PMP Process — Managing Technical Aspects Practice Question
You are the project manager for a large-scale data migration project from on-premises servers to AWS. The project involves migrating 50 terabytes of sensitive customer data. The team has completed the initial assessment and is now in the planning phase. The Chief Information Security Officer (CISO) has mandated that all data must be encrypted in transit and at rest. Additionally, the migration must minimize downtime and ensure data integrity. The project has a tight budget and schedule. During a planning meeting, the lead architect proposes using AWS Snowball Edge devices for the initial bulk transfer, followed by AWS DataSync for ongoing replication. However, the CISO is concerned about encryption key management and audit trails. As the project manager, what should you do first to address the CISO's concerns?
⚠ Common exam trap
Many candidates assume that because AWS services handle encryption automatically, no further action is needed, but the PMP exam tests the understanding that the project manager must facilitate stakeholder collaboration to define specific security requirements, not just rely on vendor documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Schedule a meeting with the security team and the architect to define encryption key management and audit trail requirements.
The CISO's concerns about encryption key management and audit trails are legitimate governance issues that must be addressed before proceeding. As the project manager, you need to facilitate a meeting between the security team and the lead architect to define clear requirements for key management (e.g., using AWS KMS with customer-managed keys) and audit logging (e.g., AWS CloudTrail for API calls and Snowball Edge device logs). This collaborative approach ensures that the proposed technical solution aligns with organizational security policies and compliance needs, which is critical before moving forward with the migration plan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Schedule a meeting with the security team and the architect to define encryption key management and audit trail requirements.
Why this is correct
This option demonstrates proactive stakeholder engagement and collaborative problem-solving, which are critical PMP competencies. By scheduling a meeting with the security team and architect, the project manager facilitates the detailed definition of specific encryption key management and audit trail requirements. This ensures that security concerns, particularly those raised by the CISO, are directly addressed and integrated into the project's design, preventing future compliance issues and rework.
- ✗
Proceed with the architect's proposal and document that encryption is handled by AWS services.
Why it's wrong here
Proceeding without addressing the CISO's specific concerns about key management and audit trails is a critical failure in stakeholder management and risk identification. Simply documenting that AWS handles encryption does not satisfy the detailed security requirements or mitigate the potential compliance risks highlighted by a key stakeholder. This approach risks project delays, non-compliance, and potential security breaches by ignoring specific, valid security requirements.
- ✗
Update the risk register and accept the risk related to encryption key management.
Why it's wrong here
Accepting a significant security risk, such as encryption key management, without first exploring mitigation strategies is a premature and irresponsible risk response. A project manager should always attempt to identify and evaluate potential risk responses, including mitigation, transfer, or avoidance, before resorting to acceptance, especially when a key stakeholder like the CISO has raised specific concerns. This approach neglects proactive risk management and could lead to severe project impacts.
- ✗
Inform the CISO that the proposed services meet all encryption requirements per AWS documentation.
Why it's wrong here
Dismissing the CISO's specific and valid concerns by merely citing general AWS documentation is a failure in effective communication and stakeholder management. It implies that the project manager has not fully understood or investigated the CISO's detailed questions regarding key management and audit trails. This approach can erode trust, lead to unaddressed security vulnerabilities, and ultimately result in project non-compliance or rework when specific requirements are later enforced.
Go deeper
Related to this question
About these practice questions
This PMP question is part of Courseiva's 800-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PMP practice question is part of Courseiva's free PMI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PMP exam.