elements are essential to include in this plan? (Choose two.)

Accepted Answer

Risk thresholds and tolerances for the portfolio. The two essential elements are risk thresholds and tolerances, and the frequency and format of portfolio risk reviews. Risk thresholds and tolerances set the boundaries for acceptable risk, while review frequency and format ensure ongoing monitoring and control. Together, they provide the framework for consistent and effective portfolio risk management.

Answer

A detailed list of all project-level tasks

Answer

The names of all project team members

Answer

A copy of the organization's marketing strategy