Courseiva

CCNA Risk Process Facilitation Questions

41 questions · Risk Process Facilitation · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

Which TWO of the following are benefits of conducting regular risk workshops?

Select 2 answers
A.Assigning project tasks to team members
B.Automating the project budget
C.Improving stakeholder buy-in and awareness
D.Ensuring the risk register remains current and accurate
E.Replacing the project management plan
AnswersC, D

Regular risk workshops bring stakeholders together to identify and assess threats collaboratively, which builds shared ownership of the risk register and raises awareness of exposures beyond individual silos. This directly satisfies the stem's requirement for benefits, since participation fosters commitment to mitigation actions rather than passive acceptance of risk decisions made elsewhere.

Why this answer

Option C is correct because regular risk workshops bring stakeholders together to discuss, prioritize, and own risks, which builds shared understanding and commitment—directly improving stakeholder buy-in and awareness of risk exposure. Option D is correct because these workshops are a recurring review activity that identifies new risks, reassesses existing ones, updates probability/impact ratings, and closes obsolete entries, thereby keeping the risk register current and accurate. Option A is incorrect because assigning project tasks is a resource-management/team-planning activity, not a risk workshop benefit.

Option B is incorrect because automating the project budget is a financial-tooling function unrelated to risk workshops. Option E is incorrect because the project management plan is a governing document that risk workshops inform and update, not replace.

Exam trap

PMI-RMP often tests whether candidates can distinguish risk workshop benefits from general project management activities, planting options like task assignment or budget automation that sound productive but have no logical connection to the purpose of a risk workshop.

Practice this question →
2
MCQmedium

You are organizing a risk workshop for a multi-disciplinary team. Which tool would be best to identify risks from different perspectives?

A.Cost Baseline
B.Resource Breakdown Structure
C.Risk Breakdown Structure
D.Schedule Network Diagram
AnswerC

A Risk Breakdown Structure hierarchically categorises risk sources, giving a multi-disciplinary team a shared framework to surface risks from technical, external, organisational and project management perspectives. This structured taxonomy prompts diverse viewpoints that a single flat list would miss.

Why this answer

The Risk Breakdown Structure (RBS) is a hierarchical representation of risk categories, organized by source (technical, external, organizational, project management), that helps a workshop team systematically examine risks from multiple perspectives. It ensures coverage across disciplines and prevents the group from overlooking categories. It is the standard PMI tool for structuring risk identification in a multi-disciplinary setting.

Exam trap

PMI-RMP often tests the distinction between the RBS and other breakdown structures, and candidates confuse the RBS (risk sources) with the WBS (deliverables) or RBS with resource/cost structures.

How to eliminate wrong answers

Option A is wrong because the cost baseline is a time-phased budget used for cost control and earned value analysis, not for identifying risks from different perspectives. Option B is wrong because the Resource Breakdown Structure organizes resources by category for resource management and cost accounting, not for risk identification. Option D is wrong because the schedule network diagram shows activity dependencies and the critical path; it is a scheduling artifact, not a risk-identification framework.

Practice this question →
3
MCQeasy

What is the purpose of a Risk Breakdown Structure (RBS)?

A.To assign risk owners
B.To document the project schedule
C.To calculate the total cost of risks
D.To provide a hierarchical representation of potential sources of risk
AnswerD

A Risk Breakdown Structure arranges risk categories hierarchically, from high-level sources down to specific risk events, giving a structured taxonomy for identification and analysis. It organises sources of risk rather than ranking, scoring or assigning owners.

Why this answer

The Risk Breakdown Structure (RBS) is a hierarchical decomposition of potential risk sources or categories, organized to help identify and categorize risks systematically. It provides a structured framework that ensures risks are considered across all relevant areas (e.g., technical, external, organizational, project management) rather than ad hoc.

Exam trap

PMI-RMP often tests the distinction between the RBS (hierarchical risk source categorization) and the risk register (list of individual risks) — candidates confuse the RBS with tools for assigning owners, scheduling, or costing.

How to eliminate wrong answers

Option A is wrong because assigning risk owners is a risk response and register activity, not the purpose of the RBS — the RBS categorizes sources, it does not assign accountability. Option B is wrong because documenting the project schedule is the purpose of the schedule baseline and Gantt charts, not the RBS. Option C is wrong because calculating total risk cost is performed through quantitative risk analysis (e.g., Monte Carlo, EMV), not through the RBS, which is a qualitative categorization tool.

Practice this question →
4
Multi-Selecteasy

Which TWO of the following are common risk response strategies for negative risks?

Select 2 answers
A.Exploit
B.Enhance
C.Avoid
D.Share
E.Transfer
AnswersC, E

Avoidance eliminates the negative risk entirely by changing the project scope, schedule or approach so the threat no longer applies, for example dropping a risky technology. It differs from mitigation, which only lowers probability or impact, and is a recognised strategy for negative risks.

Why this answer

Option C (Avoid) is correct because avoiding a negative risk means changing the project plan or scope to eliminate the threat entirely, such as removing the risky activity or adopting a proven alternative approach. Option E (Transfer) is correct because transferring a negative risk shifts the financial impact and ownership of the threat to a third party, typically through insurance, warranties, or fixed-price contracts. The other options do not belong: Exploit (A) and Enhance (B) are strategies for positive risks (opportunities), aiming to maximize their probability or impact, and Share (D) is also an opportunity strategy that allocates ownership of a positive risk to a third party best able to capture the benefit.

Exam trap

PMI-RMP often tests whether candidates can correctly separate threat response strategies (Avoid, Transfer, Mitigate, Accept, Escalate) from opportunity response strategies (Exploit, Enhance, Share, Accept, Escalate), planting opportunity strategies as distractors in questions about negative risks.

Practice this question →
5
MCQmedium

During a risk workshop, stakeholders identify a risk that could impact multiple departments. How should this be handled?

A.Document the risk and ensure all affected department leads are involved in response planning
B.Assign one department head as the owner
C.Ignore the risk until it impacts a specific department
D.Delegate the risk to the project sponsor
AnswerA

Involving every affected department lead in response planning satisfies the cross-departmental constraint, since a risk spanning multiple functions requires coordinated ownership rather than isolated treatment. Documenting alone is insufficient; the workshop's purpose is collaborative response development, so engaging all impacted leads ensures shared accountability and avoids gaps between departmental mitigation efforts.

Why this answer

When a risk spans multiple departments, the correct approach is to document it in the risk register and engage all affected department leads in response planning so that ownership, dependencies, and cross-functional impacts are addressed collectively. This ensures no department is blindsided and that the response is integrated rather than siloed. It also aligns with the PMBOK principle that risk ownership and response planning should involve all relevant stakeholders.

Exam trap

PMI-RMP often tests the misconception that a single department head can own a cross-functional risk — candidates underestimate the need for multi-stakeholder involvement in response planning.

How to eliminate wrong answers

Option B is wrong because assigning a single department head as owner ignores the cross-functional nature of the risk and can lead to responses that optimize one department at the expense of others. Option C is wrong because ignoring a risk until it materializes is a reactive, non-compliant approach that violates proactive risk management and can cause severe downstream impact. Option D is wrong because delegating the risk to the project sponsor abdicates the PM's responsibility — the sponsor may be informed or escalate, but the PM and affected leads must own the response planning.

Practice this question →
6
MCQhard

You have performed a quantitative analysis and identified a risk that is significantly impacting the schedule. What is the next step to address this?

A.Ask the team to work overtime to buffer the risk
B.Update the project schedule
C.Ignore the risk as it is only a potential occurrence
D.Develop a risk response plan for this specific risk
AnswerD

Quantitative analysis has already confirmed and prioritised the schedule risk; the next step is planning a specific response, such as mitigation, transfer, or avoidance, to reduce its schedule impact. This satisfies the stem's requirement to address the identified risk directly.

Why this answer

After quantitative analysis confirms a risk significantly impacts the schedule, the next step is to develop a targeted risk response plan for that specific risk. Quantitative analysis (e.g., Monte Carlo simulation) identifies and prioritizes risks but does not itself reduce them — the response plan translates the finding into concrete actions such as schedule buffers, resource leveling, or scope adjustments. Only after the response is planned should the schedule be updated to reflect it.

Exam trap

PMI-RMP often tests process sequencing, and candidates frequently pick 'update the project schedule' because it sounds like the logical next action, missing that the response plan must be developed first to determine what schedule changes are needed.

How to eliminate wrong answers

Option A is wrong because blanket overtime is not a risk response strategy — it is an ad hoc action that ignores the structured Plan Risk Responses process and may introduce new risks like burnout. Option B is wrong because updating the project schedule is a downstream action that should occur after the response plan is defined, not before. Option C is wrong because ignoring a quantitatively significant risk contradicts the entire purpose of performing quantitative analysis.

Practice this question →
7
Multi-Selecthard

Which THREE criteria are used to perform a 'Risk Data Quality Assessment'?

Select 3 answers
A.Reliability of the data
B.Accuracy of the data
C.Extent of the data's understanding
D.Total volume of data
E.Color of the spreadsheet cells
AnswersA, B, C

Reliability measures how consistently the data source produces the same result across repeated collection. It is one of the three Risk Data Quality Assessment criteria, satisfying the stem by testing whether the risk information is dependable enough to support qualitative or quantitative analysis.

Why this answer

In PMBOK's Perform Qualitative Risk Analysis process, the Risk Data Quality Assessment evaluates how usable the risk data is by examining its reliability (A) — whether the data comes from consistent, trustworthy sources — its accuracy (B) — how free the data is from bias and error — and the extent of the data's understanding (C) — how well the team comprehends the data's meaning and implications. These three criteria directly determine whether the risk information is sound enough to support qualitative rating and prioritization. The total volume of data (D) is not a quality criterion, since large amounts of poor data do not improve risk analysis, and the color of spreadsheet cells (E) is purely cosmetic formatting with no bearing on data quality.

Exam trap

PMI-RMP often tests the specific criteria of the Risk Data Quality Assessment, and candidates commonly select volume or format-related options because they sound plausible; the trap is forgetting that quality is about reliability, accuracy, and understanding, not quantity or appearance.

Practice this question →
8
MCQhard

A quantitative risk assessment reveals that a risk has a 10% probability of a $1,000,000 impact. What is the Expected Monetary Value (EMV) of this risk?

A.$10,000
B.$1,000,000
C.$100,000
D.$110,000
AnswerC

Multiplying the 10% probability by the $1,000,000 impact yields $100,000, satisfying the stem's requirement for the risk's Expected Monetary Value. EMV quantifies probability-weighted impact, so this figure correctly represents the average expected loss should the risk recur across many projects.

Why this answer

Expected Monetary Value (EMV) is calculated by multiplying the probability of the risk by its monetary impact. Here, 10% × $1,000,000 = $100,000. This value represents the average expected loss or gain from the risk and is used to prioritize risks and set contingency reserves.

Exam trap

PMI-RMP often tests basic EMV arithmetic, and candidates either forget to multiply by probability or confuse the impact with the expected value, picking the full impact instead of the weighted result.

How to eliminate wrong answers

Option A is wrong because $10,000 would result from a 1% probability, not 10%. Option B is wrong because $1,000,000 is the full impact if the risk occurs, not the probability-weighted value. Option D is wrong because $110,000 is the sum of the impact and the EMV, which is not a meaningful calculation in EMV analysis.

Practice this question →
9
Multi-Selecthard

Which THREE factors can lead to an ineffective risk facilitation workshop?

Select 3 answers
A.Poorly defined workshop objectives
B.Absence of key stakeholders
C.Too much coffee provided
D.Lack of preparation by the facilitator
E.Using a projector instead of a whiteboard
AnswersA, B, D

Poorly defined workshop objectives leave participants without a shared scope, so discussion drifts and risks are neither identified nor assessed consistently. This directly satisfies the stem's ineffective-facilitation constraint: absent clear purpose, the facilitator cannot steer the group, prioritise threats, or produce usable risk outputs.

Why this answer

Option A is correct because poorly defined workshop objectives leave participants without a clear scope, agenda, or success criteria, so the risk discussion drifts and produces no actionable risk register entries. Option B is correct because the absence of key stakeholders means the people who own the risks, controls, and decisions are not present, so identified risks cannot be validated, prioritized, or assigned owners. Option D is correct because a facilitator who has not prepared — no pre-read materials, no risk taxonomy, no tailored techniques — cannot guide the group through identification, analysis, and evaluation effectively.

Option C is not a genuine factor; coffee is a comfort/logistics detail and does not determine facilitation effectiveness. Option E is not a genuine factor either; a projector versus a whiteboard is a tooling preference, and either medium can support effective risk facilitation.

Exam trap

The trap here is including distractor options that seem plausible but are logistical or cosmetic (coffee, projector) rather than substantive factors that affect workshop effectiveness, tempting candidates to overthink minor details.

Practice this question →
10
MCQeasy

Which technique is most appropriate for a quick, qualitative assessment of multiple risks in a time-constrained environment?

A.Decision Tree Analysis
B.Monte Carlo Simulation
C.Expected Monetary Value (EMV)
D.Probability and Impact Matrix
AnswerD

The Probability and Impact Matrix ranks risks qualitatively by likelihood and consequence, letting many risks be assessed rapidly without quantitative modelling. This suits the time-constrained environment, whereas techniques such as Monte Carlo simulation demand far more effort per risk.

Why this answer

The Probability and Impact Matrix is most appropriate for a quick, qualitative assessment of multiple risks because it allows risks to be prioritized based on their likelihood and potential impact, without requiring quantitative data or complex simulations.

Exam trap

PMI-RMP often tests the distinction between qualitative and quantitative risk analysis. Candidates might choose quantitative techniques like Monte Carlo or EMV, but the question specifies 'quick, qualitative' and 'multiple risks'.

How to eliminate wrong answers

Option A is wrong because Decision Tree Analysis is a quantitative technique used for specific decisions, not for quick qualitative assessment of multiple risks. Option B is wrong because Monte Carlo Simulation is a quantitative technique that requires significant data and computation. Option C is wrong because Expected Monetary Value (EMV) is a quantitative technique that calculates expected value based on probabilities and impacts, not a quick qualitative assessment.

Practice this question →
11
MCQmedium

You are facilitating a risk workshop for a construction project. A subcontractor raises a concern that a new environmental regulation could delay permitting. The team agrees this is a risk, but they are unsure whether it should be escalated to the program level. What should you do FIRST to help the team make this decision?

A.Assign the risk to the subcontractor and ask them to develop a mitigation plan.
B.Ask the team to assess the risk's probability and impact using the project's risk matrix.
C.Immediately escalate the risk to the program manager because it involves a regulatory change.
D.Review the project charter and risk management plan to confirm the project's risk thresholds and escalation criteria.
AnswerD

The project charter and risk management plan define the project's risk thresholds, tolerances, and escalation criteria. Reviewing these documents first gives the team the objective basis for deciding whether the regulatory risk exceeds the project's authority or impact tolerance, ensuring escalation is consistent with governance rather than ad hoc.

Why this answer

Escalation decisions should be based on documented risk thresholds and escalation criteria, typically found in the project charter and risk management plan. By reviewing these first, the facilitator ensures the team uses a consistent, governance-aligned approach. This prevents both unnecessary escalation and failure to escalate risks that exceed project authority.

Exam trap

The trap here is assuming that any regulatory or external risk automatically belongs to the program level, rather than checking the project's defined escalation criteria.

Practice this question →
12
MCQmedium

Which facilitation technique involves presenting an anonymous survey to experts to reach a consensus on risk impacts?

A.Delphi Technique
B.Brainstorming
C.Root Cause Analysis
D.Interviewing
AnswerA

The Delphi Technique gathers expert judgements through successive anonymous questionnaires, with responses aggregated and fed back between rounds. Anonymity removes pressure to conform to dominant personalities, so consensus on risk impacts emerges iteratively. This matches the stem's requirement for an anonymous survey reaching expert consensus.

Why this answer

The Delphi Technique is a structured, iterative facilitation method in which a facilitator distributes anonymous questionnaires to a panel of subject-matter experts, collects their responses, summarizes them, and then re-circulates the results for further rounds of input until the group converges on a consensus. Anonymity is the defining feature — it removes the influence of seniority, dominant personalities, and groupthink, which is exactly what the question describes. In PMI-RMP risk management, Delphi is used specifically to estimate probability and impact of risks when objective data is scarce.

Exam trap

PMI-RMP often tests the distinction between anonymous, iterative consensus techniques (Delphi) and open group ideation (brainstorming) — candidates pick brainstorming because both involve experts, but only Delphi guarantees anonymity across multiple rounds.

How to eliminate wrong answers

Option B is wrong because brainstorming is a group ideation technique where participants openly and verbally generate ideas together — it is not anonymous and does not use iterative survey rounds to converge on consensus. Option C is wrong because Root Cause Analysis (e.g., fishbone, 5 Whys) is a diagnostic technique used to trace a problem back to its underlying cause, not a consensus-building survey method for rating risk impacts. Option D is wrong because interviewing is a one-on-one or small-group information-gathering technique that collects qualitative data from a single source at a time and does not involve anonymous multi-round convergence.

Practice this question →
13
MCQeasy

A project manager is facilitating a risk response planning session. The team identifies a risk that a key supplier might go bankrupt. They decide to split the order between two suppliers to reduce the impact if one fails. Which risk response strategy are they applying?

A.Transfer
B.Avoid
C.Mitigate
D.Accept
AnswerC

Mitigation reduces the probability or impact of a risk. By splitting the order between two suppliers, the team reduces the impact of a single supplier's bankruptcy. The risk still exists, but its effect is lessened. This is a classic example of mitigation through redundancy or diversification.

Why this answer

Mitigation is the risk response strategy that reduces the probability and/or impact of a threat. Splitting the order between two suppliers lowers the impact of a single supplier's failure, so it is mitigation. Avoidance would eliminate the risk, transfer would shift it, and acceptance would involve no proactive action.

Exam trap

The trap here is confusing mitigation with avoidance, because both involve taking action; however, mitigation only reduces the risk, while avoidance eliminates it entirely.

Practice this question →
14
MCQhard

You are facilitating a risk analysis session for a project with high technical uncertainty. Quantitative analysis results show a wide range of variance. What is the most appropriate action to improve the accuracy of the risk model?

A.Increase the number of iterations in the Monte Carlo simulation
B.Incorporate sensitivity analysis (Tornado Diagram) to refine input assumptions
C.Remove the extreme outliers from the risk dataset
D.Change the probability distribution type from Normal to Triangular
AnswerB

Sensitivity analysis via a Tornado Diagram isolates which input variables drive the widest variance in the quantitative model, letting the team refine those specific assumptions first. This directly addresses the stem's high technical uncertainty by targeting the inputs contributing most to output spread, improving model accuracy efficiently.

Why this answer

When quantitative analysis shows wide variance, the root cause is usually uncertainty in input assumptions rather than insufficient simulation iterations. Sensitivity analysis (Tornado Diagram) identifies which input variables contribute most to output variance, allowing the team to refine those specific assumptions and improve model accuracy. This is the most appropriate action because it targets the source of the variance.

Exam trap

PMI-RMP often tests the misconception that more simulation iterations or different distributions fix wide variance — the real fix is improving input assumptions via sensitivity analysis, not tweaking the simulation mechanics.

How to eliminate wrong answers

Option A is wrong because increasing Monte Carlo iterations improves the precision of the simulation's statistical estimate but does not reduce variance caused by uncertain or poorly estimated inputs — it just gives a more stable estimate of the same wide range. Option C is wrong because removing outliers distorts the model and hides legitimate extreme risks, which is analytically dishonest and dangerous in risk management. Option D is wrong because changing the distribution type from Normal to Triangular does not inherently improve accuracy — the distribution should reflect the actual data-generating process, not be swapped arbitrarily to narrow results.

Practice this question →
15
MCQhard

In a project, you are facilitating a risk workshop. You discover that a risk has been mitigated, but the residual risk remains high. What is the next logical step?

A.Document the residual risk in the risk register
B.Assign a new risk owner
C.Remove the risk from the risk register
D.Close the risk
AnswerA

Documenting the residual risk in the risk register preserves the audit trail and keeps the mitigated risk's remaining exposure visible for ongoing monitoring. Since the stem states residual risk stays high, the register entry satisfies the PMI-RMP requirement to track it, enabling further response planning rather than closure.

Why this answer

After mitigating a risk, if the residual risk remains high, the next logical step is to document the residual risk in the risk register. This ensures that the remaining risk is formally tracked and monitored, and it may require further response planning. The risk register is the central repository for all risk-related information, including residual risks.

Exam trap

PMI-RMP often tests the appropriate action after mitigation; candidates might think the risk should be closed or removed, but the exam emphasizes that residual risks must be documented and monitored, especially if high.

How to eliminate wrong answers

Option B is wrong because assigning a new risk owner is not the immediate next step; the risk already has an owner, and the issue is the high residual risk, not ownership. Option C is wrong because removing the risk from the register would be inappropriate since the risk still exists with high residual. Option D is wrong because closing the risk is premature; the risk is not fully managed if residual risk is high.

Practice this question →
16
MCQhard

You are managing a software development project. Your team has identified a potential integration risk. What is the most effective way to communicate this to the stakeholders?

A.Hold an emergency meeting
B.Update the issue log
C.Send an email to the stakeholder team
D.Add it to the Risk Report
AnswerD

The Risk Report is the formal, documented mechanism for recording identified risks, their analysis and planned responses, giving all stakeholders a consistent, auditable view. It satisfies the need to communicate the integration risk effectively, unlike ad hoc verbal updates that leave no traceable record for review.

Why this answer

The Risk Report is the formal project document specifically designed to communicate identified risks, their analysis, and planned responses to stakeholders. In PMI-RMP, risk communication follows the Plan Risk Management process, which defines how risk information will be shared; the Risk Report is the standard vehicle for conveying risk status, including newly identified integration risks. It ensures stakeholders receive consistent, documented, and traceable risk information rather than ad hoc notifications.

Exam trap

PMI-RMP often tests the distinction between the risk register (internal detail) and the risk report (stakeholder communication), causing candidates to choose the issue log or an email instead of the formal risk communication artifact.

How to eliminate wrong answers

Option A is wrong because an emergency meeting is reserved for urgent, time-critical issues requiring immediate decision-making, not for routine communication of a newly identified risk that has not yet escalated. Option B is wrong because the issue log tracks problems and issues that have already occurred, not potential future risks; risks belong in the risk register and risk report. Option C is wrong because a single email is informal, may not reach all stakeholders, and lacks the structured, documented format required for formal risk communication under PMI standards.

Practice this question →
17
MCQmedium

You are facilitating a risk identification session where one senior stakeholder dominates the conversation. Which facilitation approach would best mitigate this bias?

A.Assign a scribe to record everything
B.Request the senior stakeholder leave the room
C.Use a round-robin brainstorming session
D.Implement the Delphi Technique
AnswerD

The Delphi Technique gathers anonymous, iterative expert input through controlled questionnaires, removing dominant personalities from the room entirely. This directly neutralises the senior stakeholder's disproportionate verbal influence, satisfying the stem's constraint of mitigating bias caused by one participant dominating the identification session.

Why this answer

The Delphi Technique is a structured, anonymous, iterative expert-elicitation method in which a facilitator collects input from experts individually and circulates summarized responses across rounds until consensus emerges. Because contributions are anonymous and written, a dominant senior stakeholder cannot steer or anchor the group, which directly neutralizes the bias described. It is the PMI-recommended tool for reducing the effects of personal influence and groupthink during risk identification.

Exam trap

PMI-RMP often tests the assumption that any group brainstorming technique solves dominance bias, when only anonymous, iterative methods like Delphi truly remove the senior stakeholder's influence.

How to eliminate wrong answers

Option A is wrong because assigning a scribe only improves documentation accuracy; it does nothing to stop one participant from monopolizing the discussion or biasing the risk list. Option B is wrong because removing a senior stakeholder is politically impractical, loses that person's subject-matter expertise, and is not a recognized facilitation technique in the PMBOK risk processes. Option C is wrong because round-robin brainstorming still occurs in a live group setting where a dominant personality can influence, rebut, or intimidate others, so it only partially mitigates the bias rather than eliminating it.

Practice this question →
18
MCQeasy

Which of the following is the best definition of 'Residual Risk'?

A.The risk that occurs after the primary risk is avoided
B.The risk remaining after all response strategies have been implemented
C.The total risk before any responses are taken
D.The risk accepted as part of the project budget
AnswerB

Residual risk is precisely the exposure that persists once every agreed response strategy has been executed, encompassing both accepted and unidentified threats. This definition satisfies the stem's requirement by distinguishing residual risk from inherent risk, which exists before mitigation. It reflects the PMI-RMP principle that some risk always remains after treatment.

Why this answer

Residual risk is defined in the PMBOK Guide as the risk that remains after risk responses have been implemented. It is the exposure that persists even after all planned risk response strategies (avoid, mitigate, transfer, accept) have been executed. This residual exposure must be documented and monitored throughout the project, and it is often formally accepted by the project sponsor or key stakeholders.

Exam trap

PMI-RMP often tests the distinction between residual risk, secondary risk, and inherent risk — candidates frequently confuse residual risk with secondary risk or with the total pre-response risk exposure.

How to eliminate wrong answers

Option A is wrong because it confuses residual risk with secondary risk — a secondary risk is a new risk that arises as a direct result of implementing a risk response, not the risk that remains after avoidance. Option C is wrong because it describes inherent risk (or gross risk), which is the total risk exposure before any response actions are taken. Option D is wrong because it describes the risk budget or contingency reserve — the funds set aside to cover known risks — not the risk itself that remains after responses.

Practice this question →
19
MCQeasy

Who is primarily responsible for maintaining the risk register throughout the project?

A.Risk Management Team
B.Project Sponsor
C.Project Manager
D.Risk Owner
AnswerC

The project manager owns the risk register, ensuring identified risks, responses, owners and statuses stay current throughout the project lifecycle. Risk owners handle individual responses, but ongoing maintenance and updates of the register remain the project manager's responsibility.

Why this answer

The Project Manager is accountable for maintaining the risk register throughout the project lifecycle. While risk owners manage individual risks and the risk management team may contribute updates, the project manager owns the process and ensures the register remains a living, current document. This aligns with PMI's view of the project manager as the central integrator of all project knowledge areas.

Exam trap

PMI-RMP often tests the distinction between the Project Manager (maintains the overall risk register) and the Risk Owner (manages a specific assigned risk), causing candidates to select 'Risk Owner' because the word 'risk' appears in both roles.

How to eliminate wrong answers

Option A is wrong because the Risk Management Team (where one exists) supports risk activities but does not hold primary accountability for the register — that responsibility sits with the project manager. Option B is wrong because the Project Sponsor provides executive support and funding authority but does not maintain operational project artifacts like the risk register. Option D is wrong because the Risk Owner is responsible for monitoring and managing a specific assigned risk, not for maintaining the entire register — this is a common confusion between ownership of a risk and ownership of the register.

Practice this question →
20
Multi-Selecthard

Which TWO of the following should be included in a risk report to executive management?

Select 2 answers
A.Summary of the top high-level risks
B.The project manager's personal performance review
C.Status of management reserves and contingencies
D.Detailed minutes of every risk meeting
E.List of every minor technical task
AnswersA, C

Executives need a concise summary of the top high-level risks to make informed decisions about prioritisation, resourcing and escalation. This satisfies the stem's requirement for content included in a risk report to executive management, avoiding operational detail that obscures strategic exposure.

Why this answer

Option A is correct because a risk report to executive management must lead with a concise summary of the top high-level risks, giving leadership the aggregated view of the most significant threats and opportunities needed for strategic decision-making. Option C is correct because the status of management reserves and contingencies shows executives how much financial buffer remains to absorb realized risks, which is essential for governance and funding decisions. Options B, D, and E are not appropriate: a project manager's personal performance review is an HR matter, detailed minutes of every risk meeting are far too granular for an executive audience, and a list of every minor technical task is operational detail that belongs in team-level tracking, not executive reporting.

Exam trap

PMI-RMP often tests the confusion between what belongs in an executive risk report versus operational project documentation — candidates include excessive detail that defeats the report's decision-support purpose.

Practice this question →
21
MCQmedium

A project manager is conducting a risk review. During the meeting, a new risk is identified. What should be done immediately?

A.Assess the new risk's probability and impact
B.Wait until the next scheduled risk review cycle
C.Add it to the issues log
D.Assign a risk owner immediately
E.Update the risk management plan
AnswerA

Assessing probability and impact immediately qualifies the new risk for the register and prioritisation. Without this rating, the team cannot decide whether to avoid, mitigate, transfer or accept it, so it satisfies the review's need to triage the risk before assigning an owner or response.

Why this answer

When a new risk is identified during a risk review, the immediate next step in the PMI risk management process is to perform qualitative risk analysis—assessing its probability and impact. This evaluation determines the risk's priority and informs subsequent actions such as assigning an owner, planning responses, or adding it to the risk register. Without this assessment, the team cannot make informed decisions about how to handle the risk, so it must come first.

Exam trap

PMI-RMP often tests the sequence of risk management processes, and candidates frequently jump to assigning a risk owner or updating the risk register before assessing the risk, confusing the order of steps in the 'Perform Qualitative Risk Analysis' process.

How to eliminate wrong answers

Option B is wrong because waiting until the next scheduled risk review cycle delays action on a newly identified risk, which could escalate and miss the opportunity for timely response. Option C is wrong because an issues log tracks problems that have already occurred, not potential future risks; a new risk belongs in the risk register, not the issues log. Option D is wrong because assigning a risk owner immediately is premature—while ownership is important, it should follow the assessment of probability and impact to ensure the right person and priority are assigned.

Option E is wrong because updating the risk management plan is not the immediate action for a single new risk; the plan is a high-level document that describes how risk management will be conducted, and it is not typically updated for each individual risk. The immediate focus is on evaluating the risk itself.

Practice this question →
22
MCQmedium

If a qualitative risk analysis is showing inconsistent results, what should you review first?

A.The project charter
B.The Risk Management Plan's definitions of probability and impact
C.The risk register
D.The project budget
AnswerB

Inconsistent qualitative risk analysis usually stems from ambiguous or inconsistently applied rating scales. Reviewing the Risk Management Plan's definitions of probability and impact satisfies the stem by restoring shared, agreed criteria, so different assessors rate the same risk consistently before any other technique is questioned.

Why this answer

Inconsistent qualitative risk analysis results almost always trace back to ambiguous or inconsistently applied rating scales. The Risk Management Plan defines the probability and impact scales, the probability-impact matrix, and the thresholds that determine risk ratings. If those definitions are vague (e.g., 'high probability' without numeric ranges), different team members will score the same risk differently, producing non-repeatable results.

Reviewing and tightening these definitions restores consistency before any other artifact is examined.

Exam trap

PMI-RMP often tests the distinction between the artifact that defines the rules (Risk Management Plan) and the artifact that records the results (risk register) — candidates who pick the register are confusing the output with the governing process input.

How to eliminate wrong answers

Option A is wrong because the project charter authorizes the project and defines high-level objectives, but it contains no probability or impact rating criteria, so it cannot cause or fix scoring inconsistency. Option C is wrong because the risk register is the output being populated — it stores the risk data but does not define the scales used to score it, so reviewing it only shows the symptom, not the cause. Option D is wrong because the project budget is a cost baseline and has no bearing on how probability and impact are defined or applied during qualitative analysis.

Practice this question →
23
MCQmedium

A project manager is updating the risk register. Which of the following is the most important element to include for a newly identified risk?

A.The risk description and its potential impact
B.The cost of mitigation
C.The risk score
D.The name of the risk owner
AnswerA

Recording the risk description together with its potential impact gives the register enough substance to assess probability, prioritise responses and assign ownership. This satisfies the stem because impact defines the consequence should the risk occur, which drives subsequent analysis.

Why this answer

When a risk is first identified and added to the risk register, the foundational entries are a clear description of the risk event and its potential impact on project objectives. Without these, the risk cannot be analyzed, prioritized, or assigned. Other elements like cost of mitigation, risk score, and owner are populated later during qualitative/quantitative analysis and response planning.

Thus, the description and impact are the most critical initial elements.

Exam trap

PMI-RMP often tests the sequence of risk management processes, and candidates may incorrectly assume that a risk score or owner is immediately required upon identification, but the exam expects you to know that description and impact are the first and most critical elements.

How to eliminate wrong answers

Option B is wrong because the cost of mitigation is determined during the Plan Risk Responses process, after the risk has been analyzed and a response strategy selected; it is not an initial entry. Option C is wrong because the risk score is an output of qualitative risk analysis (probability × impact), which requires the description and impact as inputs; it cannot be calculated before those exist. Option D is wrong because the risk owner is assigned during the Plan Risk Responses process, after the risk has been analyzed and a response strategy is chosen; it is not part of the initial identification.

Practice this question →
24
Multi-Selectmedium

Which THREE techniques are suitable for facilitating risk identification with a remote team?

Select 3 answers
A.Online surveys (e.g., Delphi)
B.Face-to-face post-it note sessions
C.Virtual brainstorming platforms
D.In-person town hall meetings
E.Video conferencing with digital whiteboards
AnswersA, C, E

Online surveys such as Delphi gather anonymous expert input across rounds, refining consensus without requiring simultaneous attendance. This asynchronous technique satisfies the remote-team constraint, letting geographically dispersed participants contribute risk perspectives despite time-zone and scheduling barriers that would block live workshops.

Why this answer

Option A (Online surveys, e.g., Delphi) is correct because the Delphi technique is a structured, anonymous, iterative survey method that lets geographically dispersed participants contribute risk ideas and converge on consensus without needing to be in the same room. Option C (Virtual brainstorming platforms) is correct because tools like Miro, Mural, or similar cloud-based ideation platforms allow remote team members to asynchronously or synchronously generate, group, and vote on risks in a shared digital space. Option E (Video conferencing with digital whiteboards) is correct because live video sessions combined with shared whiteboards (e.g., Zoom/Teams with Miro or FigJam) replicate the interactivity of a workshop, enabling real-time discussion and visual capture of risks across distances.

Option B (Face-to-face post-it note sessions) is not suitable because it requires physical co-location, which a remote team by definition lacks. Option D (In-person town hall meetings) is likewise excluded since it depends on participants being physically present in one location, making it impractical for a distributed remote team.

Exam trap

PMI-RMP often tests the assumption that 'effective risk identification requires face-to-face interaction,' tempting candidates to select in-person options even when the scenario explicitly states the team is remote.

Practice this question →
25
MCQmedium

During a risk workshop, stakeholders are struggling to differentiate between root causes and symptoms. Which facilitation technique should you employ to ensure the risk register accurately reflects the true origin of risks?

A.Five Whys
B.Delphi Technique
C.SWOT Analysis
D.Monte Carlo Simulation
AnswerA

Five Whys iteratively asks why each stated problem occurs, drilling past symptoms to the underlying causal factor. Applied during the workshop, it produces risk register entries describing genuine root causes rather than surface observations, directly addressing the stakeholders' difficulty distinguishing causes from symptoms.

Why this answer

The Five Whys technique drills down from a symptom to its underlying root cause by repeatedly asking 'why.' In a risk workshop, it helps stakeholders move past surface symptoms and identify the true origin of risks for accurate register entries. This directly addresses the stated difficulty of differentiating causes from symptoms.

Exam trap

PMI-RMP often tests tool-to-purpose matching, tempting candidates to pick Delphi or SWOT when the scenario explicitly calls for root-cause drilling.

How to eliminate wrong answers

Option B is wrong because the Delphi Technique is a consensus-building method using anonymous expert rounds, not a root-cause drilling technique. Option C is wrong because SWOT Analysis identifies strengths, weaknesses, opportunities, and threats at a broad level, not the causal chain behind a specific risk. Option D is wrong because Monte Carlo Simulation is a quantitative modeling technique for schedule or cost uncertainty, not a facilitation method for root-cause analysis.

Practice this question →
26
MCQeasy

What is the primary role of a 'Risk Owner'?

A.To perform quantitative analysis
B.To fund the mitigation
C.To monitor the risk and manage the response strategy
D.To identify all project risks
AnswerC

The risk owner is the named individual accountable for a specific risk, watching triggers and executing the agreed response strategy. This differs from the risk manager, who owns the process; ownership here is assigned to the person best placed to act.

Why this answer

The Risk Owner is the individual assigned accountability for a specific identified risk. Their core responsibility is to monitor that risk throughout the project lifecycle and ensure the agreed-upon response strategy is implemented and effective. This role is distinct from analysis or funding duties — it is about ownership and ongoing management of the risk itself.

Exam trap

PMI-RMP often tests the distinction between the Risk Owner (monitors and manages a specific risk) and the Project Manager (maintains the overall risk register), causing candidates to conflate accountability for a single risk with ownership of the entire risk management process.

How to eliminate wrong answers

Option A is wrong because quantitative analysis is performed by risk analysts or the project manager using tools like Monte Carlo simulation, not by the risk owner as a primary duty. Option B is wrong because funding mitigation is a financial/reserve decision typically made by the project sponsor or through contingency reserves, not the risk owner's role. Option D is wrong because risk identification is a collective activity involving the team, stakeholders, and subject matter experts during the Identify Risks process — it is not the sole or primary responsibility of the risk owner.

Practice this question →
27
Multi-Selecteasy

Which TWO of the following techniques are commonly used for identifying risks during project initiation?

Select 2 answers
A.Interviewing
B.Sensitivity Analysis
C.Decision Tree Analysis
D.Monte Carlo Simulation
E.Brainstorming
AnswersA, E

Interviewing elicits tacit concerns directly from stakeholders, sponsors and subject-matter experts during initiation, when historical records and quantitative data are scarce. It satisfies the stem's identification constraint by surfacing risks before they materialise, using structured or unstructured questioning rather than relying on later monitoring artefacts.

Why this answer

Interviewing (A) is correct because during project initiation, structured or unstructured interviews with stakeholders, sponsors, and subject-matter experts are a standard qualitative technique for eliciting concerns, assumptions, and potential risks before detailed planning begins. Brainstorming (E) is also correct because facilitated group sessions are a core risk identification technique used at initiation to generate a broad list of possible risks from diverse perspectives. Sensitivity Analysis (B), Decision Tree Analysis (C), and Monte Carlo Simulation (D) are not identification techniques; they are quantitative risk analysis methods used later to evaluate the impact of identified risks on objectives, such as testing how changes in one variable affect the outcome, comparing expected values of decision paths, or modeling probabilistic outcomes through simulation.

Exam trap

PMI-RMP often tests the confusion between qualitative identification techniques (brainstorming, interviewing) and quantitative analysis techniques (Monte Carlo, sensitivity, decision tree) — candidates pick analysis tools for identification questions.

Practice this question →
28
MCQhard

You are managing a global project and need to perform a quantitative risk analysis. The data provided by local offices varies significantly in quality. What is your first step?

A.Discard the data from the office with the lowest quality
B.Perform a Risk Data Quality Assessment
C.Proceed with Monte Carlo simulation and interpret the wide variance
D.Normalize the data using a standard deviation calculation
AnswerB

A Risk Data Quality Assessment evaluates the accuracy, reliability, and integrity of the data gathered from local offices before quantitative analysis. This addresses the stem's constraint of varying data quality, ensuring inputs are trustworthy first.

Why this answer

When data quality varies significantly across sources, the first step is to perform a Risk Data Quality Assessment to evaluate accuracy, reliability, and completeness before feeding that data into quantitative models. Running Monte Carlo or other simulations on poor-quality data produces garbage-in-garbage-out results that mislead decision-makers. Assessing data quality first determines whether the data is usable, needs remediation, or should be excluded with documented rationale.

Exam trap

PMI-RMP often tests the misconception that you can proceed directly to Monte Carlo simulation with inconsistent data — candidates skip the Risk Data Quality Assessment that must precede credible quantitative analysis.

How to eliminate wrong answers

Option A is wrong because discarding the lowest-quality data outright is premature — the assessment may reveal the data is salvageable with normalization or additional validation, and arbitrary exclusion biases the analysis. Option C is wrong because proceeding with Monte Carlo simulation on inconsistent data produces unreliable probability distributions and wide variance that cannot be meaningfully interpreted, defeating the purpose of quantitative analysis. Option D is wrong because normalizing via standard deviation assumes the data is fundamentally sound and only needs statistical adjustment — it skips the diagnostic step of determining whether the data is accurate, reliable, and timely in the first place.

Practice this question →
29
MCQeasy

A project manager wants to maintain the risk register. Which field is strictly required to prioritize risks during the qualitative analysis phase?

A.Probability and Impact
B.Risk Response Strategy
C.Risk Owner
D.Risk Category
AnswerA

Qualitative analysis ranks risks by multiplying or plotting probability against impact, so these two fields are mandatory inputs for every register entry. Without both values, no risk score or priority ordering can be derived during the assessment.

Why this answer

Qualitative risk analysis prioritizes risks by assessing the probability of occurrence and the impact if it occurs, typically plotted on a probability-impact matrix. These two dimensions are the minimum required inputs to derive a priority ranking or risk score. Without them, risks cannot be ordered for further analysis or response planning.

Exam trap

PMI-RMP often tests the sequence of risk processes, and candidates mistakenly pick fields like risk owner or response strategy that belong to later processes rather than the probability and impact inputs needed for prioritization.

How to eliminate wrong answers

Option B is wrong because the risk response strategy is an output of Plan Risk Responses, which happens after prioritization; you cannot select a strategy before you know which risks matter most. Option C is wrong because the risk owner is assigned during Plan Risk Responses and is an accountability field, not a prioritization input. Option D is wrong because the risk category (from the RBS) is used to group and organize risks for reporting and to spot concentration, but it does not by itself determine priority.

Practice this question →
30
MCQhard

You are managing a high-risk project and the quantitative model shows a high probability of missing a milestone. What is the most proactive action to take?

A.Update the project baseline
B.Implement risk mitigation strategies to address the root causes
C.Wait for the risk to occur
D.Accept the risk
AnswerB

Mitigation directly reduces the probability or impact of the identified milestone threat by addressing its root causes, which satisfies the stem's demand for the most proactive action. Unlike contingency responses triggered after the event, mitigation acts on the risk drivers before they materialise, lowering the modelled probability of slippage.

Why this answer

When a quantitative model shows a high probability of missing a milestone, the most proactive action is to implement risk mitigation strategies that address the root causes of the risk. Mitigation reduces the probability and/or impact of the threat before it materializes, directly improving the schedule outcome. Updating the baseline or waiting does not reduce the risk exposure.

Exam trap

PMI-RMP often tests the distinction between proactive risk response (mitigation) and reactive actions (updating baseline, waiting) or passive acceptance, causing candidates to choose a non-proactive option.

How to eliminate wrong answers

Option A is wrong because updating the project baseline is a reactive change to the schedule, not a proactive risk response, and it does not address the underlying risk. Option C is wrong because waiting for the risk to occur is passive acceptance, which is not proactive and can lead to a missed milestone. Option D is wrong because accepting the risk is a valid strategy only when the risk is low or when no other response is feasible; here the high probability demands active mitigation.

Practice this question →
31
MCQeasy

Which of the following is NOT a common risk identification technique?

A.SWOT analysis
B.Brainstorming
C.Risk response planning
D.Checklist analysis
AnswerC

Risk response planning develops and selects actions to address identified risks; it occurs after identification, not as a technique for discovering them. The stem asks which is NOT a risk identification technique, so this process sits in the Plan Risk Responses stage and cannot generate a risk register entry.

Why this answer

Risk response planning is part of the Plan Risk Responses process, which occurs after risk identification is complete — it is not an identification technique. Identification techniques generate the list of risks, while response planning determines what to do about them. SWOT analysis, brainstorming, and checklist analysis are all standard identification tools listed in PMBOK.

Exam trap

PMI-RMP often tests process-group boundaries, and candidates frequently misclassify response planning as an identification technique because both involve thinking about risks, missing that identification produces the list while response planning acts on it.

How to eliminate wrong answers

Option A is wrong because SWOT analysis is a recognized identification technique that examines strengths, weaknesses, opportunities, and threats to surface risks. Option B is wrong because brainstorming is one of the most common identification techniques, used to elicit risks from the team and stakeholders. Option D is wrong because checklist analysis uses historical information and predefined risk categories to identify risks on the current project.

Practice this question →
32
Multi-Selectmedium

Which THREE factors should be considered when assessing the impact of a risk?

Select 3 answers
A.Technical performance degradation
B.Financial cost
C.Personnel vacation schedule
D.Schedule delay
E.Office supply availability
AnswersA, B, D

Technical performance degradation measures how far a risk event would reduce the product's functionality, quality or specification compliance. It is an essential impact factor because it captures non-monetary consequences to the deliverable itself, complementing schedule and cost dimensions in risk assessment.

Why this answer

When assessing the impact of a risk, three key dimensions are technical performance degradation (A), financial cost (B), and schedule delay (D). Technical performance degradation (A) matters because a risk can reduce system functionality, reliability, or quality below required specifications, directly affecting whether the deliverable meets its technical objectives. Financial cost (B) is a core impact factor since risks can trigger budget overruns through rework, penalties, or additional resources, which must be quantified against the approved budget baseline.

Schedule delay (D) is equally essential because risks can push critical-path activities past milestones, delaying delivery and potentially incurring contractual penalties or lost business value. By contrast, personnel vacation schedule (C) is a resource-planning or staffing consideration rather than a direct impact dimension, and office supply availability (E) is a trivial operational detail with no meaningful bearing on risk impact assessment.

Exam trap

PMI-RMP often tests the distinction between core project objectives (triple constraint) and peripheral operational factors, tempting candidates to select options that seem relevant but are not standard impact categories.

Practice this question →
33
MCQhard

In a quantitative risk analysis, the cost contingency has been depleted, yet the risk remains. What is the next logical step in the risk process?

A.Accept the risk without further action
B.Update the risk register with a new probability estimate
C.Reduce the scope of the project
D.Escalate the risk to the project board or project sponsor
AnswerD

When contingency is exhausted but the risk persists, the project team lacks authority to fund further response, so the risk must be escalated to the project board or sponsor. This satisfies the stem's constraint of depleted contingency with residual risk.

Why this answer

When the cost contingency is exhausted but the risk remains, the project manager no longer has authority to absorb it within the project budget, so the risk must be escalated to the project board or sponsor. Escalation is the correct risk-process step when the risk exceeds the project manager's tolerance or available reserves. This aligns with PMI's risk escalation and reserve analysis principles.

Exam trap

PMI-RMP often tests escalation thresholds, tempting candidates to choose acceptance or scope reduction when the correct move is to escalate beyond the project manager's authority.

How to eliminate wrong answers

Option A is wrong because simply accepting the risk without action ignores the fact that the contingency is gone and the risk still threatens the project. Option B is wrong because updating the probability estimate does not address the depleted contingency or the need for higher authority. Option C is wrong because reducing scope is a project change decision that must be authorized by the sponsor or board, not a unilateral next step in the risk process.

Practice this question →
34
Multi-Selecthard

Which THREE elements are necessary for a high-quality quantitative risk analysis?

Select 3 answers
A.Participation of all company employees
B.High-quality, verified data inputs
C.Expert judgment for model assumptions
D.Unlimited project budget
E.Valid probability distributions
AnswersB, C, E

High-quality, verified data inputs ensure the quantitative model reflects reality rather than assumption, satisfying the requirement that estimates be reliable. Poor or unverified data corrupts simulation outputs regardless of technique, so data quality is a precondition for credible numerical risk analysis.

Why this answer

High-quality quantitative risk analysis depends on B (high-quality, verified data inputs), because the accuracy of any probabilistic model is bounded by the reliability of the underlying data—garbage in, garbage out—so verified inputs such as historical loss data, threat frequencies, and asset values are essential. C (expert judgment for model assumptions) is also required, since assumptions about distributions, correlations, and parameter estimates often cannot be derived from data alone and must be validated by subject-matter experts. E (valid probability distributions) is necessary because quantitative analysis expresses risk as probability and impact, and the chosen distributions (e.g., normal, lognormal, Poisson, beta) must correctly represent the behavior of the variables being modeled.

A is not required—risk analysis is performed by a qualified team, not every employee—and D is irrelevant, since budget size does not determine analytical quality.

Exam trap

The exam often includes extreme options like 'all employees' or 'unlimited budget' as distractors; candidates may select them thinking more is better, but the focus is on quality inputs and expert judgment.

Practice this question →
35
Multi-Selecteasy

Which TWO of the following are essential components of a well-maintained risk register?

Select 2 answers
A.Detailed historical log of all meeting minutes
B.Risk owner
C.Project team member CVs
D.Risk description
E.Vendor contact information
AnswersB, D

Assigning a named risk owner ensures each entry has clear accountability for monitoring, response execution and status updates, satisfying the register's need for ongoing ownership rather than orphaned risks. Without this, mitigation actions stall and reporting becomes unreliable, so the risk register cannot remain a living, actively maintained document.

Why this answer

A well-maintained risk register must include a risk owner (B), because every identified risk needs an assigned individual accountable for monitoring, mitigating, and reporting on it throughout the risk management lifecycle. It must also include a risk description (D), since documenting the nature of the risk — its cause, potential impact, and likelihood — is the core purpose of the register and enables proper analysis and response planning. Options A, C, and E are not essential components: meeting minutes, team member CVs, and vendor contact information are unrelated administrative artifacts that do not describe or manage risks, even if they may be stored elsewhere in project documentation.

Exam trap

PMI-RMP often tests the distinction between risk register contents and general project documentation — candidates select plausible-sounding artifacts (meeting minutes, CVs, vendor contacts) that belong to other knowledge areas.

Practice this question →
36
MCQhard

You have multiple risks that appear to be related. What tool would help you visualize the relationships between them?

A.Probability and Impact Matrix
B.Cause-and-Effect Diagram
C.Risk Breakdown Structure
D.Risk Register
AnswerB

A Cause-and-Effect Diagram (Ishikawa) maps multiple causes branching into an effect, revealing how apparently separate risks share underlying drivers. This visual structure exposes the relationships and common root causes between the related risks, supporting more effective response planning.

Why this answer

A Cause-and-Effect Diagram (also known as a Fishbone or Ishikawa diagram) is used to visualize the relationships between a problem or effect and its potential causes. When multiple risks appear related, this tool helps identify root causes and show how they interconnect, making it ideal for understanding relationships between risks.

Exam trap

PMI-RMP often tests the confusion between tools that categorize or prioritize risks (like Risk Breakdown Structure or Probability and Impact Matrix) and those that show causal relationships (Cause-and-Effect Diagram).

How to eliminate wrong answers

Option A is wrong because a Probability and Impact Matrix is used to prioritize risks based on their likelihood and impact, not to visualize relationships. Option C is wrong because a Risk Breakdown Structure organizes risks into categories, but does not show relationships between them. Option D is wrong because a Risk Register is a document that lists risks and their attributes, but it does not provide a visual representation of relationships.

Practice this question →
37
Multi-Selectmedium

Which THREE steps are part of the 'Qualitative Risk Analysis' process?

Select 3 answers
A.Categorize risks for analysis
B.Execute the risk response
C.Assess probability and impact
D.Perform a Monte Carlo simulation
E.Prioritize risks using a matrix
AnswersA, C, E

Categorising risks by source or affected objective is an explicit step within Qualitative Risk Analysis, grouping risks so probability and impact can be assessed consistently. This satisfies the stem's requirement by structuring risks for subsequent prioritisation, before quantitative analysis or response planning begins.

Why this answer

Option A (Categorize risks for analysis) is correct because qualitative risk analysis begins by grouping risks by categories (e.g., technical, schedule, cost) to ensure consistent evaluation and to identify common root causes. Option C (Assess probability and impact) is correct because the core of qualitative risk analysis is rating each risk's likelihood and consequence using ordinal scales (such as very low to very high) rather than numerical simulation. Option E (Prioritize risks using a matrix) is correct because the probability-impact matrix (risk matrix) is the standard qualitative tool that ranks risks into priority levels to focus attention on the most significant ones.

Option B (Execute the risk response) is not part of this process; executing responses occurs in the Implement Risk Responses process after planning. Option D (Perform a Monte Carlo simulation) is not part of qualitative risk analysis; Monte Carlo simulation is a quantitative risk analysis technique that uses probability distributions and numerical modeling.

Exam trap

PMI-RMP often tests the boundary between qualitative and quantitative analysis, planting Monte Carlo simulation as a distractor because candidates who do not firmly associate simulation with quantitative techniques may incorrectly include it in the qualitative process.

Practice this question →
38
Multi-Selecthard

You are facilitating a risk identification session for a software development project. The team is using a Delphi technique to reach consensus on the top risks. Which two actions are essential for you to perform as the facilitator to ensure the Delphi process is effective? (Choose two.)

Select 2 answers
A.Provide a summary of the previous round's responses to all participants before the next round.
B.Ensure that participants remain anonymous to each other throughout the rounds.
C.Allow the project sponsor to vote first to set the direction for others.
D.Require participants to reach a unanimous agreement before ending the session.
E.Conduct the session in a single face-to-face meeting to speed up the process.
AnswersA, B

The Delphi technique relies on iterative rounds where participants see a summary of the group's previous responses. This allows them to reconsider their own positions in light of the collective view. As facilitator, you must compile and distribute this summary without attributing comments to individuals, enabling informed convergence toward consensus.

Why this answer

The Delphi technique requires anonymity and iterative feedback. Participants must remain anonymous to avoid bias, and they must receive summarized results from previous rounds to refine their opinions. These two actions enable the facilitator to guide the group toward reliable consensus without the drawbacks of direct confrontation or dominant personalities.

Exam trap

The trap here is confusing Delphi with brainstorming or nominal group technique, which may involve face-to-face interaction or open voting, rather than preserving anonymity and iterative feedback.

Practice this question →
39
MCQmedium

When facilitating a risk workshop, how do you handle a suggestion that is clearly out of scope for the current project?

A.Include it in the risk register anyway
B.Ask the stakeholder to leave
C.Acknowledge the input and record it in the 'Parking Lot' for future consideration
D.Immediately dismiss it
AnswerC

Recording the suggestion in a Parking Lot acknowledges the contributor without derailing the workshop's scope, satisfying the constraint of maintaining focus on in-scope risks. It preserves the idea for later review rather than discarding it, which sustains psychological safety and participation. Escalating or debating out-of-scope items wastes limited workshop time.

Why this answer

When a risk workshop participant offers a suggestion that is clearly out of scope, the facilitator should acknowledge the input and record it in the 'Parking Lot' for future consideration (Option C). This respects the contributor, keeps the workshop focused on the current project's risks, and preserves the idea in case it becomes relevant later or belongs to another initiative. The Parking Lot technique is a standard facilitation tool for managing off-topic but potentially valuable input.

Exam trap

PMI-RMP often tests the facilitator's response to off-topic input, tempting candidates to either include it in the risk register (polluting scope) or dismiss it (damaging engagement) instead of using the Parking Lot to acknowledge and defer.

How to eliminate wrong answers

Option A is wrong because including an out-of-scope item in the risk register pollutes the register with irrelevant risks, diluting focus and potentially triggering unnecessary responses. Option B is wrong because asking the stakeholder to leave is disrespectful and counterproductive — it discourages participation and may damage team dynamics. Option D is wrong because immediately dismissing the suggestion without acknowledgment discourages future contributions and may cause the stakeholder to disengage from the risk process.

Practice this question →
40
Multi-Selecteasy

Which TWO of the following are considered 'Risk Triggers'?

Select 2 answers
A.A sudden drop in vendor quality
B.The project office moving locations
C.The end of the fiscal year
D.A specific project milestone missed
E.The project manager's birthday
AnswersA, D

A sudden drop in vendor quality is an observable condition indicating that a risk may be about to occur or has occurred, prompting a response. This satisfies the stem's definition of a trigger as a warning sign rather than the risk event itself.

Why this answer

A risk trigger is a specific, observable event or condition that indicates a risk is about to occur or has occurred, so it must be tied to a defined risk response. Option A, a sudden drop in vendor quality, is a classic trigger because it is a measurable deviation in supplier performance that signals a supply-chain or quality risk requiring action. Option D, a specific project milestone missed, is also a valid trigger because a missed milestone is a concrete schedule event that activates contingency or corrective plans.

Option B, the project office moving locations, is a logistical change rather than a defined risk indicator, and option C, the end of the fiscal year, is a recurring calendar event that is not inherently tied to a specific risk. Option E, the project manager's birthday, is irrelevant to project risk and is not a trigger.

Exam trap

PMI-RMP often tests the distinction between a risk trigger (a specific, causally linked warning sign) and a general event or calendar date, tempting candidates to select plausible-sounding but causally unlinked options.

Practice this question →
41
Multi-Selecteasy

Which TWO documents are essential to have on hand during a risk facilitation workshop?

Select 2 answers
A.The Risk Management Plan
B.The project office floor plan
C.The company's annual report
D.The existing risk register
E.The caterer's menu
AnswersA, D

The Risk Management Plan defines the risk methodology, roles, scoring scales and reporting formats the workshop must follow, so facilitators can align identification and assessment activities with the approved approach rather than improvising. It is the governing document the stem's facilitation workshop depends on.

Why this answer

The Risk Management Plan (A) is essential because it defines the workshop's methodology, risk categories, probability and impact scales, risk thresholds, and roles, so participants can assess and prioritize risks consistently with the project's approved approach. The existing risk register (D) is also essential because it provides the current list of identified risks, their owners, statuses, and response actions, allowing the workshop to review, update, and build on prior risk work rather than starting from scratch. The project office floor plan (B) is irrelevant since room layout does not inform risk identification or analysis.

The company's annual report (C) is not a standard workshop input; while it may contain strategic context, it is not essential for facilitating risk assessment. The caterer's menu (E) is purely logistical and has no bearing on risk management content.

Exam trap

PMI-RMP often tests which documents are inputs to risk processes, and candidates pick tangentially related artifacts like the WBS or annual report instead of the Risk Management Plan and risk register.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Risk Process Facilitation questions.

Start 20-question session