Courseiva

CCNA Portfolio Risk Management Questions

54 questions · Portfolio Risk Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

You are the portfolio manager for a global retail portfolio spanning e-commerce, supply chain, and store operations programs. The portfolio board has approved a risk appetite statement and now wants assurance that portfolio risk responses remain aligned with it as conditions change. Which two actions should you take to maintain that alignment? (Choose two.)

Select 2 answers
A.Freeze each program's approved risk responses for the fiscal year so that mitigation plans remain stable and comparable across the portfolio.
B.Reassess aggregated portfolio risk exposure against the approved appetite thresholds at each portfolio review cycle and escalate any breach with recommended responses.
C.Delegate all appetite monitoring to each program's risk owner and rely on their monthly status reports to the portfolio office.
D.Verify that each component's risk responses and contingency reserves are consistent with the portfolio-level appetite rather than only with program-specific tolerances.
E.Revise the board's risk appetite statement quarterly to match whatever exposure the portfolio currently carries, keeping the portfolio continuously compliant.
AnswersB, D

Risk appetite is only meaningful if exposure is repeatedly compared against it. At each portfolio review, re-aggregating component risks and testing them against the approved thresholds detects drift caused by new risks, changed likelihoods, or portfolio rebalancing, and gives the board a timely, decision-ready escalation whenever tolerance is breached.

Why this answer

Maintaining alignment between portfolio risk responses and the board's appetite requires two disciplines: periodically re-aggregating exposure and testing it against approved thresholds, and verifying that component-level responses and reserves are calibrated to portfolio appetite rather than only local tolerances. Freezing responses, delegating monitoring entirely, or rewriting the appetite to fit exposure all break the governance link the board is asking to preserve.

Exam trap

The trap here is assuming that program-level risk tolerance automatically rolls up into portfolio risk appetite, when the two can diverge and require explicit reconciliation.

Practice this question →
2
MCQeasy

What is the primary purpose of a Portfolio Risk Management Plan?

A.To assign blame for failed projects.
B.To list all current portfolio risks.
C.To define the processes for managing portfolio risks.
D.To authorize the use of contingency reserves.
AnswerC

The Portfolio Risk Management Plan is the governing document that establishes how risk identification, assessment, response planning and monitoring are performed across the portfolio. It supplies the structured processes, roles and thresholds that let portfolio managers handle uncertainty consistently, rather than recording individual risks themselves.

Why this answer

The Portfolio Risk Management Plan defines the processes, roles, responsibilities, and methodologies for identifying, assessing, responding to, and monitoring portfolio risks. It is a governance artifact that establishes how risk management will be conducted across the portfolio, not a repository of current risks or a reserve authorization document. Its primary purpose is to provide a consistent, repeatable framework for managing risk at the portfolio level.

Exam trap

PfMP often tests the distinction between the Portfolio Risk Management Plan as a process-defining document versus a risk register as a list of current risks, so candidates who conflate the two will select the wrong answer.

How to eliminate wrong answers

Option A is wrong because assigning blame for failed projects is not a risk management function and contradicts the constructive, forward-looking nature of risk planning. Option B is wrong because listing all current portfolio risks is the function of a risk register or risk log, not the risk management plan, which describes processes rather than specific risks. Option D is wrong because authorizing the use of contingency reserves is a financial control activity typically governed by the portfolio financial management plan or governance board, not the risk management plan itself.

Practice this question →
3
MCQhard

A Portfolio Manager identifies a high-impact risk that correlates across multiple programs. How should this be managed?

A.Delegate the risk to the strongest program manager.
B.Ignore the risk until it becomes an issue for one of the programs.
C.Manage the risk as a portfolio-level risk with a unified response strategy.
D.Tell each program manager to manage the risk independently.
AnswerC

Correlated risks spanning multiple programs exceed any single program's scope, so aggregating them at portfolio level with one unified response prevents duplicated or conflicting mitigation. This satisfies the stem's cross-program correlation constraint, which program-level registers cannot address.

Why this answer

Correlated risks must be managed at the portfolio level to avoid redundant or conflicting responses.

Practice this question →
4
Multi-Selecteasy

Which TWO of the following are sources for identifying portfolio risks?

Select 2 answers
A.The cafeteria menu.
B.Project status reports.
C.Stakeholder interviews.
D.Social media gossip channels.
E.Office climate control settings.
AnswersB, C

Project status reports surface emerging risks, issues, and variances from individual projects, feeding them upward into the portfolio risk register. They are a recognised source for identifying risks that could affect multiple components or strategic objectives.

Why this answer

Option B, project status reports, is a valid source for identifying portfolio risks because these reports surface schedule variances, budget overruns, resource constraints, and issue logs from individual projects that can aggregate into portfolio-level risk exposure. Option C, stakeholder interviews, is also correct because direct engagement with sponsors, program managers, and other stakeholders elicits qualitative risk information such as emerging threats, assumptions, dependencies, and concerns not yet captured in formal documentation. The remaining options do not belong: A (cafeteria menu), D (social media gossip channels), and E (office climate control settings) are unrelated to formal risk identification inputs and are not recognized sources under portfolio risk management practices such as those in PMI's Standard for Portfolio Management.

Exam trap

The trap is that candidates overthink 'sources' and select plausible-sounding but non-standard items; PfMP expects you to recognize only formal, documented, or expert-judgment-based sources, not informal chatter.

Practice this question →
5
MCQhard

You are performing a portfolio-level qualitative risk analysis. Which method is best for ranking risks?

A.Return on Investment (ROI) calculation.
B.Monte Carlo analysis.
C.Probability and Impact Matrix.
D.Sensitivity Analysis.
AnswerC

The Probability and Impact Matrix ranks risks by combining likelihood with consequence severity, directly satisfying the portfolio-level qualitative ranking constraint. It maps each risk to a priority band, enabling consistent comparison across disparate projects without quantitative data. This makes it the standard tool for ordering risks during qualitative analysis.

Why this answer

The Probability and Impact Matrix is the standard qualitative risk analysis tool for ranking risks by combining their likelihood of occurrence with their potential impact. It produces a relative priority ranking that helps portfolio managers focus attention and resources on the most significant risks. Monte Carlo and sensitivity analysis are quantitative techniques, and ROI is a financial metric, not a risk ranking method.

Exam trap

PfMP often tests the distinction between qualitative and quantitative risk analysis — candidates pick Monte Carlo or sensitivity analysis because they sound more rigorous, but the question specifically asks for a ranking method in qualitative analysis.

How to eliminate wrong answers

Option A is wrong because ROI calculation is a financial performance metric used to evaluate investment returns, not a method for ranking risks by probability and impact. Option B is wrong because Monte Carlo analysis is a quantitative risk analysis technique that uses simulation to model the combined effect of multiple uncertain variables, not a qualitative ranking method. Option D is wrong because sensitivity analysis is a quantitative technique that examines how the variation of a single input affects the output, used to identify which variables most influence outcomes, not to rank risks qualitatively.

Practice this question →
6
MCQeasy

Which document is used to track the status of approved risk responses?

A.Portfolio Charter.
B.Portfolio Risk Register.
C.Portfolio Roadmap.
D.Resource Management Plan.
AnswerB

The Portfolio Risk Register is the central artefact recording each identified portfolio risk, its response strategy, owner and current status. It satisfies the tracking requirement by consolidating approved responses across programmes, unlike programme-level registers or the risk management plan.

Why this answer

The Portfolio Risk Register is the document that records identified portfolio risks, their analysis (probability, impact, exposure), assigned risk owners, planned responses, and—critically—the status of those responses. It is the living artifact used to track whether mitigation actions are on schedule and effective. The other documents listed serve different governance or planning purposes and do not track risk response status.

Exam trap

PfMP often tests document-to-purpose mapping, and the trap is confusing planning documents (Charter, Roadmap, Resource Plan) with the risk tracking artifact—candidates must remember that only the Risk Register tracks risk response status.

How to eliminate wrong answers

Option A is wrong because the Portfolio Charter authorizes the portfolio and defines its scope, objectives, and governance—it does not track risk responses. Option C is wrong because the Portfolio Roadmap is a time-based visual of component sequencing and delivery milestones, not a risk tracking tool. Option D is wrong because the Resource Management Plan defines how resources will be acquired, allocated, and managed across the portfolio; it addresses capacity and competency, not risk response status.

Practice this question →
7
MCQmedium

You are the portfolio manager for a pharmaceutical R&D portfolio with three drug-development programs. A key contract manufacturer shared audited financials showing a debt covenant breach that will likely trigger restructuring within two quarters, which could halt supply of a critical excipient used by two programs. The programs' risk registers list this supplier only as 'medium likelihood, medium impact.' What should you do FIRST as the portfolio manager?

A.Log the covenant breach as an issue in the portfolio issue log and assign the supplier's account manager to report progress monthly.
B.Immediately terminate the contract and sole-source the excipient from a new manufacturer to eliminate the risk before restructuring occurs.
C.Direct each program manager to update their own risk register and manage the supplier risk within their existing program contingency budgets.
D.Aggregate the correlated supplier exposure from both programs and raise it to the portfolio risk register with an escalated, portfolio-level rating for board review.
AnswerD

A single supplier feeding two programs creates correlated, portfolio-level exposure that individual program registers understate. Reassessing and aggregating that shared exposure into the portfolio risk register, with an escalated rating, gives the portfolio board the consolidated view needed to authorize mitigation such as qualifying a second excipient source or holding strategic buffer stock.

Why this answer

The correct action addresses the defining feature of this scenario: one supplier creating correlated exposure across two programs, which only becomes visible when aggregated at portfolio level. Escalating the aggregated exposure with a portfolio-level rating equips the portfolio board to weigh mitigation options against strategic objectives. Program-level handling, contract termination, or issue-logging all fail to produce that consolidated, decision-ready view.

Exam trap

The trap here is treating a risk that appears on multiple program registers as merely duplicated rather than correlated, and therefore missing the compounded portfolio-level exposure.

Practice this question →
8
MCQeasy

Which of the following describes 'Portfolio Risk Exposure'?

A.The individual risk score of the highest-priority project.
B.The total financial loss if all risks occur simultaneously.
C.The sum of all project-level risks.
D.The aggregate level of risk across all components in the portfolio.
AnswerD

Aggregating risk across every component captures portfolio-level exposure, which no single project's risk register can express. This satisfies the stem's requirement for a portfolio-wide measure, since exposure arises from the combined probability and impact of all components, including correlated risks that individual assessments overlook.

Why this answer

Portfolio Risk Exposure is the aggregate or consolidated level of risk across all components in the portfolio, reflecting how individual component risks combine and interact at the portfolio level. It is not simply the sum of project risks because portfolio-level analysis considers correlation, concentration, and interdependencies among components. This aggregate view enables the portfolio manager to assess whether the overall risk profile aligns with the organization's risk appetite.

Exam trap

The trap here is confusing the aggregate, correlation-aware portfolio risk exposure with a simple sum of project risks or a single worst-case loss figure, which ignores portfolio-level dynamics.

How to eliminate wrong answers

Option A is wrong because the risk score of a single highest-priority project addresses only one component, not the portfolio-wide exposure, and ignores all other components. Option B is wrong because total financial loss if all risks occur simultaneously is a worst-case scenario calculation, not the aggregate risk exposure, which is probability-weighted and considers interdependencies. Option C is wrong because simply summing all project-level risks ignores correlation effects, double-counting, and portfolio-level diversification or concentration, which are central to portfolio risk analysis.

Practice this question →
9
MCQeasy

A portfolio manager is reviewing the risk management approach for a portfolio of strategic initiatives. The organization's leadership wants to ensure that portfolio risks are managed consistently and aligned with strategic objectives. Which document should the portfolio manager primarily reference to understand the risk management framework, including roles, responsibilities, and risk tolerances?

A.Individual project risk management plans
B.Portfolio management plan
C.Enterprise environmental factors
D.Portfolio risk register
AnswerB

The portfolio management plan outlines how the portfolio will be managed, including the risk management approach, governance, roles, responsibilities, and risk tolerances. It is the primary document that provides the framework for consistent and strategic risk management across the portfolio.

Why this answer

The portfolio management plan is the key document that defines the risk management framework, including governance, roles, responsibilities, and risk tolerances. It ensures that risk management is consistent and aligned with strategic objectives across the portfolio.

Exam trap

The trap here is confusing the portfolio risk register, which lists risks, with the portfolio management plan, which establishes the overall risk management framework and governance.

Practice this question →
10
MCQmedium

A major vendor supporting your portfolio has filed for bankruptcy. This is an example of:

A.An internal operational bottleneck.
B.A portfolio-level risk.
C.A simple issue to be fixed by procurement.
D.A project-level constraint.
AnswerB

A vendor bankruptcy affects multiple projects and components across the portfolio simultaneously, so it is managed at portfolio level rather than as a single project risk. Its cross-project impact defines it as a portfolio-level risk.

Why this answer

A vendor bankruptcy is a portfolio-level risk because it can affect multiple projects, programs, and business operations simultaneously, threatening benefits realization across the portfolio. Portfolio risks are uncertainties that impact the portfolio's strategic objectives, and a major vendor failure is exactly that type of cross-cutting threat. It requires portfolio-level response planning, such as diversifying suppliers or invoking contingency contracts, rather than being handled solely at the project level.

Exam trap

The trap here is confusing project-level risks with portfolio-level risks; candidates often pick 'project-level constraint' because the vendor supports projects, missing that the bankruptcy affects the entire portfolio.

How to eliminate wrong answers

Option A is wrong because an internal operational bottleneck refers to internal process constraints such as capacity or workflow issues, not an external vendor's financial failure. Option C is wrong because a vendor bankruptcy is not a simple issue to be fixed by procurement; it is a strategic risk that can disrupt multiple projects and requires portfolio-level mitigation. Option D is wrong because a project-level constraint typically refers to scope, time, cost, or quality limitations within a single project, whereas a major vendor bankruptcy has portfolio-wide impact and is not confined to one project.

Practice this question →
11
MCQmedium

A risk is identified that could positively impact the portfolio's strategic goals. How should this be handled?

A.Transfer the opportunity to an external contractor.
B.Ignore it, as risks are only for negative impacts.
C.Analyze the opportunity and plan to enhance its realization.
D.Add it to the issues log immediately.
AnswerC

Positive risks are opportunities, so they require exploitation or enhancement rather than mitigation. Analysing the opportunity and planning actions to increase its probability or impact captures the upside for the portfolio's strategic goals, aligning with opportunity management.

Why this answer

A risk with a positive impact is an opportunity, and portfolio management requires that opportunities be analyzed and planned for so their realization can be enhanced or exploited. This means assessing the probability and impact, determining a response strategy (exploit, enhance, share, or accept), and integrating it into portfolio planning.

Exam trap

The trap is the common misconception that risks are only negative; candidates who forget that positive risks (opportunities) must be actively managed may choose to ignore or mishandle them.

How to eliminate wrong answers

Option A is wrong because transferring an opportunity to an external contractor is a specific sharing strategy that may be appropriate in some cases but is not the default handling; the question asks how it should be handled, which begins with analysis and planning, not immediate transfer. Option B is wrong because risks include both threats and opportunities; ignoring a positive risk forfeits potential strategic benefit. Option D is wrong because an opportunity is not an issue — issues are problems that have already occurred, while opportunities are future possibilities that require proactive management.

Practice this question →
12
Multi-Selecteasy

Which TWO of the following are primary objectives of portfolio risk management?

Select 2 answers
A.To reduce the workload of the project managers.
B.To increase the total number of projects in the portfolio.
C.To align risk responses with the portfolio's strategic goals.
D.To maximize the protection of portfolio value.
E.To ensure every project is completed under budget.
AnswersC, D

Portfolio risk management exists to protect strategic objectives, not merely individual project deliverables. Aligning responses with strategic goals ensures risk effort and funding target exposures that threaten the portfolio's intended benefits, satisfying the stem's requirement for a primary objective rather than an operational or tactical concern.

Why this answer

Option C is correct because portfolio risk management exists to ensure that risk responses are prioritized and executed in line with the organization's strategic objectives, rather than being managed in isolation at the individual project level. Option D is correct because a central purpose of portfolio risk management is to protect and preserve the aggregate value of the portfolio by identifying, assessing, and mitigating risks that could erode returns across multiple projects or programs. Options A, B, and E are not primary objectives: reducing project managers' workload is an operational side effect at best, increasing the number of projects is unrelated to risk management (and could actually increase risk exposure), and guaranteeing every project stays under budget is an unrealistic project-level cost goal rather than a portfolio risk management objective.

Exam trap

The trap is confusing project-level objectives (like under-budget completion or workload reduction) with portfolio-level objectives, which center on strategic alignment and aggregate value protection.

Practice this question →
13
MCQmedium

You are preparing a portfolio risk report for the executive committee. Which of the following best describes the purpose of a portfolio risk heat map?

A.To track the status of risk response actions over time.
B.To calculate the exact monetary value of each risk's potential impact on the portfolio.
C.To provide a visual representation of risks based on their probability and impact, aiding in prioritization.
D.To list all identified risks along with their owners and mitigation plans.
AnswerC

A portfolio risk heat map visually displays risks according to their probability and impact, helping stakeholders quickly identify high-priority risks. It aggregates risks across the portfolio, enabling comparison and informed decision-making. This tool supports effective communication and prioritization, aligning with PfMP practices for portfolio risk reporting.

Why this answer

The purpose of a portfolio risk heat map is to provide a visual representation of risks based on probability and impact, which aids in prioritization and communication. It allows executives to quickly grasp the portfolio's risk profile and focus on the most significant risks. This aligns with PfMP best practices for effective risk reporting.

Exam trap

The trap here is to confuse the heat map with the risk register or a quantitative analysis tool; the heat map is a qualitative visualization for prioritization.

Practice this question →
14
MCQhard

Your portfolio board is concerned about the impact of sudden market volatility on the portfolio. You decide to perform a quantitative risk analysis. Which tool is most effective for this?

A.Portfolio Governance Meeting minutes.
B.Portfolio Risk Register review.
C.SWOT Analysis.
D.Monte Carlo Simulation.
AnswerD

Monte Carlo simulation runs thousands of iterations across the portfolio's cost and schedule variables, each randomly sampled from defined probability distributions. This produces a probability distribution of outcomes, quantifying exposure to market volatility. It satisfies the stem's demand for quantitative risk analysis by modelling combined uncertainty, unlike qualitative matrices that only rank risks.

Why this answer

Monte Carlo Simulation is the only listed tool that performs quantitative risk analysis by running thousands of probabilistic iterations on portfolio cost, schedule, and value variables to produce a distribution of possible outcomes (e.g., P50/P80 confidence levels). It directly models the impact of market volatility on portfolio value and lets the portfolio board see the probability of meeting strategic objectives. The other options are qualitative or documentation artifacts, not quantitative modeling techniques.

Exam trap

PfMP often tests the distinction between qualitative techniques (risk register review, SWOT, probability-impact matrix) and quantitative techniques (Monte Carlo, decision trees, EMV), so candidates who see 'risk analysis' and grab the risk register fall into the qualitative trap.

How to eliminate wrong answers

Option A is wrong because governance meeting minutes are a record of decisions and oversight, not an analytical tool for quantifying risk exposure. Option B is wrong because the risk register is a repository that documents identified risks and responses; reviewing it is qualitative risk management, not quantitative simulation. Option C is wrong because SWOT analysis is a strategic planning technique that identifies internal strengths/weaknesses and external opportunities/threats qualitatively, producing no numerical probability distributions.

Practice this question →
15
Multi-Selecthard

You are leading a portfolio risk management workshop. Which TWO of the following are key inputs to the portfolio risk management process? (Choose two.)

Select 2 answers
A.Portfolio risk register
B.Portfolio strategic objectives
C.Organizational risk tolerance
D.Individual project risk reports
E.Project schedules
AnswersB, C

Portfolio strategic objectives are a key input because they define the context for risk management. Risks are assessed based on their potential to impact these objectives. Without clear objectives, it is impossible to prioritize risks or determine risk tolerance. This input ensures that risk management is aligned with the overall strategy and value delivery.

Why this answer

The key inputs to portfolio risk management include portfolio strategic objectives and organizational risk tolerance. Strategic objectives provide the context for assessing risks, while risk tolerance defines the acceptable level of risk. These inputs ensure that risk management is aligned with the portfolio's goals and the organization's overall risk appetite, enabling effective prioritization and response planning.

Exam trap

The trap here is to select the portfolio risk register or project schedules as inputs, but the risk register is an output, and schedules are too granular for portfolio-level input.

Practice this question →
16
MCQmedium

When updating the Portfolio Risk Register, which information is most critical to include to ensure stakeholders understand the risk?

A.A list of all team members assigned to the risk.
B.The potential impact on portfolio strategic goals.
C.The date the risk was first identified.
D.The name of the project manager associated with the risk.
AnswerB

Stakeholders judge portfolio risks by their effect on strategic objectives, so recording the potential impact on portfolio strategic goals gives the decision context they need. This satisfies the stem's requirement for understanding, unlike tactical details such as probability alone.

Why this answer

The Portfolio Risk Register should capture risks that could affect the achievement of portfolio strategic goals. Including the potential impact on strategic goals ensures stakeholders understand the risk's significance in terms of portfolio value and alignment, enabling informed decision-making.

Exam trap

PfMP often tests the confusion between project-level risk details and portfolio-level strategic impact, tempting candidates to focus on tactical information rather than strategic consequences.

How to eliminate wrong answers

Option A is wrong because listing all team members assigned to the risk is tactical detail that does not help stakeholders understand the risk's strategic importance. Option C is wrong because the date the risk was first identified is metadata that provides context but is not critical for understanding the risk's impact. Option D is wrong because the name of the project manager associated with the risk is an ownership detail, not a measure of the risk's strategic consequence.

Practice this question →
17
MCQmedium

Your portfolio has a risk tolerance that allows for moderate risk-taking to achieve strategic goals. A new project is proposed that has a high potential return but also a high probability of failure. The project's risk exposure exceeds the portfolio's risk tolerance. As the portfolio manager, what should you do first?

A.Reject the project outright because it exceeds the portfolio's risk tolerance.
B.Evaluate options to mitigate or transfer the risk to bring it within the portfolio's risk tolerance.
C.Accept the project and increase the portfolio's contingency reserve to cover the risk.
D.Escalate the decision to the portfolio governance board for approval.
AnswerB

The first step is to assess whether risk response strategies can reduce the risk exposure to an acceptable level. Mitigation or transfer might make the project viable within the portfolio's risk tolerance. This aligns with proactive risk management and allows the portfolio to pursue strategic opportunities while managing risk responsibly.

Why this answer

When a project's risk exposure exceeds the portfolio's risk tolerance, the portfolio manager should first explore risk response options to reduce or transfer the risk. This proactive approach may allow the project to proceed within acceptable limits. Only if the risk cannot be managed should escalation or rejection be considered.

Evaluating options is the critical first step.

Exam trap

The trap here is jumping to escalation or rejection without first attempting to optimize the risk through mitigation or transfer.

Practice this question →
18
MCQhard

You are managing a portfolio with a mix of projects and programs. A new risk has been identified that could affect multiple components simultaneously, but its probability and impact are uncertain. The portfolio board wants to understand the potential worst-case scenario and the likelihood of exceeding the portfolio's risk tolerance. Which technique is most appropriate to use?

A.SWOT analysis
B.Decision tree analysis
C.Risk probability and impact assessment
D.Monte Carlo simulation
AnswerD

Monte Carlo simulation models the combined effect of multiple uncertain risks by running thousands of iterations, providing a probability distribution of outcomes. It is ideal for assessing worst-case scenarios and the likelihood of exceeding portfolio risk tolerance, especially when risks are correlated or affect multiple components.

Why this answer

Monte Carlo simulation is the most appropriate technique because it aggregates multiple uncertain risks, models correlations, and produces a probability distribution of portfolio outcomes. This allows the portfolio manager to assess worst-case scenarios and the likelihood of exceeding risk tolerance, informing strategic decisions.

Exam trap

The trap here is selecting a qualitative technique like SWOT or a single-risk assessment when the scenario requires quantitative aggregation and probabilistic analysis of multiple risks.

Practice this question →
19
MCQmedium

A risk response is proving ineffective. What should you do?

A.Continue with the plan, hoping it works eventually.
B.Close the risk to remove it from the register.
C.Fire the project team responsible for the risk.
D.Re-assess the risk and develop a revised response strategy.
AnswerD

An ineffective response means the residual exposure no longer matches tolerance, so the risk must be re-analysed and a new strategy selected. This satisfies the stem by correcting the response rather than merely monitoring or accepting it.

Why this answer

When a risk response is ineffective, the risk management process requires re-evaluating the risk and developing a revised response strategy. This aligns with the PMBOK principle of continuous risk monitoring and adaptive response planning. Simply continuing or closing the risk without addressing it would leave the project exposed.

Exam trap

The trap here is the temptation to choose a quick fix like closing the risk or blaming the team, rather than following the disciplined process of reassessing and revising the response.

How to eliminate wrong answers

Option A is wrong because continuing with an ineffective plan ignores the risk and violates the principle of proactive risk management. Option B is wrong because closing a risk that is still active removes it from the register without mitigating the threat, which is unethical and dangerous. Option C is wrong because firing the team is a punitive, disproportionate action that does not address the risk itself and would likely create new risks.

Practice this question →
20
MCQmedium

Your portfolio includes a large infrastructure program and several smaller IT projects. A new regulatory requirement mandates that all projects comply with stricter data privacy controls within six months. You need to prioritize where to apply limited compliance resources. Which portfolio risk management action should you take FIRST?

A.Immediately initiate a change request to extend all project deadlines by six months to accommodate compliance work.
B.Direct each project manager to handle compliance independently and report status monthly.
C.Escalate the regulatory requirement to the portfolio board for a decision on which projects to cancel.
D.Update the portfolio risk register to include the regulatory requirement and then reassess the portfolio's aggregate risk exposure.
AnswerD

This is correct because the first step in portfolio risk management is to identify and document the new risk in the portfolio risk register. Once recorded, you reassess aggregate exposure to understand how the regulatory requirement affects the entire portfolio, enabling informed prioritization of limited compliance resources across both the infrastructure program and smaller IT projects.

Why this answer

The correct answer is to update the portfolio risk register and reassess aggregate risk exposure. This is the foundational step in portfolio risk management: identify and document the risk, then evaluate its impact across the portfolio. Only after this can you effectively prioritize compliance resources, potentially avoiding unnecessary schedule changes or escalations.

Exam trap

The trap here is assuming that immediate action such as schedule changes or escalation is required, when the first step should always be to document and assess the risk at the portfolio level.

Practice this question →
21
MCQeasy

A portfolio board member asks you to explain how portfolio risk management differs from the risk management performed by the individual program managers in your portfolio. Which statement best describes the portfolio manager's distinctive risk responsibility?

A.The portfolio manager replaces each program's risk management plan with a single consolidated plan that all components must follow identically.
B.The portfolio manager focuses exclusively on financial risks, leaving schedule, technical, and compliance risks entirely to component managers.
C.The portfolio manager personally owns and mitigates every risk recorded on the individual program and project risk registers.
D.The portfolio manager manages risks arising from the aggregation, interdependencies, and strategic alignment of components across the portfolio.
AnswerD

This captures the distinctive portfolio-level responsibility. Component managers handle risks within their own scope, while the portfolio manager addresses risks created by the portfolio itself: correlated exposures, resource contention, dependency chains, and misalignment between component risks and strategic objectives. Those risks exist only at the portfolio level and cannot be owned or even seen by any single component manager.

Why this answer

The portfolio manager's distinctive contribution is managing risks that emerge from the portfolio as a whole: aggregation of correlated exposures, interdependencies between components, resource contention, and alignment of component risks with strategic objectives. These risks are invisible or unowned at component level. Owning every component risk, imposing one uniform plan, or limiting scope to financial risk all misstate that responsibility.

Exam trap

The trap here is assuming the portfolio manager is simply a super-program-manager who owns all component risks, rather than the owner of risks created by aggregation and interdependency.

Practice this question →
22
Multi-Selecthard

Which TWO of the following are steps in the portfolio risk management process?

Select 2 answers
A.Risk monitoring.
B.Project team hiring.
C.Office cleaning.
D.Annual holiday planning.
E.Risk identification.
AnswersA, E

Risk monitoring is a continuous process step that tracks identified portfolio risks, reassesses probability and impact, and triggers responses as conditions change. It sits alongside identification, analysis, response planning and reporting within the portfolio risk management cycle.

Why this answer

Risk identification (E) is a core step in the portfolio risk management process because it is where risks that could affect portfolio objectives are systematically discovered and documented before they can be analyzed or addressed. Risk monitoring (A) is equally essential, as it continuously tracks identified risks, watches for new or changing risks, and verifies that risk responses remain effective throughout the portfolio lifecycle. Together, identification and monitoring form part of the standard iterative risk management cycle (identify, analyze, respond, monitor).

The remaining options do not belong: project team hiring (B) is a resource management activity, office cleaning (C) is a facilities task, and annual holiday planning (D) is an administrative scheduling matter, none of which are steps in the portfolio risk management process.

Exam trap

The trap is selecting operational activities (hiring, cleaning, holiday planning) that sound like they could relate to risk but are not formal steps in the portfolio risk management process.

Practice this question →
23
MCQhard

You are managing a portfolio of infrastructure projects. A new regulatory requirement is expected to increase costs for all projects using a specific technology. This risk has a high probability and high impact, but it is not yet reflected in any project risk register. As the portfolio manager, what should you do first?

A.Direct each project manager to update their project risk registers and develop individual mitigation plans.
B.Ignore the risk until it materializes, as it is not yet in any project risk register and may not occur.
C.Add the risk to the portfolio risk register and assess its aggregate impact across all affected projects.
D.Immediately escalate to the portfolio board to request additional funding to cover the expected cost increases.
AnswerC

The portfolio manager should first capture the risk at the portfolio level and evaluate its cumulative effect on the portfolio's objectives. This enables a coordinated response and ensures the risk is visible to governance. Adding it to the portfolio risk register is the initial step before deciding on specific responses.

Why this answer

The portfolio manager should first capture the emerging risk at the portfolio level and assess its aggregate impact. This allows for a coordinated, strategic response rather than isolated project actions. Only after understanding the portfolio-level exposure should specific responses, including escalation, be considered.

Exam trap

The trap here is jumping to project-level actions or escalation without first assessing the portfolio-wide impact and ensuring the risk is captured in the portfolio risk register.

Practice this question →
24
MCQeasy

As a Portfolio Manager, you are documenting an identified risk that could affect multiple programs. Where should this be primarily recorded?

A.Portfolio Risk Register.
B.Stakeholder Engagement Plan.
C.Program-level issue log.
D.Portfolio Business Case.
AnswerA

The Portfolio Risk Register is the central repository where the Portfolio Manager records risks affecting multiple programs, capturing probability, impact and response at portfolio level. Program-level registers cannot hold cross-program risks, so this is the primary recording location.

Why this answer

The Portfolio Risk Register is the central repository where risks that affect multiple programs or the portfolio as a whole are documented, categorized, and tracked. Because this risk spans multiple programs, it exceeds the scope of any single program's risk log and must be escalated to the portfolio level for consolidated analysis and response planning.

Exam trap

The trap here is confusing the level at which a risk should be recorded — candidates often default to the program level because the risk 'affects programs,' missing that cross-program scope mandates portfolio-level documentation.

How to eliminate wrong answers

Option B is wrong because the Stakeholder Engagement Plan documents how stakeholders will be informed and involved, not where risks are recorded. Option C is wrong because a program-level issue log captures issues within one program and cannot properly aggregate a cross-program risk; also, an issue is a realized problem, not an identified risk. Option D is wrong because the Portfolio Business Case justifies investment decisions and expected benefits, not the ongoing tracking of risks.

Practice this question →
25
MCQhard

When a portfolio risk occurs and impacts the strategic goals, this event is now classified as:

A.An external audit finding.
B.A portfolio issue.
C.A project failure.
D.A new risk.
AnswerB

Once a portfolio risk materialises and affects strategic objectives, it ceases to be a risk and becomes a portfolio issue requiring active resolution. The Portfolio Risk Register entry is converted, and issue management processes track remediation against the impacted strategic goals.

Why this answer

Once a risk occurs, it is officially recorded as an issue.

Practice this question →
26
MCQhard

You are the portfolio manager for a financial services firm's digital transformation portfolio. Your portfolio risk management plan specifies a 95% confidence level and a one-year horizon for quantitative risk analysis. The CIO asks why the aggregate portfolio contingency reserve, calculated via Monte Carlo simulation, is significantly larger than the sum of the individual component contingency reserves. What is the most likely explanation for this difference?

A.The aggregate reserve accounts for portfolio-level risks and correlations between component risks that are not captured when summing individual reserves.
B.The sum of individual contingency reserves is calculated at a lower confidence level than the portfolio-level simulation.
C.Portfolio-level Monte Carlo simulation double-counts risks that appear in multiple components, inflating the aggregate reserve.
D.Monte Carlo simulation always overestimates reserve requirements because it assumes worst-case correlations among all risks.
AnswerA

Aggregate portfolio risk includes interdependencies, shared drivers, and portfolio-level risks that component-level analyses miss. Positive correlations can increase aggregate risk beyond the simple sum of individual reserves, while diversification may reduce it. The simulation captures these effects, so the aggregate reserve legitimately differs from the sum of component reserves.

Why this answer

Aggregate portfolio risk is not simply the sum of component risks. It incorporates portfolio-level risks, shared risk drivers, and correlations among components. Positive correlations can amplify aggregate exposure, while negative correlations can reduce it.

Monte Carlo simulation at the portfolio level captures these effects, so the aggregate contingency reserve can legitimately be larger than the sum of individual component reserves.

Exam trap

The trap here is assuming that portfolio risk is always the simple sum of component risks, ignoring correlations and portfolio-level risks that can increase aggregate exposure.

Practice this question →
27
Multi-Selecthard

Which TWO of the following are appropriate portfolio risk response strategies for threats?

Select 2 answers
A.Enhancement.
B.Sharing.
C.Mitigation.
D.Avoidance.
E.Ignoring.
AnswersC, D

Mitigation reduces the probability or impact of an identified portfolio threat by committing resources before it materialises. It suits threats that cannot be avoided or transferred, and operates at portfolio level where responses are coordinated across multiple constituent components.

Why this answer

Mitigation (C) is a correct threat response strategy because it reduces the probability and/or impact of a threat through proactive actions, such as implementing controls or contingency plans. Avoidance (D) is also correct because it eliminates the threat entirely by changing the portfolio scope, approach, or requirements so the risk no longer applies. Enhancement (A) is not a threat response; it is an opportunity response that aims to increase the probability or impact of a positive risk.

Sharing (B) is an opportunity response (e.g., partnering to capture upside), not a standard threat strategy, though threat transference is sometimes confused with sharing. Ignoring (E) is not a recognized risk response strategy; threats must be actively addressed or accepted, not simply ignored.

Exam trap

The trap is mixing opportunity response strategies (enhance, share, exploit) with threat response strategies (avoid, transfer, mitigate) — candidates who memorize the list without polarity often pick 'enhancement' or 'sharing' for threats.

Practice this question →
28
Multi-Selecteasy

Which TWO are common triggers for a portfolio risk review?

Select 2 answers
A.Arrival of the monthly coffee supply.
B.Change in office desk layout.
C.A major milestone failure in a critical program.
D.The start of a new work week.
E.A change in the organizational strategy.
AnswersC, E

A critical program milestone failure signals that portfolio-level risk exposure has materialised, breaching schedule or benefit thresholds. It triggers reassessment because dependencies and aggregate risk across constituent programs shift, satisfying the stem's requirement for a common portfolio risk review trigger.

Why this answer

Option C is correct because a major milestone failure in a critical program is a significant risk event that can invalidate the portfolio's assumptions, dependencies, and schedule baselines, so it should trigger a portfolio risk review to reassess exposure and re-prioritize. Option E is correct because a change in organizational strategy alters the portfolio's strategic alignment, investment criteria, and risk appetite, which requires a formal review of portfolio risks to ensure the portfolio still supports the new direction. Options A, B, and D are not valid triggers: monthly coffee supply, office desk layout, and the start of a new work week are routine or administrative matters with no material impact on portfolio risk, strategic alignment, or program performance.

Exam trap

PfMP often tests the ability to distinguish between strategic triggers and routine operational events, tempting candidates to select trivial or periodic events as risk review triggers.

Practice this question →
29
MCQmedium

Your organization's portfolio includes a large infrastructure program that is 70% complete. A new regulatory requirement is announced that will mandate significant design changes across all remaining deliverables. The program manager reports that the changes can be absorbed within the existing schedule float but will increase costs by 12%. As the portfolio manager, what is the most appropriate first action?

A.Instruct the program manager to fast-track the remaining work to avoid the cost increase, using the schedule float.
B.Accept the cost increase and update the portfolio risk register to reflect the new regulatory risk.
C.Direct the program manager to submit a change request to the portfolio change control board for evaluation of the impact on portfolio benefits.
D.Escalate the issue to the project management office (PMO) to revise the program's baseline and reallocate funds from other projects.
AnswerC

Regulatory changes affecting a program's scope and cost are portfolio-level risks that must be evaluated through the portfolio change control process. The change control board assesses the impact on strategic benefits, funding, and other portfolio components before approving. This ensures the change is not treated as a routine program-level adjustment, preserving alignment with portfolio objectives.

Why this answer

Regulatory changes that affect multiple portfolio components are portfolio-level risks requiring formal change control. The portfolio manager must ensure the change is evaluated for its impact on strategic benefits, funding, and other components. Directing the program manager to submit a change request to the portfolio change control board is the correct first step, as it engages the appropriate governance body to assess and decide on the change.

Exam trap

The trap here is assuming that because the program has schedule float, the change can be handled at the program level without portfolio governance.

Practice this question →
30
MCQmedium

You are the portfolio manager for a pharmaceutical R&D portfolio. A new regulatory guideline is expected to significantly increase the cost and timeline for all clinical trials in the portfolio. You need to assess the overall impact on the portfolio's strategic objectives. Which action should you take first?

A.Perform a portfolio-level risk analysis to evaluate the aggregate impact of the regulatory change on all projects and programs.
B.Schedule a meeting with the portfolio board to request additional funding to cover the expected cost increases.
C.Immediately cancel the lowest-priority projects to free up budget for potential increased costs.
D.Instruct each project manager to update their individual risk registers with the new regulatory requirement.
AnswerA

This is correct because portfolio risk management requires assessing risks at the aggregate level to understand their cumulative effect on strategic objectives. A portfolio-level analysis considers interdependencies and overall exposure, enabling informed decision-making on resource allocation and prioritization. It aligns with PfMP principles of managing risk across the entire portfolio rather than in isolation.

Why this answer

The correct answer is to perform a portfolio-level risk analysis first. This approach ensures that the portfolio manager understands the aggregate impact of the regulatory change on all components, enabling informed decisions that align with strategic objectives. It is consistent with PfMP best practices for portfolio risk management, which emphasize a holistic view and proactive assessment.

Exam trap

The trap here is assuming that updating individual project risk registers is sufficient, but portfolio risk management requires aggregate analysis to capture interdependencies and strategic impact.

Practice this question →
31
MCQeasy

You are the portfolio manager for a retail company. The portfolio includes a project to implement a new e-commerce platform. A risk has been identified that a key supplier of payment processing services may increase fees by 20% next year. This risk is currently listed in the project risk register. During a portfolio risk review, you determine that this risk could also affect two other projects that use the same supplier. What should you do?

A.Add the risk to the portfolio risk register while keeping it in the project risk register, and coordinate a portfolio-level response.
B.Leave the risk only in the project risk register and inform the other project managers to add it to their registers.
C.Escalate the risk to the PMO and request that they communicate with the supplier on behalf of all projects.
D.Move the risk to the portfolio risk register and remove it from the project risk register to avoid duplication.
AnswerA

The risk now affects multiple projects, so it requires portfolio-level visibility and coordination. Keeping it in the project risk register ensures the original project continues to manage its specific impact. Adding it to the portfolio risk register allows for a coordinated response that leverages the portfolio's collective bargaining power and considers impacts across all affected projects.

Why this answer

When a project risk evolves into a portfolio-level risk affecting multiple projects, it should be recorded in both the project and portfolio risk registers. This dual visibility ensures the project team manages their specific response while the portfolio manager coordinates a broader strategy. A portfolio-level response can include negotiating bulk pricing or finding alternative suppliers for all affected projects, leveraging the portfolio's collective influence.

Exam trap

The trap here is assuming that a risk can only be managed at one level, leading to either removal from the project register or failure to escalate to the portfolio level.

Practice this question →
32
MCQeasy

Which of the following is an input to Portfolio Risk Identification?

A.Daily task lists of project staff.
B.Personal resumes of the board members.
C.Portfolio Strategic Plan.
D.Project team performance reviews.
AnswerC

The Portfolio Strategic Plan defines strategic objectives, priorities and constraints, so it frames which portfolio-level uncertainties must be identified. Risk identification draws on it to ensure risks considered align with the strategic direction the portfolio must deliver.

Why this answer

The Portfolio Strategic Plan is a formal input to the Portfolio Risk Identification process because it defines the portfolio's strategic objectives, investment mix, and prioritization criteria — all of which frame which risks are relevant to the portfolio. Risk identification must be anchored to strategic intent, so the strategic plan is the authoritative source. The other options are operational or personal artifacts with no bearing on portfolio-level risk identification.

Exam trap

The trap here is confusing project-level artifacts (task lists, performance reviews) with portfolio-level inputs; candidates who think 'more data is better' pick operational documents that have no formal standing in the PfMP process.

How to eliminate wrong answers

Option A is wrong because daily task lists of project staff are tactical execution artifacts that belong to project-level management, not portfolio risk identification inputs. Option B is wrong because board members' resumes are HR documents irrelevant to identifying portfolio risks. Option D is wrong because project team performance reviews are HR/performance management records, not inputs to portfolio risk identification; they may inform resource risk qualitatively but are not formal inputs.

Practice this question →
33
MCQmedium

You are reporting portfolio risk status to the governance board. What is the most effective way to communicate this?

A.Read the entire risk register line by line.
B.Email a spreadsheet with all raw data points.
C.Tell them only about the smallest risks so as not to worry them.
D.Present a high-level dashboard summarizing the portfolio's aggregate risk exposure.
AnswerD

A high-level dashboard condenses aggregate risk exposure across the portfolio into comparable metrics and trends, letting the governance board assess overall status quickly. Portfolio-level decisions need consolidated exposure rather than project-level detail, which the dashboard delivers.

Why this answer

Governance boards need aggregated, decision-ready information, and a high-level dashboard summarizing the portfolio's aggregate risk exposure provides exactly that — it condenses many project-level risks into portfolio-level themes, heat maps, and trend indicators. This aligns with PfMP's emphasis on portfolio-level reporting that supports strategic decision-making rather than operational detail. It also respects the board's time and lets them focus on the risks that threaten strategic objectives.

Exam trap

The trap is mistaking 'more data' for 'better communication' — candidates pick the spreadsheet or full register option thinking thoroughness equals effectiveness, when PfMP tests audience-appropriate synthesis and strategic framing.

How to eliminate wrong answers

Option A is wrong because reading the risk register line by line drowns the board in operational detail and does not translate project risks into portfolio-level strategic exposure. Option B is wrong because emailing raw spreadsheets without synthesis pushes analysis onto the board and fails to highlight aggregate exposure or trends. Option C is wrong because filtering out larger risks to avoid worry is a serious governance failure — it withholds material information the board needs to fulfill its fiduciary and oversight responsibilities.

Practice this question →
34
MCQmedium

A Portfolio Manager identifies a high-level risk where the cumulative budget of active projects exceeds the total portfolio funding ceiling. Which action best aligns with Portfolio Risk Management best practices?

A.Re-evaluate the portfolio risk response plan to include a portfolio-level contingency reserve adjustment.
B.Update the Portfolio Strategic Plan to increase the budget ceiling without further assessment.
C.Terminate all projects that are currently over budget to bring the portfolio back into balance.
D.Initiate a project-level change request to adjust the budget of each project individually.
AnswerA

Adjusting the portfolio-level contingency reserve within the risk response plan addresses the aggregate funding exposure, which sits above individual project budgets. Component-level reserves cannot absorb a portfolio-wide shortfall, so the response must be re-planned at portfolio level.

Why this answer

When the cumulative budget of active projects exceeds the portfolio funding ceiling, this is a portfolio-level risk that requires a portfolio-level response. Re-evaluating the portfolio risk response plan to include a contingency reserve adjustment is the correct action because it addresses the risk at the right level of governance and follows the Plan Risk Responses process. Project-level change requests or unilateral strategy changes bypass proper portfolio governance.

Exam trap

The trap is choosing a project-level or strategy-level action for a portfolio-level risk — candidates must recognize that the governance level of the response must match the governance level of the risk.

How to eliminate wrong answers

Option B is wrong because unilaterally increasing the budget ceiling without assessment bypasses governance and ignores the underlying risk — the ceiling exists for a reason and changing it requires board approval with analysis. Option C is wrong because terminating all over-budget projects is a draconian, indiscriminate response that ignores strategic value and could destroy the portfolio. Option D is wrong because project-level change requests cannot resolve a portfolio-level funding constraint — the sum of individual adjustments may still exceed the ceiling, and this approach fragments the response.

Practice this question →
35
Multi-Selectmedium

Which THREE are key elements of a portfolio risk management culture?

Select 3 answers
A.Accountability for risks.
B.Hiding all risks until the end of the year.
C.Proactive communication.
D.Transparency in reporting.
E.Blaming staff for project delays.
AnswersA, C, D

Accountability for risks embeds ownership directly into the portfolio governance structure, satisfying the stem's demand for a cultural element rather than a process step. When named individuals answer for outcomes, risk escalation and mitigation decisions accelerate, because ambiguity about who owns each exposure disappears. Culture shifts only when consequences attach to specific roles.

Why this answer

A portfolio risk management culture requires clear accountability for risks, meaning named owners are responsible for identifying, assessing, and responding to risks throughout the portfolio lifecycle. Proactive communication is essential because risks must be surfaced early and shared across projects, programs, and governance bodies so mitigation can occur before issues escalate. Transparency in reporting is also key, as accurate, timely risk reporting to stakeholders and governance boards enables informed decisions and effective prioritization.

Hiding risks until year-end undermines early mitigation and is the opposite of a healthy risk culture, while blaming staff for delays destroys psychological safety and discourages honest risk disclosure.

Practice this question →
36
MCQhard

During a quarterly portfolio risk review, you plot each component's risk exposure against its contribution to strategic objectives. One program shows low individual risk exposure but underpins three of the five strategic objectives, while two larger programs with high individual exposure contribute to only one objective each. The portfolio board asks how to prioritize risk response funding. Which portfolio risk management concept should drive your recommendation?

A.Weight each component's risk exposure by its contribution to strategic objectives, then allocate response funding to protect the objectives with the greatest weighted exposure.
B.Allocate funding equally across all components so that no program is disadvantaged and each retains its baseline contingency reserve.
C.Rank components strictly by their individual risk exposure scores, since the highest exposures represent the greatest threat to portfolio value.
D.Defer the decision until each program completes its next risk reassessment, then fund responses in the order the revised registers are submitted.
AnswerA

Portfolio risk prioritization is driven by impact on strategic objectives, not by component size. Weighting exposure by each component's contribution to objectives reveals that the low-exposure program carries disproportionate strategic consequence. Funding responses against weighted exposure directs limited mitigation resources where they protect the most strategic value across the portfolio.

Why this answer

Portfolio risk response funding should follow strategic value at risk, not raw component size or administrative convenience. Weighting each component's exposure by how many strategic objectives it supports exposes the disproportionate consequence of the small program and directs mitigation funds where they defend the most strategic intent. Exposure-only ranking, equal allocation, and deferral all misprice that consequence.

Exam trap

The trap here is equating the largest individual risk exposure with the greatest portfolio threat, when strategic objective contribution actually determines portfolio-level priority.

Practice this question →
37
MCQmedium

You are the portfolio manager for a pharmaceutical company. Your portfolio includes projects developing new drugs. A new regulatory guideline is expected to be released in six months, which may require additional clinical trials for one of the drugs. The project manager for that drug development project has not included this in the project risk register because the guideline is not yet final. How should you handle this in the portfolio risk management process?

A.Add the potential regulatory change to the portfolio risk register as an emerging risk, with a response strategy to monitor and prepare for possible additional trials.
B.Wait until the guideline is final before adding it to any risk register, to avoid managing speculative risks.
C.Instruct the project manager to include it in the project risk register only if the guideline is confirmed to affect the project.
D.Document the risk in the portfolio risk register but assign no owner until the guideline is released.
AnswerA

Emerging risks are those that are not yet certain but could have significant impact. The portfolio risk register should capture such risks to enable proactive monitoring and preparation. By adding it, you ensure the portfolio is ready to respond if the guideline is finalized. This aligns with portfolio risk management's goal of anticipating and mitigating risks that affect strategic objectives.

Why this answer

Emerging risks with potential portfolio-level impact should be captured in the portfolio risk register even before they are certain. This allows the portfolio manager to monitor the situation, allocate resources for contingency planning, and ensure alignment with strategic objectives. Assigning an owner and defining a preliminary response strategy are essential steps.

Waiting for confirmation could result in missed opportunities to mitigate or avoid negative impacts.

Exam trap

The trap here is dismissing a potential regulatory change as too speculative to manage, missing the opportunity to prepare for a high-impact emerging risk.

Practice this question →
38
MCQeasy

What is the primary role of the Portfolio Manager regarding risk?

A.To hide risks from the board until they are solved.
B.To write the detailed task plan for every project.
C.To fix every issue on every project personally.
D.To establish and oversee the portfolio risk management process.
AnswerD

Portfolio risk management spans the whole portfolio, so the Portfolio Manager owns the process itself: defining how risks are identified, assessed, prioritised and monitored across components. This satisfies the stem's focus on the primary role, distinct from component-level risk ownership.

Why this answer

The portfolio manager's primary risk role is to establish and oversee the portfolio risk management process, ensuring that risk is identified, assessed, prioritized, and managed consistently across all components. This includes defining risk appetite, aggregating component risks into portfolio-level exposure, and reporting to governance bodies. The portfolio manager does not personally manage every project risk but provides the framework and oversight that enables consistent risk management.

Exam trap

PfMP often tests whether candidates understand that the portfolio manager's risk role is establishing and overseeing the process at the portfolio level, not personally managing component-level risks or task plans.

How to eliminate wrong answers

Option A is wrong because hiding risks from the board is unethical and contrary to governance and transparency requirements; portfolio managers must escalate material risks. Option B is wrong because writing detailed task plans for every project is a project manager responsibility, not a portfolio manager function; the portfolio manager operates at a strategic, aggregate level. Option C is wrong because personally fixing every issue on every project is neither feasible nor appropriate; portfolio managers oversee and enable, while project managers resolve component-level issues.

Practice this question →
39
Multi-Selectmedium

You are conducting a portfolio risk review with your team. The portfolio board has asked you to identify inputs that are essential for effective portfolio risk management. Which two of the following are considered key inputs to the portfolio risk management process? (Choose two.)

Select 2 answers
A.Portfolio performance reports
B.Individual project schedules
C.Resource breakdown structure
D.Portfolio management plan
E.Portfolio risk register
AnswersD, E

The portfolio management plan defines how the portfolio will be managed, including risk management approach, governance, and tolerances. It is a key input because it sets the framework and guidelines for identifying, analyzing, and responding to portfolio risks. It ensures risk management aligns with strategic objectives.

Why this answer

The portfolio management plan and portfolio risk register are essential inputs to portfolio risk management. The plan provides the governance framework and risk approach, while the register documents current risks and responses. Together, they enable systematic identification, analysis, and response planning.

Exam trap

The trap here is confusing general portfolio documents, like performance reports or resource structures, with the specific inputs required for the risk management process.

Practice this question →
40
Multi-Selectmedium

Which THREE of the following are considered when assessing portfolio risk?

Select 3 answers
A.The frequency of office social events.
B.The color of the project office wallpaper.
C.Strategic alignment of projects.
D.Resource availability constraints.
E.Aggregate financial impact.
AnswersC, D, E

Portfolio risk assessment weighs each component's contribution to strategic objectives, so misalignment raises the risk that investment delivers little enterprise value. Strategic alignment therefore forms a core assessment criterion alongside value, dependency and resource considerations.

Why this answer

Portfolio risk assessment evaluates how the collection of projects collectively affects organizational objectives, so option C (Strategic alignment of projects) is correct because misalignment across the portfolio can undermine expected benefits and increase strategic risk. Option D (Resource availability constraints) is correct because shared or scarce resources across projects create scheduling conflicts, bottlenecks, and delivery risk at the portfolio level. Option E (Aggregate financial impact) is correct because portfolio risk considers the combined financial exposure and potential losses across all projects, not just individual project budgets.

Options A and B are incorrect because office social events and wallpaper color are irrelevant environmental or aesthetic factors with no bearing on portfolio risk analysis.

Exam trap

PfMP often tests the distinction between project-level and portfolio-level risk factors—candidates may pick operational or trivial items because they confuse project execution details with portfolio strategy, but the correct answers must relate to strategic, resource, and financial aggregation.

Practice this question →
41
MCQhard

You are assessing the 'risk-adjusted return' of your portfolio. Which components are critical for this calculation?

A.Expected return and the value at risk (VaR).
B.Stakeholder satisfaction scores.
C.Budgeted cost and actual cost.
D.Resource count and project timeline.
AnswerA

Risk-adjusted return compares the expected return of portfolio components against their value at risk, quantifying potential loss at a given confidence level. Combining these two inputs expresses return per unit of downside exposure, which is precisely what the risk-adjusted calculation requires.

Why this answer

Risk-adjusted return measures the return on a portfolio component or the portfolio as a whole relative to the risk taken to achieve it. The two critical components are the expected return (the anticipated benefit or financial return) and the value at risk (VaR), which quantifies the potential loss at a given confidence level and time horizon. Together they allow comparison of components with different risk profiles on a common basis.

Exam trap

PfMP often tests the components of risk-adjusted return, and the trap is confusing cost or schedule metrics (budget variance, timeline) with return and risk metrics—candidates must recognize that 'return' and 'risk' are the only two required inputs.

How to eliminate wrong answers

Option B is wrong because stakeholder satisfaction scores are perception metrics that do not quantify financial or strategic return and have no role in a risk-adjusted return calculation. Option C is wrong because budgeted cost and actual cost are cost performance metrics (used in CPI and variance analysis), not return or risk measures—they say nothing about the value generated per unit of risk. Option D is wrong because resource count and project timeline are capacity and schedule metrics; they inform feasibility and delivery planning but are not inputs to risk-adjusted return, which requires expected return and risk quantification.

Practice this question →
42
MCQeasy

During a portfolio review, you note that several projects are reporting risks that, if materialized, would impact shared resources and strategic initiatives. You need to ensure these risks are managed cohesively. Which portfolio document should you update to reflect the consolidated view of these risks?

A.Portfolio dashboard
B.Portfolio management plan
C.Portfolio benefits realization plan
D.Portfolio risk register
AnswerD

The portfolio risk register consolidates risks from all components and provides a holistic view of risks that affect the portfolio. It is the appropriate document to update with risks that impact shared resources and strategic initiatives, enabling coordinated response planning and monitoring at the portfolio level.

Why this answer

The portfolio risk register is the central repository for all portfolio-level risks, including those that affect multiple components or shared resources. It enables the portfolio manager to consolidate, prioritize, and monitor risks across the portfolio. Updating it ensures that risks impacting strategic initiatives are managed cohesively and that appropriate responses are coordinated.

Exam trap

The trap here is confusing the portfolio risk register with other portfolio documents like the dashboard or management plan, which serve different purposes.

Practice this question →
43
MCQmedium

A Portfolio Manager identifies a high probability risk involving resource scarcity across all active projects. What is the most appropriate risk response?

A.Mitigate the risk by establishing a cross-project resource management strategy.
B.Avoid the risk by cancelling all projects that require these resources.
C.Escalate the risk to the project managers and let them handle it individually.
D.Accept the risk and wait for the resource availability to improve.
AnswerA

A cross-project resource management strategy directly addresses scarcity spanning all active projects, satisfying the portfolio-wide scope constraint. Mitigation reduces probability or impact through coordinated allocation, rather than handling projects individually. Portfolio-level responses must synchronise shared resources across components, which project-level mitigation cannot achieve.

Why this answer

Resource scarcity across multiple projects is a portfolio-level risk that requires a portfolio-level response, so establishing a cross-project resource management strategy is the most appropriate mitigation. This approach optimizes resource allocation across the entire portfolio, balances competing demands, and reduces the likelihood and impact of scarcity. It aligns with the PfMP principle that portfolio risks are managed holistically rather than in isolated project silos.

Exam trap

PfMP often tests whether candidates recognize that portfolio-level risks require portfolio-level responses, so the trap is selecting a project-level action such as escalation to project managers or individual project cancellation instead of a holistic mitigation strategy.

How to eliminate wrong answers

Option B is wrong because cancelling all projects requiring the scarce resources is an extreme avoidance response that destroys portfolio value and is disproportionate to a high-probability but manageable risk. Option C is wrong because escalating to project managers to handle individually fragments the response and ignores the portfolio-level nature of the risk, leading to suboptimization and internal competition for resources. Option D is wrong because passive acceptance is inappropriate for a high-probability risk with significant portfolio impact; acceptance is only suitable for low-impact risks or when no cost-effective response exists.

Practice this question →
44
MCQhard

You are assessing the 'aggregate risk exposure' of a portfolio. What is the most critical factor to consider?

A.The dependencies and correlations between portfolio risks.
B.The total budget allocated to the project office.
C.The average experience level of the project managers.
D.The number of projects currently active.
AnswerA

Aggregate risk exposure is not the sum of individual risks; correlated or dependent risks can compound, amplifying or offsetting each other. Assessing those dependencies and correlations is therefore the most critical factor when judging the portfolio's true combined exposure.

Why this answer

Interdependencies and correlations are the key factors that differentiate aggregate risk from the sum of parts.

Practice this question →
45
Multi-Selectmedium

You are developing a portfolio risk management plan. Which TWO elements are essential to include in this plan? (Choose two.)

Select 2 answers
A.Risk thresholds and tolerances for the portfolio
B.A detailed list of all project-level tasks
C.The names of all project team members
D.The frequency and format of portfolio risk reviews
E.A copy of the organization's marketing strategy
AnswersA, D

Risk thresholds and tolerances define the acceptable level of risk for the portfolio. They are essential because they guide decision-making on whether to accept, mitigate, or avoid risks. Without them, the portfolio manager cannot determine when a risk exceeds the organization's risk appetite, leading to inconsistent risk responses across projects.

Why this answer

The two essential elements are risk thresholds and tolerances, and the frequency and format of portfolio risk reviews. Risk thresholds and tolerances set the boundaries for acceptable risk, while review frequency and format ensure ongoing monitoring and control. Together, they provide the framework for consistent and effective portfolio risk management.

Exam trap

The trap here is selecting operational details like task lists or team names, which belong to project management, rather than strategic risk components that are essential for portfolio-level risk planning.

Practice this question →
46
MCQeasy

You are reviewing the portfolio risk register and notice that a risk related to a key supplier's financial stability has been marked as 'accepted.' Under what circumstances is accepting this risk most appropriate?

A.When there are no other options available to address the risk.
B.When the supplier has provided a guarantee that they will not go bankrupt.
C.When the cost of mitigating the risk exceeds the potential impact, and the risk is within the portfolio's risk tolerance.
D.When the risk has a low probability of occurring, regardless of its impact.
AnswerC

Acceptance is appropriate when the cost of mitigation outweighs the potential impact and the risk falls within the portfolio's risk tolerance. This means the portfolio can absorb the consequences if the risk occurs. It is a conscious decision to not take action, often documented with a contingency plan. This aligns with PfMP principles of balancing risk and reward.

Why this answer

Accepting a risk is most appropriate when the cost of mitigation exceeds the potential impact and the risk is within the portfolio's risk tolerance. This ensures that the portfolio is not spending more to mitigate than the risk could cost, and that the remaining exposure is acceptable. It is a strategic decision that should be documented and monitored.

Exam trap

The trap here is to think that acceptance is only for low-probability risks, but it can also be for high-probability risks if the impact is manageable and within tolerance.

Practice this question →
47
Multi-Selecthard

Which THREE of the following are quantitative analysis techniques?

Select 3 answers
A.SWOT analysis.
B.Decision tree analysis.
C.Monte Carlo analysis.
D.Sensitivity analysis.
E.Brainstorming.
AnswersB, C, D

Decision tree analysis assigns monetary values and probabilities to branches, producing expected values for comparing options. That numerical expected-value computation is what makes it quantitative, satisfying the stem's requirement for techniques that yield measurable, numeric outputs.

Why this answer

Decision tree analysis (B) is a quantitative technique because it assigns monetary values and probabilities to branches to compute expected monetary value (EMV) for each alternative. Monte Carlo analysis (C) is quantitative because it runs repeated random simulations of cost or schedule variables to produce a probabilistic distribution of outcomes, such as a confidence level for completing within budget. Sensitivity analysis (D) is quantitative because it numerically varies one input at a time (e.g., a tornado diagram) to measure how much each variable affects the outcome.

SWOT analysis (A) is a qualitative strategic assessment of strengths, weaknesses, opportunities, and threats, and brainstorming (E) is a qualitative group idea-generation technique, so neither relies on numerical modeling.

Exam trap

PfMP often tests the qualitative vs. quantitative distinction—candidates may select SWOT or brainstorming because they are commonly used in risk workshops, but the exam requires recognizing that only techniques producing numerical outputs are quantitative.

Practice this question →
48
MCQmedium

You are the portfolio manager for a financial services firm. A new regulatory requirement mandates that all customer data be stored within the country. Your portfolio includes a project upgrading the CRM system, which currently stores data in a foreign cloud region. The project manager reports that the compliance risk is not in the project risk register because it is considered a portfolio-level concern. What should you do first to ensure this risk is managed appropriately?

A.Conduct a qualitative risk analysis on the CRM project to determine the probability and impact of the regulatory change.
B.Escalate the risk to the PMO and wait for their guidance before taking any action.
C.Instruct the project manager to add the risk to the project risk register and manage it locally.
D.Update the portfolio risk register to include the regulatory compliance risk, assign an owner, and define response strategies.
AnswerD

Portfolio-level risks that affect multiple projects or the entire portfolio must be recorded in the portfolio risk register. This ensures centralized visibility, ownership, and coordinated response. The regulatory risk impacts the CRM project and potentially other projects, so it belongs at the portfolio level. Updating the portfolio risk register is the first step to ensure it is managed, not just documented in the project register.

Why this answer

The risk affects multiple projects and the portfolio's compliance posture, so it must be captured in the portfolio risk register. This central repository ensures the risk is visible, owned, and addressed with appropriate responses. Project-level management alone would not address cross-project impacts or strategic alignment.

The portfolio manager should first ensure the risk is recorded and assigned, then proceed with analysis and response planning.

Exam trap

The trap here is assuming that because the risk originates in a project, it should only be managed in the project risk register, ignoring portfolio-level aggregation.

Practice this question →
49
MCQmedium

You are leading a portfolio risk workshop with project managers. One project manager suggests that since their project is ahead of schedule, they can ignore a medium-probability risk because it won't affect their timeline. How should you respond as the portfolio manager?

A.Agree, because the project's schedule buffer can absorb any impact.
B.Escalate the decision to the project sponsor for their approval.
C.Explain that the risk must still be evaluated for its potential impact on the entire portfolio.
D.Remove the risk from the project's risk register to avoid unnecessary reporting.
AnswerC

As a portfolio manager, you must ensure that risks are evaluated at the portfolio level. Even if a project is ahead of schedule, the risk could affect other projects, shared resources, or strategic goals. The risk's aggregate impact must be considered, and it should remain in the portfolio risk register for monitoring and potential response.

Why this answer

The correct response is to explain that the risk must still be evaluated for its impact on the entire portfolio. Portfolio risk management requires a holistic view; risks that seem contained within one project can have ripple effects across the portfolio. The portfolio manager must ensure that all risks are assessed for their aggregate impact and managed accordingly.

Exam trap

The trap here is focusing solely on the individual project's schedule buffer and overlooking the portfolio-wide implications of a risk, which is a common oversight in siloed risk management.

Practice this question →
50
Multi-Selectmedium

Which THREE components are found in a Portfolio Risk Register?

Select 3 answers
A.Planned risk response.
B.Project team lunch menu.
C.Risk description.
D.Risk impact/severity score.
E.Personal salary data of project leads.
AnswersA, C, D

A Portfolio Risk Register records each identified portfolio-level risk together with its planned risk response, the agreed mitigation or contingency action. This satisfies the stem by capturing how the portfolio will address the risk should it materialise.

Why this answer

The Portfolio Risk Register is a governance artifact that records each identified portfolio-level risk along with structured attributes, so option C (Risk description) is correct because every register entry must clearly state the risk event and its cause so it can be assessed and owned. Option D (Risk impact/severity score) is correct because each risk is rated for probability and impact (often using a qualitative scale or numeric score) to enable prioritization and escalation decisions across the portfolio. Option A (Planned risk response) is correct because the register documents the agreed response strategy — such as avoid, mitigate, transfer, or accept — along with the assigned risk owner and target date.

Option B (Project team lunch menu) is incorrect because catering logistics are unrelated to risk governance, and option E (Personal salary data of project leads) is incorrect because HR compensation data is confidential and outside the scope of a risk register.

Exam trap

PfMP often tests whether candidates confuse project-level artifacts with portfolio-level artifacts, so the trap is selecting operational or HR details (lunch menus, salaries) that feel like 'register content' but have no risk-management purpose.

Practice this question →
51
MCQhard

You are managing a portfolio of IT projects for a healthcare organization. During a portfolio risk review, you identify that three projects rely on the same external vendor for a critical software component. The vendor has recently been acquired by a competitor, and there is a risk that support and licensing terms may change unfavorably. Which action best addresses this portfolio-level risk?

A.Transfer the risk by purchasing insurance that covers vendor-related disruptions.
B.Accept the risk and monitor the vendor's actions, taking no proactive steps until an actual issue arises.
C.Develop a portfolio risk response plan that includes qualifying alternative vendors and renegotiating contracts with the current vendor.
D.Instruct each project manager to develop a contingency plan for their individual project's dependency on the vendor.
AnswerC

This risk is portfolio-level because it affects multiple projects through a common vendor. A coordinated response plan can leverage portfolio-wide buying power, assess alternatives, and mitigate the impact across all affected projects. Addressing it at the portfolio level ensures consistency and avoids duplicated efforts. Qualifying alternative vendors and renegotiating contracts are proactive steps to reduce the risk's probability and impact.

Why this answer

The shared vendor dependency creates a portfolio-level risk that requires a coordinated response. Developing a portfolio risk response plan allows the organization to leverage its collective influence, explore alternative vendors, and renegotiate contracts to secure favorable terms. This approach addresses the risk across all affected projects, ensuring efficiency and consistency.

Individual project plans or insurance would not adequately mitigate the systemic nature of this risk.

Exam trap

The trap here is treating a shared vendor risk as independent project risks rather than recognizing the portfolio-level aggregation and the need for a coordinated response.

Practice this question →
52
MCQhard

During a quarterly portfolio risk review, you notice that two strategic initiatives have risks that are individually rated as low, but when combined, they could cause a critical shared supplier to fail. This situation is an example of:

A.Risk correlation
B.Risk appetite
C.Risk transference
D.Risk mitigation
AnswerA

Risk correlation refers to the relationship between risks where the occurrence of one may increase the likelihood or impact of another. Here, the two individually low risks combine to create a critical supplier failure, which is a correlated risk. Portfolio managers must identify and manage such correlations because they can escalate aggregate risk beyond the sum of individual risks.

Why this answer

The correct answer is risk correlation. When two risks interact, their combined effect can be greater than the sum of their individual impacts. In portfolio management, understanding correlations is essential because risks across projects may not be independent.

A portfolio manager must assess how risks correlate to accurately evaluate aggregate risk exposure and prioritize responses.

Exam trap

The trap here is confusing the interaction of risks with general risk concepts like appetite or mitigation, when the scenario specifically describes correlated risks amplifying each other.

Practice this question →
53
MCQmedium

During a portfolio review, you observe that the actual ROI is consistently lower than predicted due to cumulative risk impacts. What is the most logical next step?

A.Increase the budget for all projects to improve their output.
B.Re-balance the portfolio by prioritizing projects with higher ROI and lower risk.
C.Ask the board to lower the ROI targets for the year.
D.Stop all active projects and restart the portfolio planning cycle.
AnswerB

Re-balancing toward higher-ROI, lower-risk projects directly addresses the cumulative risk impacts depressing actual ROI. Portfolio rebalancing reallocates investment to restore alignment between predicted and realised returns, satisfying the stem's constraint that risk-driven underperformance requires corrective portfolio action.

Why this answer

When actual ROI consistently falls below predictions due to cumulative risk impacts, the portfolio manager's core responsibility is to rebalance the portfolio — shifting investment toward components with stronger risk-adjusted returns and away from underperformers. This is the portfolio balancing and optimization response, not a budget, target, or restart decision.

Exam trap

PfMP often tests the misconception that underperformance should be met with more funding or relaxed targets, when the correct portfolio management response is disciplined rebalancing based on risk-adjusted return.

How to eliminate wrong answers

Option A is wrong because increasing budgets across all projects does not address the root cause (cumulative risk impacts) and may worsen ROI by pouring more money into underperforming components. Option C is wrong because lowering ROI targets is a form of goal manipulation that masks the problem rather than managing the portfolio; governance boards set targets based on strategy, not on poor performance. Option D is wrong because stopping all projects and restarting planning is a disproportionate, disruptive overreaction that destroys value and momentum; portfolio management calls for incremental rebalancing, not wholesale shutdown.

Practice this question →
54
MCQmedium

You are managing a portfolio of IT infrastructure projects. A new regulatory requirement is expected to increase the cost of compliance for all projects in the portfolio by 10-15% over the next fiscal year. Your portfolio sponsor asks you to update the portfolio risk register and recommend a response strategy. Which action best aligns with portfolio risk management principles?

A.Escalate the risk to the portfolio governance board and recommend rebalancing the portfolio to include projects with lower compliance exposure.
B.Accept the risk because regulatory changes are external and cannot be mitigated, and increase the portfolio contingency reserve by 15%.
C.Instruct each project manager to include the regulatory risk in their individual project risk registers and manage it locally.
D.Conduct a portfolio-level risk assessment to quantify the aggregate impact, then develop a coordinated response plan that may include renegotiating contracts, adjusting budgets, or rebalancing components.
AnswerD

This action follows the portfolio risk management process: identify, assess, and respond at the portfolio level. Quantifying aggregate impact reveals the true exposure and informs a coordinated response that leverages portfolio-wide mitigation, such as bulk contract negotiations or strategic rebalancing. It ensures the response is proportionate and aligned with portfolio objectives.

Why this answer

Portfolio risk management requires assessing risks that affect multiple components at the portfolio level. A regulatory change impacting all projects should be quantified in aggregate, then addressed with a coordinated response that may include portfolio-wide mitigation, transfer, or avoidance strategies. This ensures efficient use of resources and alignment with strategic objectives, rather than fragmented project-level responses.

Exam trap

The trap here is treating a portfolio-level risk as a collection of independent project risks, which overlooks aggregation effects and coordinated response opportunities.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Portfolio Risk Management questions.

Start 20-question session