PMI Risk Management Professional (PMI-RMP) (PMI-RMP) PMI-RMP Questions 151–199 | Page 3/3

151

MCQeasy

You are a risk manager on a construction project. The project sponsor requests a report on the top five risks by exposure. You have calculated the risk exposure for each risk as the product of probability and impact. Which document should you consult to obtain the most current probability and impact values for each risk?

A.Risk register

B.Lessons learned register

C.Issue log

D.Risk management plan

AnswerA

The risk register is the primary document that contains detailed information about each identified risk, including its probability, impact, risk score, and response plan. It is regularly updated throughout the project lifecycle, so it holds the most current values. To report on top risks by exposure, you must consult the risk register for the latest probability and impact assessments. This ensures that the report reflects the current risk landscape and supports informed decision-making.

Why this answer

The risk register is the centralized repository for all risk-related information, including current probability and impact assessments. It is updated throughout the project, making it the authoritative source for calculating risk exposure. Other documents like the risk management plan, issue log, and lessons learned register serve different purposes and do not contain the real-time risk data needed for this report.

Exam trap

The trap here is confusing the risk management plan with the risk register; the plan describes the process, while the register contains the actual risk data.

Full explanation →

152

MCQeasy

During a risk audit, you identify that a previously closed risk has manifested. What is the most appropriate action to ensure accurate project risk status?

A.Archive the risk to maintain the dashboard clarity

B.Create a new risk entry in the Risk Register

C.Update the Lessons Learned repository only

D.Re-open the existing risk and update the response plan

AnswerD

A closed risk that has actually occurred must return to the register as active, because the risk status is no longer valid. Re-opening it preserves the original identification, owner and history, and lets the response plan be revised to reflect the realised threat.

Why this answer

When a previously closed risk manifests, the most appropriate action is to re-open the existing risk and update its response plan. This maintains the integrity of the risk register, ensures the risk is actively managed again, and allows the team to apply the planned response or adjust it based on current conditions. It also preserves the historical link between the original risk and its realization.

Exam trap

The trap is thinking that a closed risk should remain closed or be replaced by a new entry; candidates may choose to create a new risk to avoid re-opening, but that loses traceability and violates proper risk management practice.

How to eliminate wrong answers

Option A is wrong because archiving the risk would hide a real issue and prevent proper management, compromising project risk status. Option B is wrong because creating a new risk entry duplicates the risk and loses the history and context of the original entry, leading to confusion and potential double-counting. Option C is wrong because updating lessons learned alone does not address the active risk; it is a retrospective action, not a real-time response.

Full explanation →

153

MCQhard

You are leading a project where the stakeholders have a 'neutral' risk attitude. Which risk strategy is most appropriate for this environment?

A.Accept all risks without analysis.

B.Outsource everything to external experts.

C.Avoid all risks regardless of cost.

D.Perform balanced analysis to ensure risks are treated proportionally to their impact.

AnswerD

Neutral stakeholders neither seek nor avoid risk, so neither aggressive exploitation nor heavy avoidance fits. Balanced analysis weighs each risk's probability and impact, applying responses proportional to exposure, which matches a neutral appetite rather than uniformly maximising or minimising risk.

Why this answer

A neutral risk attitude means the organization neither seeks nor avoids risk but evaluates it on its merits, so the appropriate approach is balanced analysis that treats each risk proportionally to its impact. This aligns with the PMI-RMP principle of tailoring risk responses to the organization's risk appetite and tolerance. Option D reflects that measured, proportionate treatment rather than blanket acceptance or avoidance.

Exam trap

PMI-RMP often tests the confusion between risk attitude (averse, neutral, seeking) and risk response strategies (avoid, transfer, mitigate, accept), so candidates incorrectly pick a response strategy when the question is really asking about the decision-making posture.

How to eliminate wrong answers

Option A is wrong because accepting all risks without analysis is the behavior of a risk-seeking or risk-tolerant attitude taken to an extreme, and it ignores the 'proportional to impact' requirement of neutral risk management. Option B is wrong because outsourcing everything to external experts is a risk transfer strategy, not a response to a neutral risk attitude, and it is not universally appropriate or cost-effective. Option C is wrong because avoiding all risks regardless of cost reflects a risk-averse attitude, which contradicts the neutral stance that weighs risk against opportunity and cost.

Full explanation →

154

MCQeasy

When monitoring risk triggers, what is the primary purpose of a 'Risk Trigger' threshold field in your project management software?

A.To automate the closure of the risk entry

B.To define the escalation path for the project manager

C.To provide an objective indicator that a risk is about to occur

D.To notify the finance department of budget changes

AnswerC

The threshold field stores a measurable value, such as a cost variance or schedule slip, that signals the risk is materialising. Crossing it gives an objective, pre-agreed cue to activate the response plan rather than relying on subjective judgement.

Why this answer

The primary purpose of a risk trigger threshold field is to provide an objective, measurable indicator that a risk is about to occur, enabling timely activation of the response plan. It sets a specific value or condition that, when met, signals the need for action. This supports proactive risk management rather than reactive firefighting.

Exam trap

PMI-RMP often tests the misconception that a trigger threshold is for escalation or closure, when its core purpose is to provide an objective indicator of impending risk occurrence.

How to eliminate wrong answers

Option A is wrong because a trigger threshold does not automate risk closure; closure is a deliberate decision based on risk status, not a threshold breach. Option B is wrong because the escalation path is defined separately in the risk management plan or communication plan, not by the trigger threshold field. Option D is wrong because notifying the finance department of budget changes is a communication action, not the purpose of a trigger threshold; the threshold is about risk occurrence, not budget updates.

Full explanation →

155

Multi-Selectmedium

Which THREE factors should be considered when assessing the impact of a risk?

Select 3 answers

A.Technical performance degradation

B.Financial cost

C.Personnel vacation schedule

D.Schedule delay

E.Office supply availability

AnswersA, B, D

Technical performance degradation measures how far a risk event would reduce the product's functionality, quality or specification compliance. It is an essential impact factor because it captures non-monetary consequences to the deliverable itself, complementing schedule and cost dimensions in risk assessment.

Why this answer

When assessing the impact of a risk, three key dimensions are technical performance degradation (A), financial cost (B), and schedule delay (D). Technical performance degradation (A) matters because a risk can reduce system functionality, reliability, or quality below required specifications, directly affecting whether the deliverable meets its technical objectives. Financial cost (B) is a core impact factor since risks can trigger budget overruns through rework, penalties, or additional resources, which must be quantified against the approved budget baseline.

Schedule delay (D) is equally essential because risks can push critical-path activities past milestones, delaying delivery and potentially incurring contractual penalties or lost business value. By contrast, personnel vacation schedule (C) is a resource-planning or staffing consideration rather than a direct impact dimension, and office supply availability (E) is a trivial operational detail with no meaningful bearing on risk impact assessment.

Exam trap

PMI-RMP often tests the distinction between core project objectives (triple constraint) and peripheral operational factors, tempting candidates to select options that seem relevant but are not standard impact categories.

Full explanation →

156

MCQhard

In a quantitative risk analysis, the cost contingency has been depleted, yet the risk remains. What is the next logical step in the risk process?

A.Accept the risk without further action

B.Update the risk register with a new probability estimate

C.Reduce the scope of the project

D.Escalate the risk to the project board or project sponsor

AnswerD

When contingency is exhausted but the risk persists, the project team lacks authority to fund further response, so the risk must be escalated to the project board or sponsor. This satisfies the stem's constraint of depleted contingency with residual risk.

Why this answer

When the cost contingency is exhausted but the risk remains, the project manager no longer has authority to absorb it within the project budget, so the risk must be escalated to the project board or sponsor. Escalation is the correct risk-process step when the risk exceeds the project manager's tolerance or available reserves. This aligns with PMI's risk escalation and reserve analysis principles.

Exam trap

PMI-RMP often tests escalation thresholds, tempting candidates to choose acceptance or scope reduction when the correct move is to escalate beyond the project manager's authority.

How to eliminate wrong answers

Option A is wrong because simply accepting the risk without action ignores the fact that the contingency is gone and the risk still threatens the project. Option B is wrong because updating the probability estimate does not address the depleted contingency or the need for higher authority. Option C is wrong because reducing scope is a project change decision that must be authorized by the sponsor or board, not a unilateral next step in the risk process.

Full explanation →

157

Multi-Selecteasy

Which TWO stakeholders are most likely to request a detailed 'Risk Report'?

Select 2 answers

A.The office receptionist

B.The local newspaper reporter

C.The project sponsor

D.The project manager

E.The catering service staff

AnswersC, D

The project sponsor requires the Risk Report to oversee overall risk exposure, approve contingency reserves, and make informed decisions about the project's viability. This satisfies the stem's demand for detailed risk information, as sponsors need comprehensive visibility into threats and opportunities to fulfil their governance and funding responsibilities.

Why this answer

The project sponsor (C) is a correct answer because sponsors are accountable for the project's business case and overall success, so they need the Risk Report to understand exposure, potential impacts on budget/schedule/scope, and whether risks threaten expected benefits. The project manager (D) is also correct because they own day-to-day risk management: they use the Risk Report to track identified risks, probability/impact ratings, risk owners, response plans, and status, and to drive mitigation and escalation decisions. The office receptionist (A), local newspaper reporter (B), and catering service staff (E) are not typical project stakeholders with a legitimate need for detailed risk information; they have no role in risk ownership, governance, or decision-making, and sharing such a report with them would be inappropriate and potentially a confidentiality concern.

Exam trap

PMI-RMP often tests the confusion between the Risk Report and the Risk Register, and candidates must remember that the Risk Report is a broader communication artifact for senior stakeholders, not a tactical list of risks.

Full explanation →

158

Multi-Selectmedium

Which THREE criteria are commonly used to score risks during qualitative analysis?

Select 3 answers

A.The office address.

B.The age of the project manager.

C.Probability of occurrence.

D.Impact on project objectives.

E.Urgency of the response required.

AnswersC, D, E

Probability of occurrence directly satisfies the likelihood dimension that qualitative risk scoring requires, letting assessors rank each risk by how likely it is to happen. Combined with impact and detectability, it forms the standard scoring triad, enabling prioritisation without quantitative modelling. This criterion is fundamental to any PMI-RMP qualitative assessment.

Why this answer

Qualitative risk analysis scores each identified risk by combining two core dimensions: the likelihood that the risk event will happen, which is option C, probability of occurrence, and the severity of its effect on scope, schedule, cost, or quality, which is option D, impact on project objectives. These two factors are typically multiplied on a probability-impact matrix to produce a relative risk score that drives prioritization. Option E, urgency of the response required, is also a common qualitative scoring criterion because risks needing near-term action (for example, those with short response windows or imminent triggers) are rated higher so they can be escalated and addressed first.

Options A and B are not risk-scoring criteria: an office address is irrelevant to the likelihood or consequence of a project risk, and the project manager's age has no bearing on risk exposure or prioritization.

Exam trap

PMI-RMP often tests whether candidates can distinguish qualitative scoring criteria (probability, impact, urgency) from irrelevant personal or logistical factors, so distractors like office address or PM age are designed to be obviously wrong but test process discipline.

Full explanation →

159

MCQmedium

A project is utilizing a 'Risk-Adjusted Schedule'. What does this imply about the project's risk planning?

A.The schedule was created by a software tool without human input.

B.The schedule accounts for identified risks via time buffers or logic changes.

C.The schedule has no risks involved.

D.The schedule is fixed and cannot be changed.

AnswerB

A risk-adjusted schedule incorporates contingency reserves or buffer durations and may reorder activities to reflect identified risk exposure. The buffers absorb potential delays from realised threats, so the baseline reflects risk rather than assuming none occurs.

Why this answer

A Risk-Adjusted Schedule is a project schedule that has been deliberately modified to reflect the impact of identified risks and agreed-upon risk responses. This is typically achieved by adding time buffers (such as contingency reserves or feeding buffers) or by altering the logical sequence of activities (e.g., adding lag, changing dependencies, or re-sequencing work) to reduce the probability or impact of risk events. In PMI's risk management framework, this schedule is an output of the Plan Risk Responses process and is used to establish a realistic baseline that accounts for uncertainty rather than assuming a risk-free environment.

Exam trap

PMI-RMP often tests the misconception that a Risk-Adjusted Schedule simply means adding extra time (padding) without linking it to identified risks or logic changes, or that it implies a schedule with no risks or a fixed baseline.

How to eliminate wrong answers

Option A is wrong because a Risk-Adjusted Schedule is not defined by whether a software tool created it; even automated schedules require human input to identify risks and define responses, and the term refers to the content of the schedule, not its creation method. Option C is wrong because no project schedule can be completely free of risks; the Risk-Adjusted Schedule explicitly acknowledges and incorporates risks, so claiming it has no risks contradicts the definition. Option D is wrong because a Risk-Adjusted Schedule is not fixed; it is a dynamic baseline that can be updated as risks materialize or change, and it is specifically designed to allow for adjustments through buffers and logic changes.

Full explanation →

160

MCQeasy

Which document outlines how risk management activities will be communicated to stakeholders?

A.The Project Charter.

B.The Risk Register.

C.The Communications Management Plan.

D.The Resource Management Plan.

AnswerC

The Communications Management Plan defines stakeholder information needs, formats, channels and timing, so it governs how risk management communications are delivered. It is the document that satisfies the stem's requirement for outlining risk communication to stakeholders, not the risk or stakeholder plan.

Why this answer

The Communications Management Plan is the PMBOK document that defines how project information—including risk management activities, risk status reports, and risk escalation paths—will be distributed to stakeholders. It specifies who receives what information, in what format, at what frequency, and through which channel. Since the question asks specifically about how risk management activities will be communicated, this plan is the correct governing document.

Exam trap

PMI-RMP often tests whether candidates confuse the document that contains risk information (Risk Register) with the document that governs how that information is shared (Communications Management Plan).

How to eliminate wrong answers

Option A is wrong because the Project Charter authorizes the project and names the project manager but does not describe communication methods or risk communication protocols. Option B is wrong because the Risk Register is a repository of identified risks, their analysis, owners, and responses—it is the content being communicated, not the plan describing how communication occurs. Option D is wrong because the Resource Management Plan covers how project resources (people, equipment, materials) are acquired, allocated, and managed, not how risk information is communicated to stakeholders.

Full explanation →

161

MCQmedium

You are reviewing a 'Risk Burndown' chart and see that it is flat. What does this mean?

A.The project is completed

B.No risk mitigation or closure has occurred

C.The risk management process is highly effective

D.Risks are being identified faster than they are being closed

AnswerB

A flat risk burndown means the cumulative risk exposure is unchanged over time. Mitigation and closure actions reduce that exposure and would slope the line downward, so a flat line indicates no such risk reduction work has occurred.

Why this answer

A Risk Burndown chart plots cumulative risk exposure (typically probability × impact) against time across the project lifecycle. A flat line means the total risk exposure is not decreasing, which indicates that no risk responses have been executed, no risks have been closed, and no new mitigation value has been realized. In other words, the project team is not actively reducing the risk profile over time.

Exam trap

PMI-RMP often tests the interpretation of graphical risk tools, and candidates confuse a flat burndown with 'no new risks' or 'stable risk,' when it actually means no net reduction in risk exposure has occurred.

How to eliminate wrong answers

Option A is wrong because project completion would be represented by the burndown line reaching zero (or the baseline), not remaining flat. Option C is wrong because effective risk management would show a downward-sloping burndown as risks are mitigated and closed, not a flat line. Option D is wrong because risks being identified faster than closed would produce a rising or upward-trending line, not a flat one.

Full explanation →

162

Multi-Selectmedium

Which TWO output reports are commonly used in Primavera Risk Analysis to communicate risk results to the project sponsor?

Select 2 answers

A.Activity constraint report.

B.Project meeting minutes.

C.Tornado Diagram (Sensitivity Analysis).

D.S-Curve (Cumulative Distribution).

E.Resource utilization histogram.

AnswersC, D

The tornado diagram ranks individual risks by their impact on the overall project cost or schedule, displaying each as a horizontal bar. This directly satisfies the sponsor's need to see which uncertainties drive the outcome most, making it a standard Primavera Risk Analysis sensitivity report.

Why this answer

The Tornado Diagram (Sensitivity Analysis) (C) is correct because it ranks individual risks and tasks by their impact on a chosen output such as cost or finish date, making it the standard way to show the sponsor which few drivers dominate the uncertainty. The S-Curve (Cumulative Distribution) (D) is correct because it plots the cumulative probability of achieving cost or schedule targets, letting the sponsor read off confidence levels (e.g., P50, P80) for contingency decisions. Both are native Primavera Risk Analysis outputs designed specifically to communicate quantified risk exposure to executive stakeholders.

The Activity constraint report (A) is a scheduling/quality-control listing of imposed constraints, not a risk communication deliverable. Project meeting minutes (B) are a general project record, not a risk-analysis output report. The Resource utilization histogram (E) shows resource loading over time and does not convey probabilistic risk results to a sponsor.

Exam trap

PMI-RMP often tests the identification of Primavera Risk Analysis outputs, and candidates may confuse general project reports (like meeting minutes) with specialized risk analysis reports, or select resource histograms which are not risk-focused.

Full explanation →

163

Multi-Selecthard

Which THREE elements are necessary for a high-quality quantitative risk analysis?

Select 3 answers

A.Participation of all company employees

B.High-quality, verified data inputs

C.Expert judgment for model assumptions

D.Unlimited project budget

E.Valid probability distributions

AnswersB, C, E

High-quality, verified data inputs ensure the quantitative model reflects reality rather than assumption, satisfying the requirement that estimates be reliable. Poor or unverified data corrupts simulation outputs regardless of technique, so data quality is a precondition for credible numerical risk analysis.

Why this answer

High-quality quantitative risk analysis depends on B (high-quality, verified data inputs), because the accuracy of any probabilistic model is bounded by the reliability of the underlying data—garbage in, garbage out—so verified inputs such as historical loss data, threat frequencies, and asset values are essential. C (expert judgment for model assumptions) is also required, since assumptions about distributions, correlations, and parameter estimates often cannot be derived from data alone and must be validated by subject-matter experts. E (valid probability distributions) is necessary because quantitative analysis expresses risk as probability and impact, and the chosen distributions (e.g., normal, lognormal, Poisson, beta) must correctly represent the behavior of the variables being modeled.

A is not required—risk analysis is performed by a qualified team, not every employee—and D is irrelevant, since budget size does not determine analytical quality.

Exam trap

The exam often includes extreme options like 'all employees' or 'unlimited budget' as distractors; candidates may select them thinking more is better, but the focus is on quality inputs and expert judgment.

Full explanation →

164

Multi-Selecteasy

Which TWO of the following are essential components of a well-maintained risk register?

Select 2 answers

A.Detailed historical log of all meeting minutes

B.Risk owner

C.Project team member CVs

D.Risk description

E.Vendor contact information

AnswersB, D

Assigning a named risk owner ensures each entry has clear accountability for monitoring, response execution and status updates, satisfying the register's need for ongoing ownership rather than orphaned risks. Without this, mitigation actions stall and reporting becomes unreliable, so the risk register cannot remain a living, actively maintained document.

Why this answer

A well-maintained risk register must include a risk owner (B), because every identified risk needs an assigned individual accountable for monitoring, mitigating, and reporting on it throughout the risk management lifecycle. It must also include a risk description (D), since documenting the nature of the risk — its cause, potential impact, and likelihood — is the core purpose of the register and enables proper analysis and response planning. Options A, C, and E are not essential components: meeting minutes, team member CVs, and vendor contact information are unrelated administrative artifacts that do not describe or manage risks, even if they may be stored elsewhere in project documentation.

Exam trap

PMI-RMP often tests the distinction between risk register contents and general project documentation — candidates select plausible-sounding artifacts (meeting minutes, CVs, vendor contacts) that belong to other knowledge areas.

Full explanation →

165

Multi-Selectmedium

Which THREE categories are typically found in a standard Risk Breakdown Structure (RBS)?

Select 3 answers

A.External risk category.

B.The color preference category.

C.Technical risk category.

D.Management risk category.

E.The lunch break category.

AnswersA, C, D

External risk covers uncertainties outside the project team's control, such as regulatory, market, supplier and environmental factors. It forms a standard RBS category because these sources require distinct response strategies and ownership separate from internal technical or management risks.

Why this answer

In a standard Risk Breakdown Structure (RBS), risks are organized into hierarchical categories, and the External risk category (A) is correct because it captures risks originating outside the project team's control, such as regulatory, market, weather, or supplier-related risks. The Technical risk category (C) is correct because it covers risks tied to requirements, technology, design, interfaces, and performance, which are core technical sources of project uncertainty. The Management risk category (D) is correct because it addresses risks from project management processes such as estimating, planning, resourcing, communication, and control.

The color preference category (B) and the lunch break category (E) are not recognized RBS risk categories; they are irrelevant to standard risk classification and do not represent sources of project risk.

Exam trap

The trap is including non-risk operational or trivial items as RBS categories, so candidates must distinguish genuine risk source categories from irrelevant distractors.

Full explanation →

166

Multi-Selecthard

Which TWO factors should be documented in a 'Risk Management Plan' to ensure successful stakeholder buy-in?

Select 2 answers

A.The names of every person on the project.

B.Accessible and clear reporting mechanisms.

C.A promise that no risks will occur.

D.The amount of money the project manager is paid.

E.The value and benefits of risk management to the project.

AnswersB, E

Clear, accessible reporting mechanisms let stakeholders see risk status, ownership, and escalation paths without chasing updates, which sustains their engagement throughout the project. This satisfies the stem's buy-in requirement by making the risk process transparent and accountable rather than opaque.

Why this answer

Option B is correct because a Risk Management Plan must define accessible and clear reporting mechanisms — the communication paths, formats, frequency, and escalation routes (e.g., risk register reviews, status reports) — so stakeholders know how risks will be surfaced and tracked, which builds the transparency and trust needed for buy-in. Option E is correct because documenting the value and benefits of risk management to the project articulates the business case — how proactive risk handling protects schedule, cost, scope, and quality — giving stakeholders a concrete rationale to support and fund the risk process. The remaining options do not belong: A (listing every person's name) is a resource/stakeholder register detail, not a risk management factor; C (promising no risks will occur) is unrealistic and contradicts the purpose of risk management; and D (the project manager's pay) is irrelevant confidential compensation data with no bearing on stakeholder buy-in.

Exam trap

The trap is selecting options that seem like good project management practices (A, D) but are not relevant to stakeholder buy-in or are not part of the Risk Management Plan, while missing the communication and value proposition elements that directly address buy-in.

Full explanation →

167

MCQmedium

When configuring a simulation in Oracle Primavera Risk Analysis, what is the impact of checking the 'Correlate Task Durations' option?

A.It reduces the number of iterations required for convergence.

B.It forces all tasks to have the same duration.

C.It automatically removes all risk events from the schedule.

D.It enables the model to reflect that specific tasks may fluctuate together.

AnswerD

Correlate Task Durations introduces a correlation coefficient so sampled durations move together across related activities, rather than being drawn independently. This reflects shared drivers such as weather or crew availability, producing a more realistic distribution of total project duration.

Why this answer

Checking 'Correlate Task Durations' in Oracle Primavera Risk Analysis enables the simulation to model dependencies between task durations, reflecting that certain tasks may fluctuate together due to shared drivers (e.g., weather, resource availability). This produces more realistic risk outputs because it captures correlated uncertainty rather than treating each task's duration as independent.

Exam trap

The trap here is confusing correlation with causation or with other simulation settings; candidates may think correlation reduces iterations or forces equal durations, but it actually models co-movement of task durations.

How to eliminate wrong answers

Option A is wrong because correlation does not reduce the number of iterations needed for convergence; it actually adds complexity to the simulation, potentially requiring more iterations. Option B is wrong because correlation does not force tasks to have identical durations; it only models the degree to which their durations move together. Option C is wrong because correlation has no effect on risk events; it only affects the duration uncertainty modeling, not the presence or absence of risk events.

Full explanation →

168

MCQhard

You have multiple risks that appear to be related. What tool would help you visualize the relationships between them?

A.Probability and Impact Matrix

B.Cause-and-Effect Diagram

C.Risk Breakdown Structure

D.Risk Register

AnswerB

A Cause-and-Effect Diagram (Ishikawa) maps multiple causes branching into an effect, revealing how apparently separate risks share underlying drivers. This visual structure exposes the relationships and common root causes between the related risks, supporting more effective response planning.

Why this answer

A Cause-and-Effect Diagram (also known as a Fishbone or Ishikawa diagram) is used to visualize the relationships between a problem or effect and its potential causes. When multiple risks appear related, this tool helps identify root causes and show how they interconnect, making it ideal for understanding relationships between risks.

Exam trap

PMI-RMP often tests the confusion between tools that categorize or prioritize risks (like Risk Breakdown Structure or Probability and Impact Matrix) and those that show causal relationships (Cause-and-Effect Diagram).

How to eliminate wrong answers

Option A is wrong because a Probability and Impact Matrix is used to prioritize risks based on their likelihood and impact, not to visualize relationships. Option C is wrong because a Risk Breakdown Structure organizes risks into categories, but does not show relationships between them. Option D is wrong because a Risk Register is a document that lists risks and their attributes, but it does not provide a visual representation of relationships.

Full explanation →

169

Multi-Selectmedium

Which THREE steps are part of the 'Qualitative Risk Analysis' process?

Select 3 answers

A.Categorize risks for analysis

B.Execute the risk response

C.Assess probability and impact

D.Perform a Monte Carlo simulation

E.Prioritize risks using a matrix

AnswersA, C, E

Categorising risks by source or affected objective is an explicit step within Qualitative Risk Analysis, grouping risks so probability and impact can be assessed consistently. This satisfies the stem's requirement by structuring risks for subsequent prioritisation, before quantitative analysis or response planning begins.

Why this answer

Option A (Categorize risks for analysis) is correct because qualitative risk analysis begins by grouping risks by categories (e.g., technical, schedule, cost) to ensure consistent evaluation and to identify common root causes. Option C (Assess probability and impact) is correct because the core of qualitative risk analysis is rating each risk's likelihood and consequence using ordinal scales (such as very low to very high) rather than numerical simulation. Option E (Prioritize risks using a matrix) is correct because the probability-impact matrix (risk matrix) is the standard qualitative tool that ranks risks into priority levels to focus attention on the most significant ones.

Option B (Execute the risk response) is not part of this process; executing responses occurs in the Implement Risk Responses process after planning. Option D (Perform a Monte Carlo simulation) is not part of qualitative risk analysis; Monte Carlo simulation is a quantitative risk analysis technique that uses probability distributions and numerical modeling.

Exam trap

PMI-RMP often tests the boundary between qualitative and quantitative analysis, planting Monte Carlo simulation as a distractor because candidates who do not firmly associate simulation with quantitative techniques may incorrectly include it in the qualitative process.

Full explanation →

170

MCQeasy

What is the primary function of a 'Risk Dashboard' compared to a 'Risk Register'?

A.Dashboards provide full historical logs of all changes

B.Dashboards replace the need for the Risk Register

C.Dashboards offer visual summaries and trends for executive review

D.Dashboards store raw data for quantitative analysis

AnswerC

A risk dashboard aggregates register data into visual summaries, heat maps and trend lines, giving executives a fast portfolio-level view. The register itself remains the detailed, item-level record; the dashboard's distinct function is condensed visual reporting for leadership review and decision-making.

Why this answer

A Risk Dashboard provides visual summaries and trends, such as heat maps, burn-down charts, and key risk indicators, tailored for executive review and decision-making. In contrast, the Risk Register is a detailed repository of individual risks. The dashboard aggregates and visualizes data to highlight patterns and overall risk exposure, enabling quick comprehension.

Exam trap

The trap is confusing the purpose of a dashboard with that of a register; candidates might think dashboards store data or replace the register, but the exam emphasizes that dashboards are for visualization and summarization, not data storage.

How to eliminate wrong answers

Option A is wrong because full historical logs are typically maintained in the Risk Register or a separate audit trail, not in a dashboard. Option B is wrong because dashboards complement, not replace, the Risk Register; the register remains the source of detailed risk data. Option D is wrong because raw data storage and quantitative analysis are functions of the Risk Register or specialized risk analysis tools, not the dashboard's primary purpose.

Full explanation →

171

MCQeasy

What is the primary benefit of maintaining a transparent risk register accessible to all project stakeholders?

A.It ensures that everyone is blamed if a risk occurs.

B.It fosters a proactive risk culture and improves risk awareness across the team.

C.It reduces the need for formal risk meetings.

D.It automatically resolves all high-impact risks.

AnswerB

Shared visibility of risks lets every stakeholder see threats, owners and responses, encouraging early reporting rather than concealment. That transparency builds a proactive culture and raises awareness across the team, satisfying the stated benefit of an accessible register.

Why this answer

A transparent risk register that all stakeholders can access creates shared visibility of threats and opportunities, which is the foundation of a proactive risk culture. When team members see risks documented, owned, and tracked, they are more likely to identify and report new risks early rather than react after they materialize. This aligns with PMI-RMP principles of stakeholder engagement and continuous risk awareness throughout the project lifecycle.

Exam trap

PMI-RMP often tests the misconception that documentation tools like the risk register directly eliminate or resolve risks, when in fact they only enable awareness, ownership, and response planning.

How to eliminate wrong answers

Option A is wrong because a risk register is a management and communication tool, not a blame-assignment mechanism; risk ownership means accountability for response, not punishment. Option C is wrong because transparency supplements rather than replaces formal risk review meetings, which remain required for qualitative and quantitative analysis, response planning, and stakeholder engagement. Option D is wrong because no document automatically resolves risks; risks are addressed through planned response strategies (avoid, transfer, mitigate, accept, escalate) executed by assigned owners.

Full explanation →

172

Multi-Selecthard

You are facilitating a risk identification session for a software development project. The team is using a Delphi technique to reach consensus on the top risks. Which two actions are essential for you to perform as the facilitator to ensure the Delphi process is effective? (Choose two.)

Select 2 answers

A.Provide a summary of the previous round's responses to all participants before the next round.

B.Ensure that participants remain anonymous to each other throughout the rounds.

C.Allow the project sponsor to vote first to set the direction for others.

D.Require participants to reach a unanimous agreement before ending the session.

E.Conduct the session in a single face-to-face meeting to speed up the process.

AnswersA, B

The Delphi technique relies on iterative rounds where participants see a summary of the group's previous responses. This allows them to reconsider their own positions in light of the collective view. As facilitator, you must compile and distribute this summary without attributing comments to individuals, enabling informed convergence toward consensus.

Why this answer

The Delphi technique requires anonymity and iterative feedback. Participants must remain anonymous to avoid bias, and they must receive summarized results from previous rounds to refine their opinions. These two actions enable the facilitator to guide the group toward reliable consensus without the drawbacks of direct confrontation or dominant personalities.

Exam trap

The trap here is confusing Delphi with brainstorming or nominal group technique, which may involve face-to-face interaction or open voting, rather than preserving anonymity and iterative feedback.

Full explanation →

173

MCQhard

A project manager is facing pushback from a functional manager who refuses to allocate resources to risk response activities. What is the most appropriate risk strategy planning response?

A.Remove the identified risks from the risk register.

B.Escalate the issue to the project board for a decision on resource prioritization.

C.Accept all risks without mitigation.

D.Lower the probability rating of the risks associated with those resources.

AnswerB

Escalation suits this scenario because the functional manager sits outside the project manager's authority, so resource prioritisation must be decided at portfolio or governance level. The project board holds the mandate to arbitrate competing demands across functions, satisfying the constraint that the risk response requires resources the project manager cannot command directly.

Why this answer

When a functional manager refuses to allocate resources for risk responses, the issue exceeds the project manager's authority because it involves cross-functional resource prioritization. Escalating to the project board (or sponsor/steering committee) is the appropriate risk strategy response, as escalation is a recognized PMI risk response strategy for risks outside the project manager's control. The board can make an organizational-level decision on resource trade-offs.

Exam trap

PMI-RMP often tests the misconception that project managers should resolve resource conflicts unilaterally or alter risk data to avoid escalation, when the correct action is to escalate risks beyond their authority.

How to eliminate wrong answers

Option A is wrong because removing risks from the register does not eliminate them; it merely hides them, which is a documentation failure and violates the integrity of the risk management process. Option C is wrong because accepting all risks without mitigation is a passive strategy that is only appropriate for low-priority risks and ignores the project manager's duty to plan responses for significant threats. Option D is wrong because lowering probability ratings to avoid conflict is data manipulation that falsifies the risk analysis and leads to under-reserved budgets and schedules.

Full explanation →

174

MCQhard

In a decision tree analysis, what occurs if you 'fold back' the decision tree?

A.You reset the probabilities of all chance nodes to zero.

B.You assign risk scores to each decision alternative.

C.You calculate the probability of each branch ending in failure.

D.You determine the optimal path by selecting the branch with the best EMV at each decision node.

AnswerD

Folding back calculates expected monetary value at each chance node, then selects the highest EMV branch at every decision node, working right to left. This satisfies the stem's requirement to identify the optimal path through sequential decisions under uncertainty, resolving each decision point by its best EMV.

Why this answer

Folding back a decision tree involves calculating the EMV at each chance node and then selecting the decision branch with the best EMV at each decision node. This process works backward from the end nodes to the start, determining the optimal path.

Exam trap

Candidates often confuse folding back with other decision tree steps like probability calculation or risk scoring; the exam tests the specific definition of folding back as determining the optimal path via EMV.

How to eliminate wrong answers

Option A is wrong because folding back does not reset probabilities; it uses them to compute EMV. Option B is wrong because assigning risk scores is a qualitative step, not the folding back process. Option C is wrong because calculating failure probability is only part of the analysis; folding back determines the optimal path based on EMV.

Full explanation →

175

MCQhard

When calculating the Expected Monetary Value (EMV) for a risk, why do we multiply probability by impact?

A.To create a buffer for the management reserve.

B.To determine the risk-weighted value of the impact.

C.To identify which risks are impossible to mitigate.

D.To calculate the total cost of all risks combined.

AnswerB

Multiplying probability by impact converts a potential loss or gain into its risk-weighted value, expressing the average outcome across all possible occurrences. This satisfies the stem's requirement to quantify expected exposure, enabling comparison of dissimilar risks on a common monetary scale for prioritisation and contingency reserving.

Why this answer

Expected Monetary Value (EMV) is a quantitative risk analysis technique that computes the risk-weighted value of an uncertain event by multiplying its probability of occurrence by its monetary impact. This product represents the average outcome if the risk were repeated many times, allowing risks with very different probability/impact profiles to be compared on a common monetary scale and aggregated into a contingency reserve. It is the foundational calculation behind decision tree analysis and Monte Carlo inputs.

Exam trap

The trap is confusing EMV with reserve calculation or total cost summation — candidates forget that EMV is a per-risk weighted value, and that contingency reserve is the *sum* of EMVs, not the EMV itself.

How to eliminate wrong answers

Option A is wrong because the management reserve is derived from the overall project uncertainty and organizational policy — EMV feeds the contingency reserve, not the management reserve, and the multiplication itself does not 'create a buffer.' Option C is wrong because EMV quantifies risk exposure; it says nothing about whether a risk can be mitigated or is impossible to mitigate — that is a qualitative assessment. Option D is wrong because EMV calculates the weighted value of a *single* risk (or the sum of individual EMVs for a portfolio of risks); it is not a method for summing total costs, which would ignore probability weighting entirely.

Full explanation →

176

MCQeasy

Which communication method is most appropriate for informing stakeholders about a significant change in the project's risk profile?

A.Sending a brief text message to the team.

B.Updating the project's formal communication plan and issuing a status report to relevant stakeholders.

C.Discussing it during a casual coffee break.

D.Posting the update on the company intranet without notifying anyone.

AnswerB

A significant risk-profile change demands formal, documented communication to the stakeholders it affects. Amending the communication plan and issuing a status report satisfies the need for a controlled, traceable channel, ensuring the right stakeholders receive consistent information rather than ad-hoc verbal updates.

Why this answer

A significant change in the risk profile is a formal project event that must be communicated through the established communication plan to all relevant stakeholders, ensuring traceability and appropriate distribution. Issuing a status report aligns with PMI's emphasis on using the Communications Management Plan to determine who needs what information, when, and in what format. This approach keeps stakeholders informed, maintains governance, and documents the change for audit and decision-making.

Exam trap

The trap here is choosing the fastest or most casual communication method; PMI-RMP expects the formal, plan-driven answer whenever a significant project change occurs.

How to eliminate wrong answers

Option A is wrong because a brief text message is informal, lacks documentation, and reaches only the team rather than the full set of relevant stakeholders. Option C is wrong because a casual coffee break is not a controlled communication channel and provides no record or assurance that all stakeholders are informed. Option D is wrong because posting on the intranet without notification relies on stakeholders discovering the information themselves, violating the communication plan's proactive distribution requirements.

Full explanation →

177

Multi-Selecthard

Which THREE factors influence the choice of a 'risk management methodology' for a project?

Select 3 answers

A.Project complexity and uncertainty level.

B.Organizational risk management maturity.

C.The project office's desk arrangement.

D.Project governance and regulatory requirements.

E.The project manager's favorite color.

AnswersA, B, D

Greater project complexity and uncertainty demand more elaborate, iterative risk processes, such as quantitative analysis and frequent reassessment, rather than a simple checklist. This directly shapes methodology selection because the chosen approach must match the scale of ambiguity the project faces.

Why this answer

Option A is correct because project complexity and uncertainty level directly determine how much structure the risk methodology needs — highly complex, uncertain projects require more formal, iterative approaches such as quantitative analysis and continuous risk reassessment, while simple projects can use lighter methods. Option B is correct because organizational risk management maturity dictates which methodologies are feasible and sustainable; an organization with immature processes cannot effectively adopt advanced techniques like Monte Carlo simulation or detailed risk registers without foundational capability. Option D is correct because project governance and regulatory requirements impose mandatory risk processes, documentation, and compliance standards (e.g., ISO 31000, PMBOK, or industry-specific regulations) that constrain and shape the selected methodology.

Option C is incorrect because a project office's desk arrangement is a physical workspace detail with no bearing on risk management methodology selection. Option E is incorrect because a project manager's favorite color is a personal preference irrelevant to professional risk management decisions.

Exam trap

PMI-RMP often tests the factors influencing methodology selection, and candidates may be distracted by irrelevant options (like desk arrangement or favorite color) that are obviously nonsensical, but they might also overlook governance as a key factor.

Full explanation →

178

MCQmedium

You are selecting a risk management methodology for a high-security government project. Which factor is most important to consider?

A.The cost of the software tools used.

B.The speed of risk identification.

C.The flexibility to change the process daily.

D.The level of formal governance, documentation, and compliance required.

AnswerD

High-security government projects demand rigorous formal governance, documentation and compliance, so the methodology must support these constraints. Selecting one that matches this level of formality ensures auditability and regulatory adherence, which outweighs flexibility or speed considerations.

Why this answer

For a high-security government project, the dominant consideration when selecting a risk methodology is the level of formal governance, documentation, and compliance required. Government projects typically must satisfy regulatory frameworks (e.g., FISMA, FedRAMP, DoD standards), so the methodology must support audit trails, formal approvals, and rigorous documentation.

Exam trap

PMI-RMP often tests whether candidates prioritize governance and compliance over cost or speed in regulated environments — the trap is selecting the 'efficient' or 'cheap' answer when the scenario signals high-security or regulatory oversight.

How to eliminate wrong answers

Option A is wrong because software tool cost is a minor procurement consideration and does not drive methodology selection for a high-security context. Option B is wrong because speed of risk identification, while useful, is subordinate to compliance and governance requirements in a regulated environment. Option C is wrong because flexibility to change the process daily is the opposite of what a high-security project needs — it requires stability, repeatability, and auditability, not daily process churn.

Full explanation →

179

MCQhard

You are presenting a report on high-impact risks. The project sponsor asks how these risks affect the overall business strategy. What is the most effective way to explain this?

A.Apologize and state you haven't considered the business impact.

B.State that the risks are only project-level and do not concern the business.

C.Provide a detailed technical breakdown of each risk.

D.Explain how the risk impacts key performance indicators (KPIs) and business objectives.

AnswerD

Linking risks to KPIs and business objectives translates project-level threats into strategic language the sponsor owns. This satisfies the stem's constraint of demonstrating business-strategy impact, showing measurable consequences rather than technical schedule or cost detail the sponsor cannot act on.

Why this answer

The most effective way to explain how high-impact risks affect business strategy is to link each risk to specific KPIs and business objectives, such as revenue, customer retention, regulatory compliance, or market share. This translates project-level risks into strategic terms that the sponsor and executives understand, enabling informed decision-making about risk response and resource allocation. It demonstrates that risk management is not just a project activity but a driver of business value.

Exam trap

PMI-RMP often tests whether candidates can elevate risk discussions from technical details to strategic business impact—choosing a technical breakdown or dismissing business relevance are common wrong answers.

How to eliminate wrong answers

Option A is wrong because admitting you haven't considered business impact undermines your credibility and fails to provide the sponsor with needed information. Option B is wrong because stating that risks are only project-level and do not concern the business is inaccurate—high-impact project risks can directly affect business strategy, and dismissing this connection is a failure of risk communication. Option C is wrong because a detailed technical breakdown of each risk may overwhelm the sponsor and does not answer the strategic question; it focuses on technical details rather than business implications.

Full explanation →

180

MCQmedium

When facilitating a risk workshop, how do you handle a suggestion that is clearly out of scope for the current project?

A.Include it in the risk register anyway

B.Ask the stakeholder to leave

C.Acknowledge the input and record it in the 'Parking Lot' for future consideration

D.Immediately dismiss it

AnswerC

Recording the suggestion in a Parking Lot acknowledges the contributor without derailing the workshop's scope, satisfying the constraint of maintaining focus on in-scope risks. It preserves the idea for later review rather than discarding it, which sustains psychological safety and participation. Escalating or debating out-of-scope items wastes limited workshop time.

Why this answer

When a risk workshop participant offers a suggestion that is clearly out of scope, the facilitator should acknowledge the input and record it in the 'Parking Lot' for future consideration (Option C). This respects the contributor, keeps the workshop focused on the current project's risks, and preserves the idea in case it becomes relevant later or belongs to another initiative. The Parking Lot technique is a standard facilitation tool for managing off-topic but potentially valuable input.

Exam trap

PMI-RMP often tests the facilitator's response to off-topic input, tempting candidates to either include it in the risk register (polluting scope) or dismiss it (damaging engagement) instead of using the Parking Lot to acknowledge and defer.

How to eliminate wrong answers

Option A is wrong because including an out-of-scope item in the risk register pollutes the register with irrelevant risks, diluting focus and potentially triggering unnecessary responses. Option B is wrong because asking the stakeholder to leave is disrespectful and counterproductive — it discourages participation and may damage team dynamics. Option D is wrong because immediately dismissing the suggestion without acknowledgment discourages future contributions and may cause the stakeholder to disengage from the risk process.

Full explanation →

181

MCQmedium

You are reviewing a S-curve generated from a cost simulation. What does the P80 value represent on this curve?

A.The cost level with an 80% confidence of being met or bettered.

B.The average cost of the project.

C.The cost value representing the 20th percentile of risks.

D.The baseline cost before risk adjustments.

AnswerA

The P80 on a cumulative cost S-curve marks the value at which 80% of simulated outcomes fall at or below it. It expresses an 80% confidence level that actual cost will not exceed this figure, giving a risk-adjusted budget target.

Why this answer

The P80 value on a cost S-curve derived from Monte Carlo simulation represents the cost threshold at which there is an 80% probability that the actual project cost will be at or below that value. It is a confidence-level metric, not an average or baseline. Risk managers use P-values (P50, P80, P90) to set contingency reserves aligned with organizational risk appetite.

Exam trap

PMI-RMP often tests confusion between percentile confidence levels (P80 = 80% confidence) and the complementary 20% probability of exceedance, causing candidates to select the '20th percentile' distractor.

How to eliminate wrong answers

Option B is wrong because the average cost corresponds to the mean of the distribution, which is not the same as the P80 value and is typically closer to the P50 in a symmetric distribution. Option C is wrong because the 20th percentile (P20) is a low-confidence threshold, not the P80; the P80 is the 80th percentile, not the 20th. Option D is wrong because the baseline cost is the deterministic planned budget before any risk-adjusted simulation output, whereas the P80 is a probabilistic output of the simulation.

Full explanation →

182

Multi-Selectmedium

Which TWO of the following are common types of probability distributions used in risk simulation?

Select 2 answers

A.Triangular distribution.

B.Square distribution.

C.Linear distribution.

D.Beta distribution.

E.Circular distribution.

AnswersA, D

Triangular distribution suits risk simulation because it needs only minimum, most likely and maximum estimates, which match the limited expert judgement available in most project risk workshops. It satisfies the stem's requirement for a common simulation distribution without demanding historical data.

Why this answer

The Triangular distribution (A) is correct because it is a standard probability distribution in risk simulation (e.g., Monte Carlo analysis), defined by minimum, most likely, and maximum values, making it ideal for modeling expert estimates when limited data is available. The Beta distribution (D) is also correct because it is widely used in risk simulation to model uncertainty bounded between 0 and 1, such as probabilities or percentages, and can take many shapes (including uniform, U-shaped, or J-shaped) based on its two shape parameters. The other options are not recognized probability distributions: 'Square distribution' (B) is not a standard statistical distribution, 'Linear distribution' (C) is not a formal probability distribution (though a linear density could be constructed, it is not a common named type), and 'Circular distribution' (E) is not a standard probability distribution used in risk simulation.

Exam trap

PMI-RMP often tests recognition of valid distribution names, so candidates must distinguish real distributions (triangular, Beta, normal, lognormal, uniform, PERT) from invented-sounding distractors like 'square,' 'linear,' and 'circular.'

Full explanation →

183

MCQhard

During a project, a stakeholder refuses to accept a risk mitigation strategy that requires their department to allocate resources. What should the risk practitioner do first?

A.Conduct a stakeholder analysis to identify the stakeholder's interests and underlying concerns.

B.Consult the Risk Management Plan for escalation procedures.

C.Inform the project sponsor that the risk is now an issue due to lack of support.

D.Force the implementation of the strategy as it was approved in the project plan.

AnswerA

Before influencing the stakeholder, the practitioner must understand why they resist. Stakeholder analysis uncovers the department's interests, priorities and underlying concerns, enabling a tailored engagement approach rather than escalating or forcing the mitigation strategy prematurely.

Why this answer

When a stakeholder resists a risk response, the first step is to understand why — their interests, constraints, and underlying concerns — before deciding on escalation or enforcement. Option A applies stakeholder analysis, a foundational PMI technique, to uncover the root cause of resistance and identify ways to address it collaboratively. This aligns with the PMI mindset of engaging stakeholders rather than overriding them.

Exam trap

PMI-RMP often tests the 'first step' qualifier, and candidates incorrectly jump to escalation (B, C) or authority (D) instead of the analytical, stakeholder-centric first action (A).

How to eliminate wrong answers

Option B is wrong because consulting escalation procedures is premature; escalation should occur only after attempts to understand and resolve the stakeholder's concerns have failed. Option C is wrong because declaring the risk an issue and escalating to the sponsor skips the analysis step and damages the stakeholder relationship. Option D is wrong because forcing implementation ignores the stakeholder's legitimate concerns, violates collaborative engagement principles, and often backfires through passive resistance.

Full explanation →

184

MCQmedium

You are identifying a trend where multiple risks in a specific category (e.g., 'Supply Chain') are occurring. What report should you generate?

A.Budget Variance Report

B.Individual Risk Audit Report

C.Project Schedule Baseline

D.Risk Category Trend Report

AnswerD

Grouping risks by category and plotting occurrence frequency over time exposes the concentration the stem describes, letting you see which category is trending upward. A Risk Category Trend Report aggregates this data specifically, unlike a register or heat map that shows only current exposure.

Why this answer

A Risk Category Trend Report aggregates risk data by category (e.g., Supply Chain, Technical, External) to reveal patterns, such as a rising frequency of risks in one area. This report helps the PM identify systemic issues and prioritize response efforts. It is the appropriate artifact when multiple risks in a specific category are occurring.

Exam trap

PMI-RMP often tests the difference between a Risk Report (comprehensive snapshot) and a Risk Category Trend Report (pattern analysis by category), so candidates must match the tool to the specific analytical need.

How to eliminate wrong answers

Option A is wrong because a Budget Variance Report tracks cost performance against the baseline, not risk category patterns. Option B is wrong because an Individual Risk Audit Report examines a single risk's response effectiveness, not trends across a category. Option C is wrong because the Project Schedule Baseline is a time-related reference, not a risk analysis tool.

Full explanation →

185

MCQmedium

When interpreting the results of a cost simulation, what does the 'Distribution' (histogram) tell you that a 'Mean' value does not?

A.The total project budget.

B.The frequency and probability of different cost outcomes.

C.The accuracy of the initial estimation team.

D.The specific task that causes the budget overrun.

AnswerB

The histogram plots the frequency of simulated cost outcomes across the range, revealing the probability of each value and the shape of the distribution. The mean collapses this into a single figure, hiding spread, skew and the likelihood of extreme costs.

Why this answer

A cost simulation produces a probability distribution of total project cost, and the histogram visualizes that distribution — showing how frequently each cost outcome occurs across thousands of iterations. The mean is only a single summary statistic and hides the shape, spread, and skew of the distribution. The histogram therefore reveals the probability of different cost outcomes, which is essential for setting contingency reserves and confidence levels.

Exam trap

PMI-RMP often tests the difference between a point estimate (mean) and a distribution, so the trap is choosing an answer that describes a single value or an input rather than the probability information the histogram provides.

How to eliminate wrong answers

Option A is wrong because the total project budget is an input or a target, not something the histogram reveals — the histogram shows possible outcomes, not the approved budget. Option C is wrong because the accuracy of the estimation team is not measurable from a Monte Carlo output; the simulation reflects the inputs given, not the estimators' competence. Option D is wrong because a cost histogram aggregates total project cost outcomes and does not identify which specific task drives an overrun — that requires sensitivity analysis or tornado diagrams.

Full explanation →

186

Multi-Selecthard

Which THREE items should be included in a 'Risk Audit' report to project governance?

Select 3 answers

A.The cost of the audit consultant

B.Summary of audit findings

C.The internal team's lunch schedule

D.Status of the risk management process compliance

E.Recommendations for process improvement

AnswersB, D, E

A risk audit report must communicate what the audit discovered, so a summary of findings gives governance the observed strengths, gaps and non-compliance in risk practise. This satisfies the stem directly, since findings are the substantive output that justifies the audit and informs subsequent decisions.

Why this answer

A Risk Audit report to project governance must communicate what was found, so option B (Summary of audit findings) is correct because governance needs a concise account of the audit's observations, evidence, and conclusions to make informed oversight decisions. Option D (Status of the risk management process compliance) is correct because the audit's core purpose is to verify that the risk management process adheres to the defined policy, standards, and procedures, and governance must know the degree of compliance. Option E (Recommendations for process improvement) is correct because an effective audit does not merely report deficiencies but proposes corrective or enhancing actions so governance can authorize remediation and improve the risk process.

Option A (The cost of the audit consultant) is not included because consultant fees are a procurement or budget matter, not a substantive risk audit finding for governance. Option C (The internal team's lunch schedule) is irrelevant administrative trivia with no bearing on risk management or governance oversight.

Exam trap

PMI-RMP often tests the distinction between process-level audit outputs and project-level administrative details, so candidates who grab any 'reasonable-sounding' report item (like audit cost) instead of the three governance-relevant process findings lose the question.

Full explanation →

187

MCQhard

A PMO is standardizing risk management across multiple projects. They want to ensure that risk appetite is consistent across the organization. What is the most effective approach?

A.Only allow senior management to identify risks.

B.Publish an Enterprise Risk Management (ERM) policy that defines standard risk tolerance levels.

C.Mandate the use of a single, complex quantitative software tool.

D.Require all project managers to define their own risk appetite.

AnswerB

An ERM policy codifies organisation-wide risk tolerance levels, giving every project a common benchmark for evaluating and prioritising risks. This directly satisfies the PMO's goal of consistent risk appetite across multiple projects rather than relying on per-project judgement.

Why this answer

An Enterprise Risk Management (ERM) policy defines the organization's risk appetite, tolerance levels, and standard risk processes, ensuring consistency across all projects and aligning with strategic objectives. Publishing such a policy is the most effective way to standardize risk appetite across multiple projects and the organization as a whole.

Exam trap

PMI-RMP often tests the difference between risk appetite and risk tolerance, and candidates may incorrectly think that individual project managers should define their own appetite, rather than following an enterprise-wide policy.

How to eliminate wrong answers

Option A is wrong because restricting risk identification to senior management excludes valuable input from project teams and stakeholders, and does not ensure consistent risk appetite. Option C is wrong because mandating a single complex quantitative tool does not address risk appetite consistency; tools are enablers, not policies, and may not suit all projects. Option D is wrong because allowing each project manager to define their own risk appetite leads to inconsistency and defeats the purpose of standardization.

Full explanation →

188

MCQeasy

In the context of the Risk Management Plan, what is a 'Risk Threshold'?

A.The start date of the risk assessment phase.

B.A value that triggers a specific risk response or escalation path.

C.The total budget allocated to the project.

D.The maximum number of risks allowed in the register.

AnswerB

A risk threshold is a predefined measurable value that, once breached, triggers a specific response or escalation path defined in the Risk Management Plan. It differs from risk appetite, which expresses overall willingness to accept risk, by being an actionable, quantified trigger for escalation.

Why this answer

A Risk Threshold is a predefined value or level of risk exposure (e.g., cost, schedule, or quality impact) that, when reached or exceeded, triggers a specific risk response or escalation to a higher authority. It is documented in the Risk Management Plan and helps determine when a risk is no longer acceptable and requires action. For example, a threshold might state that any risk with a potential cost overrun greater than $50,000 must be escalated to the project sponsor.

Thus, it acts as a decision trigger, not a date, budget total, or register limit.

Exam trap

PMI-RMP often tests the confusion between risk threshold and other project constraints like budget, schedule, or risk register limits, so candidates must remember that a threshold is a trigger value for risk response, not a general project parameter.

How to eliminate wrong answers

Option A is wrong because the start date of the risk assessment phase is a schedule milestone, not a threshold; thresholds are about risk exposure levels, not timing. Option C is wrong because the total budget allocated to the project is a financial baseline, not a risk threshold; thresholds define acceptable risk limits, not overall funding. Option D is wrong because the maximum number of risks allowed in the register is an arbitrary limit, not a threshold; risk thresholds are about impact or probability values that trigger responses, not a count of risks.

Full explanation →

189

MCQhard

Your organization is transitioning to a hybrid methodology. During risk management planning, you must select an approach that accommodates both Agile delivery and Waterfall governance. Which strategy is most effective?

A.Use a central Risk Register managed exclusively by the PMO.

B.Tailor the Risk Management Plan to include iterative risk review sessions during sprint planning.

C.Adopt a purely Waterfall risk register for all work packages.

D.Eliminate the Risk Management Plan to reduce bureaucratic overhead.

AnswerB

Tailoring the Risk Management Plan embeds iterative risk reviews within sprint planning, satisfying the hybrid constraint of Agile delivery alongside Waterfall governance. This preserves the formal, documented plan that governance requires while enabling frequent reassessment, so emerging risks surface each sprint rather than only at phase gates.

Why this answer

In a hybrid methodology, the Risk Management Plan must be tailored to integrate both Agile and Waterfall practices. Including iterative risk review sessions during sprint planning accommodates Agile's adaptive nature while maintaining governance through the overall plan. This approach ensures risks are continuously identified and addressed in short cycles.

Exam trap

The trap is choosing an extreme approach (A, C, or D) that favors one methodology over the other, whereas PMI-RMP expects a tailored, integrated approach that leverages the strengths of both Agile and Waterfall.

How to eliminate wrong answers

Option A is wrong because a central Risk Register managed exclusively by the PMO may create bottlenecks and reduce team ownership, which is contrary to Agile principles of self-organizing teams. Option C is wrong because adopting a purely Waterfall risk register for all work packages ignores the iterative nature of Agile delivery and may not capture emergent risks. Option D is wrong because eliminating the Risk Management Plan reduces governance and oversight, which is necessary for Waterfall governance and overall project success.

Full explanation →

190

MCQhard

During planning, you identify that your project relies on a 'Single Point of Failure' (SPOF) in the supply chain. What is the best strategy to integrate into your plan?

A.Add the SPOF to the risk register with a mitigation strategy to develop secondary suppliers.

B.Reduce the project scope immediately.

C.Accept the risk and hope it does not materialize.

D.Ignore the risk because it is external.

AnswerA

Documenting the single point of failure in the risk register with a mitigation to develop secondary suppliers directly addresses the supply chain vulnerability. This converts the identified SPOF into a tracked, owned risk with a planned response, satisfying the planning requirement rather than leaving it unmanaged.

Why this answer

A Single Point of Failure in the supply chain is a classic risk that must be captured in the risk register and addressed with a proactive response. Developing secondary suppliers is a mitigation strategy that reduces the probability and impact of supply disruption by removing the single-source dependency. This integrates risk management into planning rather than reacting after the failure occurs.

Exam trap

PMI-RMP often tests whether candidates recognize that external risks still belong in the risk register, so the trap is picking 'ignore because external' or 'accept and hope' instead of a documented mitigation.

How to eliminate wrong answers

Option B is wrong because reducing scope is a drastic, unvalidated response that does not address the root cause of the SPOF and may destroy project value without any risk analysis. Option C is wrong because 'accept and hope' is not a strategy — passive acceptance without analysis or contingency reserves is risk negligence, not risk management. Option D is wrong because external risks are still project risks; PMI explicitly requires external risks to be identified, analyzed, and responded to in the risk register.

Full explanation →

191

MCQmedium

Which tool in your PMIS allows you to track the 'Risk Response' implementation status across multiple work streams?

A.Individual Risk Response Plan

B.Project Charter

C.Risk Impact Analysis Matrix

D.Risk Register Status Report

AnswerD

The risk register status report consolidates each identified risk with its response owner, actions and implementation progress, giving a single cross-work-stream view of response status. Other PMIS artefacts track individual risks or schedules but do not aggregate response implementation across work streams.

Why this answer

The Risk Register Status Report (Option D) is the PMIS tool designed to track the implementation status of risk responses across multiple work streams. It aggregates data from the risk register — such as response owner, due date, completion percentage, and effectiveness — into a report that gives a portfolio or program-level view. This enables risk managers to monitor whether responses are being executed as planned and to identify work streams that are falling behind.

Exam trap

PMI-RMP often tests the confusion between documents that define or prioritize risks (charter, impact matrix, individual response plan) and the report that tracks implementation status across work streams.

How to eliminate wrong answers

Option A is wrong because an Individual Risk Response Plan documents the response for a single risk; it does not provide cross-work-stream tracking or status aggregation. Option B is wrong because the Project Charter is a high-level authorization document that defines the project's purpose and boundaries — it does not track risk response implementation. Option C is wrong because a Risk Impact Analysis Matrix (similar to a probability-impact matrix) is used to prioritize risks, not to track the status of response implementation across work streams.

Full explanation →

192

Multi-Selecthard

Which THREE outcomes are expected from an effective stakeholder engagement plan for risk management?

Select 3 answers

A.Increased accuracy in risk identification through diverse stakeholder input.

B.A significant reduction in project scope.

C.A total elimination of all project risks.

D.Improved ownership of risk responses by those best positioned to execute them.

E.Enhanced alignment between risk management activities and project goals.

AnswersA, D, E

Diverse stakeholder input widens the pool of perspectives and knowledge, surfacing threats and opportunities that a narrow group would miss. This directly satisfies the outcome of more accurate risk identification, since engagement supplies the raw information the risk process depends on.

Why this answer

Option A is correct because an effective stakeholder engagement plan brings together diverse perspectives (technical, business, operational), which broadens the input base and surfaces risks that a narrow group would miss, thereby increasing the accuracy and completeness of risk identification. Option D is correct because engaging the stakeholders who will actually execute risk responses builds commitment and accountability, ensuring responses are owned by the people best positioned to implement them effectively. Option E is correct because ongoing stakeholder communication and involvement keep risk management activities tied to the project's objectives, priorities, and success criteria, enhancing alignment between risk work and project goals.

Option B is not correct because stakeholder engagement in risk management does not inherently reduce project scope; scope changes are governed by change control, not by engagement itself. Option C is not correct because no risk management approach can totally eliminate all project risks; risks can be mitigated, transferred, avoided, or accepted, but residual and emergent risks always remain.

Exam trap

PMI-RMP often tests whether candidates recognize that risk management reduces but never eliminates risk, and that scope reduction is not an engagement outcome — tempting candidates to pick B or C as 'positive-sounding' distractors.

Full explanation →

193

MCQhard

You discover that a risk response plan is no longer effective due to changing market conditions. What is your next step?

A.Inform the project team that the risk no longer matters.

B.Re-evaluate the risk and develop a new, appropriate response plan.

C.Escalate the issue to the PMO immediately.

D.Continue with the current plan to maintain consistency.

AnswerB

Re-evaluating the risk first confirms whether probability, impact or triggers have shifted, then a new response plan addresses the changed market conditions. This satisfies the stem's constraint that the existing plan is no longer effective, since PMI-RMP treats risk response as iterative rather than fixed once documented.

Why this answer

When a risk response plan becomes ineffective due to changed conditions, the risk management process requires re-evaluation of the risk's probability, impact, and overall priority, followed by development of a new response strategy. This aligns with the PMI-RMP principle of continuous risk monitoring and adaptive response planning, where the 'Plan Risk Responses' process is iterative and must reflect current reality. Simply abandoning the risk or persisting with a failed plan violates the core risk management cycle of identify-analyze-plan-implement-monitor.

Exam trap

The trap here is the assumption that escalation (Option C) is always the safest or most 'PMI-correct' first step, when in fact PMI methodology emphasizes the risk manager's responsibility to re-evaluate and adapt responses at the project level before escalating.

How to eliminate wrong answers

Option A is wrong because a risk becoming unresponsive to its current plan does not mean the risk no longer exists — changing market conditions may have altered its probability or impact, but the risk must be re-analyzed before any decision to close it. Option C is wrong because escalation to the PMO is only appropriate when the risk exceeds the project manager's authority or when organizational-level action is required; the scenario describes a project-level response failure that the risk manager should first address through re-evaluation. Option D is wrong because continuing an ineffective plan wastes resources and leaves the project exposed, directly contradicting the PMBOK Guide's mandate to monitor risks and adjust responses as conditions change.

Full explanation →

194

Multi-Selecteasy

Which TWO of the following are considered 'Risk Triggers'?

Select 2 answers

A.A sudden drop in vendor quality

B.The project office moving locations

C.The end of the fiscal year

D.A specific project milestone missed

E.The project manager's birthday

AnswersA, D

A sudden drop in vendor quality is an observable condition indicating that a risk may be about to occur or has occurred, prompting a response. This satisfies the stem's definition of a trigger as a warning sign rather than the risk event itself.

Why this answer

A risk trigger is a specific, observable event or condition that indicates a risk is about to occur or has occurred, so it must be tied to a defined risk response. Option A, a sudden drop in vendor quality, is a classic trigger because it is a measurable deviation in supplier performance that signals a supply-chain or quality risk requiring action. Option D, a specific project milestone missed, is also a valid trigger because a missed milestone is a concrete schedule event that activates contingency or corrective plans.

Option B, the project office moving locations, is a logistical change rather than a defined risk indicator, and option C, the end of the fiscal year, is a recurring calendar event that is not inherently tied to a specific risk. Option E, the project manager's birthday, is irrelevant to project risk and is not a trigger.

Exam trap

PMI-RMP often tests the distinction between a risk trigger (a specific, causally linked warning sign) and a general event or calendar date, tempting candidates to select plausible-sounding but causally unlinked options.

Full explanation →

195

MCQmedium

A stakeholder expresses concern about the timing of risk review meetings. How should you address this?

A.Cancel the meetings altogether.

B.Send the meeting minutes after the meeting instead of holding it.

C.Keep the meeting time and notify the stakeholder they are required to attend.

D.Consult the stakeholders to identify a more convenient time for regular risk reviews.

AnswerD

Consulting stakeholders directly addresses the timing concern by collaboratively selecting a schedule that suits participants, increasing attendance and engagement. This satisfies the scenario's constraint that risk reviews must occur regularly with stakeholder participation, rather than imposing inconvenient times.

Why this answer

Stakeholder engagement is a core input to effective risk management, and scheduling risk review meetings at times that work for key participants increases attendance, participation, and ownership. Option D reflects the collaborative, consultative approach PMI advocates: engage stakeholders to find a mutually acceptable time rather than imposing or abandoning the review. This preserves the review cadence while removing a participation barrier.

Exam trap

PMI-RMP often tests whether candidates default to authority-based answers (C) or avoidance answers (A, B) instead of the collaborative stakeholder-engagement answer (D), which is almost always preferred in PMI's people-oriented mindset.

How to eliminate wrong answers

Option A is wrong because canceling risk review meetings eliminates a critical control in the Monitor Risks process and leaves the risk register stale and unmanaged. Option B is wrong because distributing minutes is not a substitute for live discussion; risk reviews require interactive analysis, re-assessment, and decision-making that minutes cannot replicate. Option C is wrong because unilaterally mandating attendance ignores the stakeholder's legitimate constraint and damages engagement, which is contrary to the collaborative spirit of stakeholder management.

Full explanation →

196

MCQhard

A project stakeholder discovers an unmanaged risk and is upset that it wasn't captured. How do you resolve this?

A.Blame the team for not identifying it sooner.

B.Thank the stakeholder for the identification, add it to the register, and adjust the response plan.

C.Argue that the risk was already known and it wasn't important.

D.Explain that the register is only for high-priority risks.

AnswerB

Thanking the stakeholder and logging the risk in the register directly satisfies the stem's constraint: an unmanaged risk must be captured. Adding it to the register converts the discovery into a tracked entry, and adjusting the response plan assigns ownership and treatment, closing the gap that caused the stakeholder's concern.

Why this answer

The best response is to thank the stakeholder for identifying the unmanaged risk, add it to the risk register, and adjust the response plan accordingly. This collaborative approach encourages future risk identification, maintains stakeholder engagement, and ensures the risk is properly managed. It turns a negative situation into a constructive one, reinforcing the value of proactive risk management.

Exam trap

PMI-RMP often tests whether candidates choose a collaborative, proactive response over defensive or dismissive ones—blaming, arguing, or limiting the register to high-priority risks are common wrong answers that violate PMI's principles of stakeholder engagement and continuous risk identification.

How to eliminate wrong answers

Option A is wrong because blaming the team is counterproductive, damages morale, and does not address the risk; it also discourages future reporting. Option C is wrong because arguing that the risk was already known and unimportant dismisses the stakeholder's concern and may be untrue; it erodes trust and could leave a real risk unmanaged. Option D is wrong because explaining that the register is only for high-priority risks is incorrect—all identified risks should be documented, and prioritization happens after entry; this response also fails to capture the risk.

Full explanation →

197

Multi-Selecteasy

Which TWO documents are essential to have on hand during a risk facilitation workshop?

Select 2 answers

A.The Risk Management Plan

B.The project office floor plan

C.The company's annual report

D.The existing risk register

E.The caterer's menu

AnswersA, D

The Risk Management Plan defines the risk methodology, roles, scoring scales and reporting formats the workshop must follow, so facilitators can align identification and assessment activities with the approved approach rather than improvising. It is the governing document the stem's facilitation workshop depends on.

Why this answer

The Risk Management Plan (A) is essential because it defines the workshop's methodology, risk categories, probability and impact scales, risk thresholds, and roles, so participants can assess and prioritize risks consistently with the project's approved approach. The existing risk register (D) is also essential because it provides the current list of identified risks, their owners, statuses, and response actions, allowing the workshop to review, update, and build on prior risk work rather than starting from scratch. The project office floor plan (B) is irrelevant since room layout does not inform risk identification or analysis.

The company's annual report (C) is not a standard workshop input; while it may contain strategic context, it is not essential for facilitating risk assessment. The caterer's menu (E) is purely logistical and has no bearing on risk management content.

Exam trap

PMI-RMP often tests which documents are inputs to risk processes, and candidates pick tangentially related artifacts like the WBS or annual report instead of the Risk Management Plan and risk register.

Full explanation →

198

MCQeasy

During a risk review meeting, a stakeholder asks for the definition of a specific risk term. How should you respond?

A.Ignore the question to keep the meeting on schedule.

B.Refer them to the project management office (PMO) website.

C.Clearly define the term using the agreed-upon project glossary.

D.Ask them to research the term after the meeting.

AnswerC

Using the agreed-upon project glossary ensures the stakeholder receives the definition already sanctioned for this project, satisfying the stem's need for a consistent, shared risk vocabulary. This prevents ambiguity from ad hoc interpretations, aligning the response with the project's documented terminology baseline rather than personal or generic definitions.

Why this answer

The project glossary (sometimes called the risk glossary or data dictionary) is the agreed-upon source of truth for terminology, and using it ensures consistent understanding across all stakeholders. Option C directly applies this artifact, which is part of the project management plan and supports the 'Plan Risk Management' process by establishing common definitions for risk categories, probability, and impact scales. Answering clearly from the glossary also reinforces shared vocabulary for future discussions.

Exam trap

PMI-RMP often tests whether candidates recognize the glossary as the authoritative in-project source for definitions, rather than deferring to external sources (B) or dismissing the question (A, D).

How to eliminate wrong answers

Option A is wrong because ignoring a legitimate clarification question undermines stakeholder engagement and can lead to misinterpretation of risk data throughout the project. Option B is wrong because deferring to a PMO website is impersonal, may not reflect the project-specific glossary, and delays resolution unnecessarily. Option D is wrong because asking the stakeholder to research on their own shifts the burden, risks inconsistent definitions, and fails the risk practitioner's responsibility to ensure shared understanding.

Full explanation →

199

MCQeasy

Why is it important to include stakeholders in the initial risk identification phase?

A.To satisfy a documentation requirement.

B.To force them to accept the project plan.

C.To ensure a comprehensive view by leveraging their diverse experience and knowledge.

D.To blame them if the risks occur.

AnswerC

Stakeholders bring varied perspectives from different disciplines, functions and prior projects, surfacing risks a single team would miss. Their involvement broadens coverage of the risk register during identification, ensuring threats and opportunities are captured comprehensively before qualitative analysis begins.

Why this answer

Stakeholders bring diverse perspectives, domain expertise, and contextual knowledge that the project manager alone cannot possess, so their inclusion in risk identification produces a more comprehensive and accurate risk register. PMI-RMP emphasizes that stakeholder engagement in identification leverages collective experience to surface risks that might otherwise be missed. This directly supports the goal of comprehensive risk identification.

Exam trap

The trap is reducing stakeholder involvement to a bureaucratic checkbox, causing candidates to pick the documentation or blame options instead of the knowledge-leveraging rationale.

How to eliminate wrong answers

Option A is wrong because stakeholder inclusion is not a documentation formality; it is a substantive technique that improves the quality and completeness of risk identification. Option B is wrong because risk identification is not a mechanism to force plan acceptance — that is a separate stakeholder management concern and misrepresents the purpose of the process. Option D is wrong because risk identification is forward-looking and constructive, not a blame-assignment exercise; blaming stakeholders contradicts the open-communication principle of risk culture.

Full explanation →

PMI Risk Management Professional (PMI-RMP) (PMI-RMP) (PMI-RMP) — Questions 151–199