PMI · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A PMO is standardizing risk management across multiple projects. They want to ensure that risk appetite is consistent across the organization. What is the most effective approach?
Only allow senior management to identify risks.
Publish an Enterprise Risk Management (ERM) policy that defines standard risk tolerance levels.
An ERM policy codifies organisation-wide risk tolerance levels, giving every project a common benchmark for evaluating and prioritising risks. This directly satisfies the PMO's goal of consistent risk appetite across multiple projects rather than relying on per-project judgement.
Mandate the use of a single, complex quantitative software tool.
Require all project managers to define their own risk appetite.
Your organization is transitioning to a hybrid methodology. During risk management planning, you must select an approach that accommodates both Agile delivery and Waterfall governance. Which strategy is most effective?
Use a central Risk Register managed exclusively by the PMO.
Tailor the Risk Management Plan to include iterative risk review sessions during sprint planning.
Tailoring the Risk Management Plan embeds iterative risk reviews within sprint planning, satisfying the hybrid constraint of Agile delivery alongside Waterfall governance. This preserves the formal, documented plan that governance requires while enabling frequent reassessment, so emerging risks surface each sprint rather than only at phase gates.
Adopt a purely Waterfall risk register for all work packages.
Eliminate the Risk Management Plan to reduce bureaucratic overhead.
Your project is highly sensitive to regulatory changes. How should you incorporate this into your risk strategy planning?
Outsource all regulatory compliance tasks to a third party.
Establish a regulatory risk watch list and define trigger conditions.
A regulatory watch list with defined trigger conditions converts ongoing regulatory uncertainty into monitored, actionable signals, embedding it into risk strategy rather than treating it as a one-off. This gives the project early warning and predefined responses to regulatory change.
Increase the reserve budget based on expert judgment.
Ignore the risk until a specific regulation is passed.
When establishing the risk management methodology, which document should be used to provide the framework and authority for risk activities?
Issue Log
Risk Management Plan
The Risk Management Plan defines how risk activities are structured, funded and governed, and it grants the authority and framework for performing them. It is the methodology document that guides risk identification, analysis, response planning and monitoring throughout the project.
Stakeholder Register
Project Charter
A project manager is developing the Risk Management Plan for a complex infrastructure project. The stakeholders have expressed concerns about potential financial volatility. Which action should the project manager take to align the plan with organizational expectations?
Assign a risk owner to every potential financial risk identified.
Immediately perform a qualitative risk analysis on all identified risks.
Define the project's risk appetite and tolerance levels with key stakeholders.
Defining risk appetite and tolerance with stakeholders directly addresses the financial volatility concern by establishing agreed thresholds for acceptable exposure. This satisfies the stem's requirement to align the Risk Management Plan with organisational expectations, since appetite and tolerance are foundational inputs that shape funding reserves, escalation triggers and response strategies.
Update the project scope to remove high-risk components.
During a project kickoff meeting, a senior stakeholder states they are 'very risk-averse' regarding project timelines but 'open to innovation' regarding technical solutions. How should the risk management plan reflect this?
Escalate all technical risks to the project sponsor immediately.
Ignore the stakeholder's comment as it is subjective.
Create separate risk tolerance thresholds for schedule-related risks and technical risks.
Risk tolerance thresholds are set per objective, so the stakeholder's low appetite for schedule slippage and high openness to technical experimentation require distinct thresholds. Separate schedule and technical tolerances satisfy both attitudes, letting responses to each risk category match the stated appetite.
Set a single, conservative risk tolerance threshold for all risk categories.
Want more Risk Strategy And Planning practice?
Practice this domainYou are fostering a risk culture in a team that historically hides risks. What is the best first step?
Communicate that identifying risks is a positive contribution to project success and not a sign of failure.
Communicating that risk identification is valued reframes the behaviour as a contribution rather than an admission of failure, directly addressing the psychological safety gap that causes the team to hide risks. This cultural signal must precede any process or tooling change to be effective.
Mandate a minimum number of risk entries for every team member.
Implement a reward system for those who identify the most risks.
Threaten to remove team members who fail to report risks.
During a project, a stakeholder refuses to accept a risk mitigation strategy that requires their department to allocate resources. What should the risk practitioner do first?
Conduct a stakeholder analysis to identify the stakeholder's interests and underlying concerns.
Before influencing the stakeholder, the practitioner must understand why they resist. Stakeholder analysis uncovers the department's interests, priorities and underlying concerns, enabling a tailored engagement approach rather than escalating or forcing the mitigation strategy prematurely.
Consult the Risk Management Plan for escalation procedures.
Inform the project sponsor that the risk is now an issue due to lack of support.
Force the implementation of the strategy as it was approved in the project plan.
Which communication method is most appropriate for informing stakeholders about a significant change in the project's risk profile?
Sending a brief text message to the team.
Updating the project's formal communication plan and issuing a status report to relevant stakeholders.
A significant risk-profile change demands formal, documented communication to the stakeholders it affects. Amending the communication plan and issuing a status report satisfies the need for a controlled, traceable channel, ensuring the right stakeholders receive consistent information rather than ad-hoc verbal updates.
Discussing it during a casual coffee break.
Posting the update on the company intranet without notifying anyone.
What is the primary benefit of maintaining a transparent risk register accessible to all project stakeholders?
It ensures that everyone is blamed if a risk occurs.
It fosters a proactive risk culture and improves risk awareness across the team.
Shared visibility of risks lets every stakeholder see threats, owners and responses, encouraging early reporting rather than concealment. That transparency builds a proactive culture and raises awareness across the team, satisfying the stated benefit of an accessible register.
It reduces the need for formal risk meetings.
It automatically resolves all high-impact risks.
A practitioner is developing a risk reporting dashboard for executive leadership. Which information is most critical to include to support effective decision-making?
A list of all individual risks including minor operational issues.
The total number of risks identified in the risk register.
The technical details of every mitigation action taken to date.
High-level risks aligned with project objectives and strategic business impact.
High-level risks aligned with project objectives and strategic business impact give executives the aggregated, outcome-focused view they need, rather than granular detail. This satisfies the stem's executive-audience constraint: leadership decides on strategic exposure and business impact, not on tactical task-level risks that operational teams manage.
A project stakeholder is concerned about the impact of a risk response on their budget. How should the risk practitioner respond?
Explain that risk management is separate from the project budget.
Immediately remove the mitigation strategy from the project plan.
Dismiss the concern as the mitigation is already approved.
Quantify the impact of the risk versus the cost of mitigation and present the analysis to the stakeholder.
Quantifying risk impact against mitigation cost directly addresses the stakeholder's budget concern, giving objective data to justify whether the response is worth its expense. This satisfies the stem's requirement to resolve the stakeholder's worry through analysis rather than reassurance.
Want more Stakeholder Engagement practice?
Practice this domainA risk audit has just been completed. What is the most critical activity to perform with the findings?
Update the risk management plan and register
Audit findings only create value once fed back into the risk management plan and risk register, updating response strategies, owners and reassessed exposures. This closes the audit loop and satisfies the stem's requirement to act on findings, ensuring risk processes reflect current effectiveness rather than remaining static documentation.
Discard the report to avoid negative visibility
Request a project budget increase immediately
Send the report to external regulatory bodies
Delete the risks identified during the audit
During project execution, you find that the 'Risk Response Owner' is not reporting updates. How should this be addressed within the project governance framework?
Update the risk yourself and hide the lack of participation
Escalate the accountability issue to the project sponsor
Escalating to the project sponsor satisfies the governance constraint because the sponsor owns project-level accountability when a designated owner fails to perform. The risk response owner's silence is a performance and authority gap the project manager cannot resolve alone; the sponsor can enforce accountability, reassign ownership, or direct corrective action.
Assign a new owner without informing the original owner
Remove the risk from the register
You are performing a periodic risk reassessment. A key risk has shifted from 'Low' to 'High' probability. What is the next immediate step in the reporting workflow?
Update the Probability and Impact Matrix and trigger a stakeholder notification
Re-scoring the risk in the Probability and Impact Matrix formally records the Low-to-High shift, and notifying stakeholders ensures the changed exposure is communicated before further response planning. Reporting workflow demands the register and matrix reflect current ratings first.
Schedule an immediate Steering Committee meeting
Close the risk and add it to the Issues Log
Immediately activate the contingency reserve
You are configuring a risk dashboard in a PMIS. Stakeholders need to see the 'Risk Burn-down' trend. Which data point must be tracked consistently to enable this report?
Aggregate risk exposure value
A risk burn-down chart plots remaining aggregate risk exposure over time, so the exposure value must be calculated and recorded consistently at each reporting interval. Tracking this single data point satisfies the stakeholder requirement to display the trend of diminishing overall risk exposure.
Owner assignment frequency
Total number of risks identified
Number of risk responses completed
When monitoring risk triggers, what is the primary purpose of a 'Risk Trigger' threshold field in your project management software?
To automate the closure of the risk entry
To define the escalation path for the project manager
To provide an objective indicator that a risk is about to occur
The threshold field stores a measurable value, such as a cost variance or schedule slip, that signals the risk is materialising. Crossing it gives an objective, pre-agreed cue to activate the response plan rather than relying on subjective judgement.
To notify the finance department of budget changes
During a risk audit, you identify that a previously closed risk has manifested. What is the most appropriate action to ensure accurate project risk status?
Archive the risk to maintain the dashboard clarity
Create a new risk entry in the Risk Register
Update the Lessons Learned repository only
Re-open the existing risk and update the response plan
A closed risk that has actually occurred must return to the register as active, because the risk status is no longer valid. Re-opening it preserves the original identification, owner and history, and lets the response plan be revised to reflect the realised threat.
Want more Risk Monitoring And Reporting practice?
Practice this domainYou are facilitating a risk identification session where one senior stakeholder dominates the conversation. Which facilitation approach would best mitigate this bias?
Assign a scribe to record everything
Request the senior stakeholder leave the room
Use a round-robin brainstorming session
Implement the Delphi Technique
The Delphi Technique gathers anonymous, iterative expert input through controlled questionnaires, removing dominant personalities from the room entirely. This directly neutralises the senior stakeholder's disproportionate verbal influence, satisfying the stem's constraint of mitigating bias caused by one participant dominating the identification session.
In a quantitative risk analysis, the cost contingency has been depleted, yet the risk remains. What is the next logical step in the risk process?
Accept the risk without further action
Update the risk register with a new probability estimate
Reduce the scope of the project
Escalate the risk to the project board or project sponsor
When contingency is exhausted but the risk persists, the project team lacks authority to fund further response, so the risk must be escalated to the project board or sponsor. This satisfies the stem's constraint of depleted contingency with residual risk.
You are facilitating a risk analysis session for a project with high technical uncertainty. Quantitative analysis results show a wide range of variance. What is the most appropriate action to improve the accuracy of the risk model?
Increase the number of iterations in the Monte Carlo simulation
Incorporate sensitivity analysis (Tornado Diagram) to refine input assumptions
Sensitivity analysis via a Tornado Diagram isolates which input variables drive the widest variance in the quantitative model, letting the team refine those specific assumptions first. This directly addresses the stem's high technical uncertainty by targeting the inputs contributing most to output spread, improving model accuracy efficiently.
Remove the extreme outliers from the risk dataset
Change the probability distribution type from Normal to Triangular
You are managing a global project and need to perform a quantitative risk analysis. The data provided by local offices varies significantly in quality. What is your first step?
Discard the data from the office with the lowest quality
Perform a Risk Data Quality Assessment
A Risk Data Quality Assessment evaluates the accuracy, reliability, and integrity of the data gathered from local offices before quantitative analysis. This addresses the stem's constraint of varying data quality, ensuring inputs are trustworthy first.
Proceed with Monte Carlo simulation and interpret the wide variance
Normalize the data using a standard deviation calculation
A project manager wants to maintain the risk register. Which field is strictly required to prioritize risks during the qualitative analysis phase?
Probability and Impact
Qualitative analysis ranks risks by multiplying or plotting probability against impact, so these two fields are mandatory inputs for every register entry. Without both values, no risk score or priority ordering can be derived during the assessment.
Risk Response Strategy
Risk Owner
Risk Category
During a risk workshop, stakeholders are struggling to differentiate between root causes and symptoms. Which facilitation technique should you employ to ensure the risk register accurately reflects the true origin of risks?
Five Whys
Five Whys iteratively asks why each stated problem occurs, drilling past symptoms to the underlying causal factor. Applied during the workshop, it produces risk register entries describing genuine root causes rather than surface observations, directly addressing the stakeholders' difficulty distinguishing causes from symptoms.
Delphi Technique
SWOT Analysis
Monte Carlo Simulation
Want more Risk Process Facilitation practice?
Practice this domainIn a decision tree analysis, what occurs if you 'fold back' the decision tree?
You reset the probabilities of all chance nodes to zero.
You assign risk scores to each decision alternative.
You calculate the probability of each branch ending in failure.
You determine the optimal path by selecting the branch with the best EMV at each decision node.
Folding back calculates expected monetary value at each chance node, then selects the highest EMV branch at every decision node, working right to left. This satisfies the stem's requirement to identify the optimal path through sequential decisions under uncertainty, resolving each decision point by its best EMV.
You are conducting sensitivity analysis using a scatter plot in a simulation tool. What does a tight clustering of data points along a diagonal line suggest?
The variable is independent of the outcome.
Low sensitivity.
High sensitivity.
A tight diagonal clustering means output values change proportionally with each input change, so the tornado/scatter relationship is strong. This directly satisfies the stem's sensitivity question: the tighter the points hug the diagonal, the more sensitive the model is to that variable.
The simulation failed to converge.
In the context of risk-adjusted cost analysis, what is the primary purpose of adding a 'Risk Contingency' reserve to the project budget?
To cover identified risks that have been quantified.
A risk contingency reserve is budget allocated for identified risks whose probability and impact have been quantified, typically via expected monetary value. It covers those known risks should they materialise, distinct from management reserve for unknown risks.
To cover scope creep requested by the client.
To account for inflation over the project lifecycle.
To replace the management reserve.
During a Monte Carlo simulation in @RISK, you notice the project completion date distribution is heavily skewed. Which distribution type is most appropriate for modeling task durations that have a hard 'minimum' but a long 'maximum' tail?
Normal distribution.
Beta distribution.
The Beta distribution is flexible and ideal for skewed data with fixed bounds.
Discrete distribution.
Uniform distribution.
When evaluating project risks using EMV, why is it critical to include both threats and opportunities in the calculation?
To provide an accurate assessment of the project's risk exposure.
Including both threats and opportunities ensures EMV aggregates their probability-weighted monetary impacts into one net figure, rather than overstating exposure by counting only negative outcomes. This directly satisfies the stem's requirement for a complete risk exposure assessment, since omitting opportunities inflates the expected loss and misrepresents the project's true risk position.
To double the number of items in the Risk Register.
To ensure the contingency reserve is maximized.
To satisfy regulatory reporting requirements.
When configuring a simulation in Oracle Primavera Risk Analysis, what is the impact of checking the 'Correlate Task Durations' option?
It reduces the number of iterations required for convergence.
It forces all tasks to have the same duration.
It automatically removes all risk events from the schedule.
It enables the model to reflect that specific tasks may fluctuate together.
Correlate Task Durations introduces a correlation coefficient so sampled durations move together across related activities, rather than being drawn independently. This reflects shared drivers such as weather or crew availability, producing a more realistic distribution of total project duration.
Want more Specialized Risk Analyses practice?
Practice this domainThe PMI-RMP exam has 115 questions and must be completed in 150 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based project management questions covering agile, hybrid, and predictive delivery methodologies.
The exam covers 5 domains: Risk Strategy And Planning, Stakeholder Engagement, Risk Monitoring And Reporting, Risk Process Facilitation, Specialized Risk Analyses. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official PMI PMI-RMP exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.