Knowledge + Practice

CCNA Risk Strategy And Planning Questions

40 questions · Risk Strategy And Planning · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

Your organization uses a 'Risk Management Information System' (RMIS). During planning, you are configuring the system to track risk data. Which parameter is critical to define to ensure meaningful risk reporting?

A.Standardized probability and impact scoring scales.

B.The exact date of the project's completion.

C.The project manager's salary.

D.A list of all possible project vendors.

AnswerA

Standardised probability and impact scales give every risk a common scoring basis, so the RMIS can aggregate, compare and rank risks consistently. Without this shared calibration, reporting thresholds and heat maps become meaningless, defeating the system's purpose during planning.

Why this answer

A Risk Management Information System (RMIS) aggregates risk data across projects and portfolios, and meaningful reporting requires that all inputs use consistent, standardized probability and impact scoring scales. Without a common scale (e.g., 1–5 for probability, 1–5 for impact with defined monetary or schedule thresholds), risk scores from different projects cannot be compared, aggregated, or trended — the RMIS would produce apples-to-oranges data. Defining these scales is a foundational configuration step in the risk management plan and a prerequisite for quantitative and qualitative analysis.

Exam trap

The trap is selecting a project-specific detail (completion date, salary, vendor list) when the question asks about a *system-wide configuration parameter* — candidates must recognize that RMIS value comes from cross-project comparability, which requires standardized scoring scales.

How to eliminate wrong answers

Option B is wrong because the project completion date is a schedule attribute, not a risk data parameter — it does not affect how risks are scored, compared, or reported in the RMIS. Option C is wrong because the project manager's salary is a cost/HR detail with no relevance to risk scoring or reporting; it would never be a configuration parameter for risk data. Option D is wrong because a vendor list is a procurement artifact, not a risk scoring input — while vendors may be risk sources, listing them does not standardize risk reporting.

Practice this question →

2

Multi-Selectmedium

Which THREE steps are essential for a project manager when planning for 'Stakeholder Risk Attitudes'?

Select 3 answers

A.Identify key stakeholders and their attitudes.

B.Ignore the stakeholder's feelings.

C.Adjust risk response strategies based on identified attitudes.

D.Change the project objectives to match the sponsor's personality.

E.Document the risk attitude in the Stakeholder Register.

AnswersA, C, E

Identifying stakeholders and their individual risk attitudes establishes the baseline input for stakeholder risk planning, satisfying the stem's requirement. Without knowing who holds which attitude, response tailoring and communication approaches cannot be aligned to tolerance levels.

Why this answer

Option A is correct because the first essential step in planning for stakeholder risk attitudes is to identify the key stakeholders and determine whether each one is risk-averse, risk-neutral, or risk-seeking, since these attitudes directly shape how risks will be perceived and tolerated. Option C is correct because once attitudes are identified, the project manager must tailor risk response strategies — for example, choosing avoidance or mitigation for risk-averse stakeholders versus acceptance or exploitation for risk-seeking ones — so that responses align with stakeholder expectations. Option E is correct because the Stakeholder Register is the standard project document for recording stakeholder analysis information, including risk attitude, and documenting it there ensures the data is available for ongoing risk planning and communication.

Option B is incorrect because ignoring stakeholder feelings contradicts the entire purpose of stakeholder risk-attitude analysis and would undermine engagement and risk buy-in. Option D is incorrect because project objectives are derived from the charter, scope, and business case, not from altering them to match a sponsor's personality; risk attitudes influence risk responses, not the fundamental objectives.

Exam trap

The trap here is the distractor that sounds proactive but actually violates scope or governance (changing objectives to match a sponsor's personality), which candidates may pick because it seems responsive to stakeholder concerns.

Practice this question →

3

MCQmedium

A project manager wants to ensure that risk management is not viewed as a 'blame game'. How should they configure their risk communication strategy?

A.Focus on the root cause and mitigation during risk reviews, not on who identified the risk.

B.Require team members to report risks to the project sponsor directly.

C.Only allow the project manager to identify risks.

D.Publicly document every risk identified by each team member.

AnswerA

Directing discussion to root cause and mitigation removes personal attribution, so participants report risks without fearing reprisal. This keeps the risk register honest and satisfies the stem's requirement that risk management not become a blame game.

Why this answer

To prevent risk management from becoming a blame game, the communication strategy should focus on root causes and mitigation actions rather than on who identified or caused the risk. This fosters psychological safety, encouraging open and honest risk reporting without fear of retribution. PMI emphasizes a blame-free culture as essential for effective risk identification and stakeholder engagement.

Exam trap

PMI-RMP often tests the distinction between accountability for risk response and blame for risk occurrence — candidates may pick options that seem transparent but actually reinforce a blame culture.

How to eliminate wrong answers

Option B is wrong because requiring team members to report risks directly to the sponsor bypasses the project manager and can create fear or political pressure, worsening the blame culture. Option C is wrong because restricting risk identification to the project manager severely limits input and contradicts the principle that risk identification should involve all relevant stakeholders. Option D is wrong because publicly documenting every risk by team member name invites blame and discourages reporting, directly undermining a healthy risk culture.

Practice this question →

4

MCQhard

You are leading risk management for a global ERP rollout. The program management office has issued a directive that all projects must use a single enterprise risk register with a fixed scoring scale of 1-5 for probability and impact. During a risk workshop, a regional project manager argues that the fixed scale does not reflect the severe regulatory penalties unique to their region. What is the most appropriate action for you as the risk manager?

A.Propose a calibrated scale within the enterprise framework that defines region-specific anchors for the impact levels while preserving the 1-5 structure.

B.Allow the region to define a separate parallel register with its own scale and report only aggregate results upward.

C.Instruct the regional manager to use the enterprise scale unchanged to preserve cross-project comparability.

D.Escalate the disagreement to the PMO and request an exemption for the region from the enterprise register requirement.

AnswerA

Calibrating impact anchors for a region while keeping the 1-5 structure maintains enterprise comparability and captures the region's severe regulatory consequences. This satisfies the PMO's standardization goal and the regional manager's legitimate concern. It is a common tailoring approach in risk management planning, where scales are defined with context-specific descriptors to improve rating accuracy without abandoning the shared framework.

Why this answer

The best resolution preserves the enterprise's need for consistent, comparable risk data while accommodating legitimate contextual differences. Calibrating the impact scale's descriptive anchors by region keeps the 1-5 structure intact and makes ratings more accurate. This is an application of tailoring within Plan Risk Management, balancing standardization with relevance.

The other choices either ignore the regional concern, fragment the register, or bypass the framework entirely.

Exam trap

The trap here is treating standardization and contextual accuracy as mutually exclusive, when a calibrated scale within the shared framework satisfies both requirements.

Practice this question →

5

MCQhard

You are auditing a project and find that the Risk Management Plan was never socialized with the project team. What is the most significant risk of this situation?

A.The team will be confused about their project roles.

B.The project sponsor will be unhappy.

C.The project will be over budget immediately.

D.Risks will not be identified or reported consistently throughout the project.

AnswerD

Without socialisation, team members apply inconsistent identification and reporting criteria, so risks surface unevenly or go unreported. This directly undermines the plan's purpose of uniform risk management across the project, making inconsistent identification the most significant consequence.

Why this answer

The Risk Management Plan defines the methodology, roles, responsibilities, budget, timing, and risk categories/thresholds the project will use — so if it is never socialized, team members will apply inconsistent identification techniques, use different probability/impact scales, and report risks through ad hoc channels. This directly undermines the plan's purpose of creating a common, repeatable approach to risk. The most significant consequence is therefore inconsistent risk identification and reporting across the project lifecycle.

Exam trap

PMI-RMP often tests the distinction between the Risk Management Plan (the process/methodology document) and the Risk Register (the list of identified risks), so candidates who pick role confusion or budget impact are confusing risk management with HR or cost management.

How to eliminate wrong answers

Option A is wrong because role confusion is a resource/HR management concern addressed by the Responsibility Assignment Matrix (RACI) and staffing management plan, not the primary purpose of the Risk Management Plan. Option B is wrong because sponsor dissatisfaction is a stakeholder engagement outcome, not a direct technical consequence of failing to socialize the risk plan. Option C is wrong because going over budget 'immediately' is an exaggerated, non-deterministic claim — poor risk management may increase cost exposure over time, but it does not cause instant budget overruns.

Practice this question →

6

MCQmedium

Your project is highly sensitive to regulatory changes. How should you incorporate this into your risk strategy planning?

A.Outsource all regulatory compliance tasks to a third party.

B.Establish a regulatory risk watch list and define trigger conditions.

C.Increase the reserve budget based on expert judgment.

D.Ignore the risk until a specific regulation is passed.

AnswerB

A regulatory watch list with defined trigger conditions converts ongoing regulatory uncertainty into monitored, actionable signals, embedding it into risk strategy rather than treating it as a one-off. This gives the project early warning and predefined responses to regulatory change.

Why this answer

For a project highly sensitive to regulatory changes, the risk management plan should include a structured mechanism to monitor the external regulatory environment continuously. A regulatory risk watch list with defined trigger conditions operationalizes this by identifying specific regulations, assigning owners, and specifying the thresholds or events that would activate a risk response — turning an ambiguous 'regulatory uncertainty' into a manageable, trackable risk. This aligns with PMI's emphasis on proactive risk identification and the 'Monitor Risks' process, where triggers are the early-warning signals that prompt contingency plan execution.

Exam trap

The trap is choosing a response action (increasing reserves, outsourcing) instead of a monitoring/strategy mechanism — PMI-RMP questions about 'incorporating into risk strategy planning' are asking for the planning artifact, not the execution tactic.

How to eliminate wrong answers

Option A is wrong because outsourcing compliance does not transfer regulatory accountability — the organization remains legally liable, and outsourcing removes the internal visibility needed to detect and respond to regulatory shifts. Option C is wrong because increasing the reserve budget is a response tactic, not a strategy; without identified triggers and monitoring, the reserve may be misallocated or insufficient, and it does nothing to detect the risk event. Option D is wrong because ignoring a known, high-sensitivity risk until it materializes is the definition of a reactive (and negligent) approach that violates the core principle of proactive risk management.

Practice this question →

7

Multi-Selecthard

Which THREE elements should be explicitly defined in the Risk Management Plan regarding 'Risk Thresholds'?

Select 3 answers

A.The favorite hobby of the project sponsor.

B.Specific trigger values for metrics like cost or time variance.

C.The alignment between thresholds and organizational risk tolerance.

D.The font style for reports.

E.The approval process for exceeding the threshold.

AnswersB, C, E

Thresholds need concrete, measurable trigger values — for example a cost variance exceeding 10 per cent — so the team can detect when a risk response or escalation is required. This satisfies the stem's demand for explicitly defined thresholds rather than qualitative statements, making monitoring objective and repeatable.

Why this answer

Option B is correct because a Risk Management Plan must state concrete, measurable trigger values — for example, a cost variance of ±10% or a schedule variance of 5 days — so that the team can objectively detect when a risk threshold has been breached. Option C is correct because thresholds are only meaningful if they are calibrated to the organization's documented risk tolerance and appetite, ensuring that escalation and response decisions reflect the enterprise's acceptable exposure levels. Option E is correct because the plan must define who is authorized to approve actions when a threshold is exceeded, such as the sponsor or PMO, along with the required escalation and change-control steps.

Option A is incorrect because a sponsor's personal hobby is irrelevant to risk threshold definition and has no bearing on project risk management. Option D is incorrect because report font style is a formatting/presentation detail, not a substantive element of risk thresholds.

Exam trap

The trap is including obviously irrelevant distractors (hobby, font style) that are easy to eliminate, but candidates may still miss the need to include the approval process for exceeding thresholds, which is a less obvious but essential element.

Practice this question →

8

MCQhard

During a project's mid-lifecycle review, you discover that the original risk management strategy is no longer effective due to a change in the market environment. What is the best course of action?

A.Continue using the current plan to maintain consistency.

B.Ask stakeholders to sign off on the original plan again.

C.Formally review and update the Risk Management Plan to reflect current realities.

D.Switch to a quantitative-only approach immediately.

AnswerC

The Risk Management Plan is a living document; when market conditions invalidate its assumptions, it must be formally reviewed and updated through change control. This restores alignment between the strategy and the current environment, satisfying the stem's constraint that the original strategy is no longer effective.

Why this answer

When the market environment changes and the original risk management strategy is no longer effective, the project manager must formally review and update the Risk Management Plan to reflect current realities. Risk management is iterative, and the plan is a living document that must be revised when assumptions, constraints, or external conditions change. This ensures responses remain relevant and resources are allocated appropriately.

Exam trap

The trap is the false comfort of 'consistency' — candidates may think sticking to the approved plan is always correct, but PMI-RMP emphasizes that risk management is iterative and plans must adapt to changing conditions.

How to eliminate wrong answers

Option A is wrong because continuing with an ineffective plan for the sake of consistency ignores the dynamic nature of risk and can lead to unmanaged exposure. Option B is wrong because re-signing the original plan does not address the changed environment; stakeholder sign-off on outdated content provides no risk management value. Option D is wrong because switching to a quantitative-only approach is an overreaction; quantitative analysis complements but does not replace qualitative analysis and the broader risk management framework, and the problem is the strategy, not the analysis method.

Practice this question →

9

MCQeasy

Which of the following is a 'tool and technique' used during the Plan Risk Management process?

A.The Risk Register

B.The Project Scope Statement

C.Expert Judgment

D.The Project Team

AnswerC

Expert judgment draws on specialists' experience to tailor how risk management is planned, including methodology, roles, budgeting and timing. It is a recognised tool and technique of Plan Risk Management, alongside meetings and data analysis.

Why this answer

Expert Judgment is explicitly listed as a tool and technique in the Plan Risk Management process per the PMBOK Guide. During this process, experts with experience in similar projects or risk management provide input on how to tailor the risk management approach, including methodologies, roles, responsibilities, and budget. This makes it a core technique for developing the risk management plan.

Exam trap

PMI-RMP often tests the distinction between inputs, tools and techniques, and outputs (ITTO) of each process, and candidates frequently confuse outputs like the Risk Register with tools and techniques.

How to eliminate wrong answers

Option A is wrong because the Risk Register is an output of the Identify Risks process, not a tool and technique used during Plan Risk Management. Option B is wrong because the Project Scope Statement is an input to Plan Risk Management, not a tool and technique. Option D is wrong because the Project Team is a resource or participant, not a formal tool and technique; while team members may contribute, the PMBOK Guide does not list 'Project Team' as a tool and technique for this process.

Practice this question →

10

MCQmedium

You are auditing a project's risk management methodology. You notice that risk identification happens only at the start of the project. What should you recommend to align with standard PMI-RMP best practices?

A.Request additional funding for a dedicated risk consultant.

B.Create a separate document for residual risks only.

C.Integrate risk identification into each project stage gate or iteration review.

D.Use a quantitative risk analysis tool to automate identification.

AnswerC

Risk identification is iterative, not a one-off activity. Embedding it in stage gates and iteration reviews surfaces new threats as scope, assumptions and external conditions change, satisfying PMI-RMP's requirement for continuous risk identification throughout the project life cycle.

Why this answer

PMI-RMP best practice treats risk identification as an iterative, ongoing process conducted throughout the project lifecycle, not a one-time activity. Integrating identification into stage gates or iteration reviews ensures new risks emerging from changing conditions are captured and existing risks are re-evaluated. This aligns with the 'Identify Risks' process being repeated in every phase and with progressive elaboration.

Exam trap

The trap is confusing risk identification with a one-time planning activity, leading candidates to pick tooling or documentation options instead of the iterative process fix.

How to eliminate wrong answers

Option A is wrong because hiring a dedicated risk consultant does not fix the process gap of one-time identification; it addresses resourcing, not methodology. Option B is wrong because creating a separate residual risk document is a documentation artifact, not a corrective action for continuous identification, and residual risks are already tracked in the risk register. Option D is wrong because quantitative analysis tools automate analysis, not identification; identification relies on techniques like brainstorming, Delphi, interviews, and checklists, and automation cannot replace iterative human identification.

Practice this question →

11

MCQeasy

Which component of the risk management plan details the frequency and level of detail for risk reports?

A.Risk Breakdown Structure

B.Risk Response Matrix

C.Probability and Impact Matrix

D.Risk Reporting Requirements

AnswerD

Risk Reporting Requirements specify the format, cadence and level of detail for risk reports, plus their audience and purpose. This component directly governs how often and how thoroughly risk information is communicated, matching the question's constraint.

Why this answer

The Risk Reporting Requirements section of the risk management plan defines the format, frequency, audience, and level of detail for risk reports — exactly what the question asks. It specifies who receives which reports (e.g., weekly risk dashboard for the PMO, monthly summary for the steering committee) and the granularity of data (e.g., top-10 risks vs. full register). This is a planning artifact that ensures stakeholders get timely, decision-useful risk information without over- or under-reporting.

Exam trap

The trap is selecting a risk *analysis* tool (RBS, P-I Matrix, Response Matrix) when the question asks about a *reporting* specification — candidates must distinguish between tools that categorize/prioritize risks and the plan component that defines how risks are communicated.

How to eliminate wrong answers

Option A is wrong because the Risk Breakdown Structure (RBS) is a hierarchical categorization of risk sources (technical, external, organizational, PM) used to structure risk identification — it does not address reporting cadence or detail. Option B is wrong because a Risk Response Matrix maps risks to response strategies (avoid, transfer, mitigate, accept) and owners; it is a response-planning tool, not a reporting specification. Option C is wrong because the Probability and Impact Matrix is a qualitative prioritization grid that classifies risks into high/medium/low zones — it informs which risks to report on, but does not define the reporting requirements themselves.

Practice this question →

12

Multi-Selectmedium

Which TWO factors contribute to a project's risk appetite?

Select 2 answers

A.The color of the project status report.

B.The number of pages in the risk register.

C.The software tool selected for the project.

D.Organizational culture and management style.

E.The strategic objectives and the value at stake.

AnswersD, E

Organisational culture and management style directly shape how much uncertainty senior leaders tolerate, which sets the project's risk appetite. A culture that rewards caution and a directive management style both lower the appetite, satisfying the stem's requirement for contributing factors rather than generic risk responses.

Why this answer

Option D is correct because an organization's culture and management style directly shape how much uncertainty stakeholders are willing to accept, since risk tolerance is set by leadership attitudes, governance norms, and decision-making behavior rather than by project artifacts. Option E is correct because risk appetite is fundamentally driven by strategic objectives and the value at stake: when a project supports high-value strategic goals, the organization may accept more risk to capture the reward, while low-value or compliance-critical efforts usually demand a more conservative posture. The unmarked options do not belong because A, the color of the project status report, is merely a reporting indicator and does not determine risk appetite; B, the number of pages in the risk register, reflects documentation volume, not the organization's willingness to take risk; and C, the software tool selected for the project, is a tactical delivery choice that has no bearing on the enterprise's risk tolerance.

Exam trap

The trap is selecting options that sound like project management artifacts (risk register, status report, tools) rather than the governance and strategic drivers — PMI-RMP tests whether you understand that risk appetite is a leadership/strategy concept, not a documentation concept.

Practice this question →

13

MCQmedium

A project team is conducting a risk planning workshop. A team member suggests that all risks identified should be mitigated. What is the most appropriate response from the project manager?

A.Transfer all identified risks to a third-party vendor.

B.Ignore the comment and document only the risks the manager likes.

C.Explain that risk responses are selected based on the cost-benefit analysis and risk appetite.

D.Agree with the team member to ensure project safety.

AnswerC

Not every risk warrants mitigation; responses are chosen through cost-benefit analysis against the organisation's risk appetite, so some risks are accepted, transferred or avoided. Blanket mitigation wastes resources and is not the project manager's appropriate guidance.

Why this answer

Risk responses are not automatically applied to every risk; they are selected through cost-benefit analysis and must align with the organization's risk appetite and tolerance. Some risks may be accepted, some avoided, some transferred, and some mitigated — the choice depends on whether the response's cost is justified by the reduction in exposure. The project manager should explain this decision framework rather than agree to mitigate everything.

Exam trap

The trap is the absolutist framing 'all risks should be mitigated,' which sounds safe but violates the principle that response selection is driven by cost-benefit analysis and risk appetite, not by blanket mitigation.

How to eliminate wrong answers

Option A is wrong because transferring all risks to a third party is neither feasible nor cost-effective; transfer typically applies to specific insurable or contractual risks and usually comes with a premium that must be justified. Option B is wrong because ignoring team input and selectively documenting risks violates the inclusive, documented approach required by the Identify Risks process and undermines stakeholder engagement. Option D is wrong because agreeing to mitigate all risks blindly ignores cost-benefit analysis and risk appetite, potentially wasting budget on low-priority risks while underfunding high-priority ones.

Practice this question →

14

MCQeasy

During a project kickoff meeting, a senior stakeholder states they are 'very risk-averse' regarding project timelines but 'open to innovation' regarding technical solutions. How should the risk management plan reflect this?

A.Escalate all technical risks to the project sponsor immediately.

B.Ignore the stakeholder's comment as it is subjective.

C.Create separate risk tolerance thresholds for schedule-related risks and technical risks.

D.Set a single, conservative risk tolerance threshold for all risk categories.

AnswerC

Risk tolerance thresholds are set per objective, so the stakeholder's low appetite for schedule slippage and high openness to technical experimentation require distinct thresholds. Separate schedule and technical tolerances satisfy both attitudes, letting responses to each risk category match the stated appetite.

Why this answer

The stakeholder has expressed two distinct risk attitudes: low tolerance for schedule risk and high tolerance for technical risk. PMI-RMP best practice recognizes that risk tolerance is not monolithic — it varies by risk category, stakeholder, and objective. Creating separate thresholds for schedule and technical risks accurately captures this differentiated appetite and allows appropriate response strategies for each category.

Exam trap

The trap here is assuming risk tolerance is a single universal value, causing candidates to pick the 'one conservative threshold' option instead of recognizing that PMI-RMP requires category-specific thresholds.

How to eliminate wrong answers

Option A is wrong because escalating all technical risks to the sponsor is an overreaction that ignores the stakeholder's stated openness to innovation and bypasses the normal risk response planning process. Option B is wrong because stakeholder risk attitudes are a legitimate and required input to risk management planning under PMI-RMP; dismissing them as subjective ignores a key input to the Risk Management Plan. Option D is wrong because a single conservative threshold for all categories would over-constrain technical risks that the stakeholder explicitly welcomes, misaligning the plan with actual stakeholder tolerance.

Practice this question →

15

MCQmedium

You are tasked with defining the 'Risk Breakdown Structure' (RBS). What is the primary purpose of this tool?

A.To list the names of all team members.

B.To calculate the final project budget.

C.To report progress to the project board.

D.To structure the identification of risks in a logical and comprehensive way.

AnswerD

An RBS provides a hierarchical, category-based framework that organises risk identification across sources such as technical, external, organisational and project management, ensuring no category is overlooked. This structured decomposition satisfies the stem's requirement for a logical, comprehensive identification approach rather than ad hoc brainstorming.

Why this answer

The Risk Breakdown Structure (RBS) is a hierarchical representation of potential risk sources, organized by category and subcategory, used to structure risk identification systematically. Its primary purpose is to ensure comprehensive risk identification by providing a framework that prompts the team to consider risks across all relevant areas. This reduces the chance of overlooking categories of risk and supports consistent categorization in the risk register.

Exam trap

The trap is confusing the RBS with the WBS or with a risk register; PMI-RMP expects candidates to know the RBS is specifically a categorization tool for structuring risk identification.

How to eliminate wrong answers

Option A is wrong because listing team members is a resource management function, not the purpose of the RBS. Option B is wrong because calculating the project budget is a cost management activity; the RBS does not perform calculations. Option C is wrong because reporting progress to the project board is a performance reporting function, unrelated to the RBS's role in risk identification.

Practice this question →

16

MCQeasy

When planning for risk management, which stakeholder is usually the final authority on risk appetite for the project?

A.The project sponsor.

B.The project manager.

C.Project team members.

D.The external auditor.

AnswerA

The project sponsor owns the business case and funding, so they hold final authority over the acceptable degree of risk exposure the project may carry. The risk manager facilitates the process, but the sponsor ratifies the risk appetite.

Why this answer

The project sponsor is the executive who funds the project and owns the business case, so they are the final authority on the project's risk appetite — the amount of risk the organization is willing to accept in pursuit of the project's objectives. The project manager and team apply that appetite but do not set it.

Exam trap

PMI-RMP often tests the governance hierarchy — candidates pick the project manager because they 'manage' risk, but the sponsor is the authority who defines how much risk is acceptable.

How to eliminate wrong answers

Option B is wrong because the project manager manages risks within the appetite defined by the sponsor and organization, but does not have the authority to set the risk appetite itself. Option C is wrong because project team members execute risk responses and provide input, but they have no organizational authority over risk tolerance. Option D is wrong because an external auditor provides independent assurance and evaluates controls, but does not define the organization's risk appetite — that is a governance function.

Practice this question →

17

MCQeasy

What is the primary purpose of defining 'Risk Roles and Responsibilities' in the Risk Management Plan?

A.To identify who gets paid more for risk management tasks.

B.To assign blame if the project fails.

C.To clarify who has the authority to approve risk responses and risk reserve usage.

D.To reduce the number of stakeholders involved in the project.

AnswerC

Defining risk roles and responsibilities establishes decision rights, specifying which individuals may authorise risk responses and draw on contingency reserves. This satisfies the stem's governance requirement by removing ambiguity over approval authority, ensuring reserve usage follows delegated thresholds rather than informal agreement.

Why this answer

Defining Risk Roles and Responsibilities in the Risk Management Plan clarifies who is accountable for identifying, analyzing, responding to, and monitoring risks, and specifically who has the authority to approve risk responses and use contingency reserves. This ensures clear decision-making and avoids delays or conflicts during risk events.

Exam trap

PMI-RMP often tests the purpose of risk roles and responsibilities, and candidates may choose options about blame or compensation because they sound like typical HR concerns; the trap is overlooking the focus on authority and accountability for risk decisions.

How to eliminate wrong answers

Option A is wrong because compensation is not the purpose of defining risk roles; it is about accountability and authority, not pay. Option B is wrong because assigning blame is counterproductive and not the intent; the focus is on proactive management, not punishment. Option D is wrong because reducing stakeholder involvement is not a goal; effective risk management often requires engaging more stakeholders, not fewer.

Practice this question →

18

Multi-Selectmedium

You are drafting the risk management plan for a high-voltage transmission line project. The project is in a regulated environment with multiple permitting authorities, and the sponsor wants the plan to clearly define how risk governance will operate. Which two elements must the risk management plan define to establish effective risk governance for this project? (Choose two.)

Select 2 answers

A.The reporting cadence and escalation thresholds for risks that exceed defined tolerance levels.

B.The detailed work breakdown structure for all construction activities.

C.The specific contingency reserve amount to be held for known risks.

D.The procurement strategy for hiring transmission tower suppliers.

E.The roles and responsibilities for risk management, including who owns, reviews, and approves risk responses.

AnswersA, E

Reporting frequency and escalation thresholds define how risk information flows to the right decision-makers when tolerances are breached. In a regulated project with multiple permitting authorities, clear escalation triggers ensure that risks threatening compliance or schedule are surfaced promptly. This is a core governance mechanism that translates risk appetite into operational decision rules.

Why this answer

Effective risk governance rests on clear accountability and clear decision rules. Defining roles and responsibilities establishes who owns, reviews, and approves risk responses, while reporting cadence and escalation thresholds translate risk tolerances into action. Together they ensure that in a regulated transmission project, permitting and compliance risks reach the appropriate authority promptly.

Reserve amounts, the work breakdown structure, and procurement strategy are outputs of other processes and do not establish governance.

Exam trap

The trap here is conflating governance content with other planning artifacts, such as reserve amounts or procurement strategy, which are related to risk but do not define decision rights or escalation.

Practice this question →

19

MCQeasy

What is the primary role of the 'Risk Owner' during the planning phase?

A.To perform all the project work.

B.To approve all project changes.

C.To fund the mitigation activities.

D.To ensure the risk is monitored and the response is executed when triggered.

AnswerD

The risk owner is the named individual accountable for watching the assigned risk throughout delivery. During planning they define the trigger conditions and confirm the agreed response can be executed, satisfying the stem's requirement for ownership beyond identification.

Why this answer

The Risk Owner is the person accountable for monitoring a specific risk and ensuring the agreed response is executed when triggers occur. During planning, this role involves understanding the risk, validating the response strategy, and preparing to act. This accountability is distinct from performing work, approving changes, or funding mitigation.

Exam trap

The trap is conflating the Risk Owner with roles like change approver or funder, causing candidates to pick options that describe other governance responsibilities.

How to eliminate wrong answers

Option A is wrong because performing all project work is the responsibility of the project team, not the risk owner, whose focus is a specific risk. Option B is wrong because change approval belongs to the Change Control Board or sponsor, not the risk owner. Option C is wrong because funding mitigation is a financial authorization typically held by the sponsor or budget owner, not the risk owner's role.

Practice this question →

20

Multi-Selectmedium

Which TWO of the following are essential components of a robust Risk Management Plan?

Select 2 answers

A.The current project budget.

B.A list of all project vendors.

C.Roles and responsibilities for risk management.

D.Risk methodology and process definitions.

E.Detailed project schedule.

AnswersC, D

Roles and responsibilities assign clear ownership for identifying, assessing and responding to risks, so accountability is unambiguous. This satisfies the stem's requirement for a robust Risk Management Plan by ensuring every risk activity has a named owner rather than diffused responsibility.

Why this answer

Option C is correct because a robust Risk Management Plan must define who is accountable for identifying, assessing, responding to, and monitoring risks, including the risk owner, risk manager, and team roles, which ensures clear ownership and escalation paths. Option D is correct because the plan must specify the risk methodology and processes to be used, such as risk identification techniques, qualitative and quantitative analysis approaches, probability/impact scales, risk tolerance thresholds, and response planning and monitoring procedures. Options A, B, and E are not essential components of a Risk Management Plan: the current project budget, a list of all project vendors, and a detailed project schedule are project artifacts that may inform risk identification but are not structural elements of the risk management plan itself.

Exam trap

PMI-RMP often tests the boundary between the Risk Management Plan (the 'how') and the Risk Register (the 'what') — candidates incorrectly select budget, schedule, or vendor artifacts that belong to other knowledge areas.

Practice this question →

21

MCQeasy

When establishing the risk management methodology, which document should be used to provide the framework and authority for risk activities?

A.Issue Log

B.Risk Management Plan

C.Stakeholder Register

D.Project Charter

AnswerB

The Risk Management Plan defines how risk activities are structured, funded and governed, and it grants the authority and framework for performing them. It is the methodology document that guides risk identification, analysis, response planning and monitoring throughout the project.

Why this answer

The Risk Management Plan is the document produced during the Plan Risk Management process that defines the risk management methodology, including the approach, tools, techniques, roles, responsibilities, budgeting, timing, and reporting formats for risk activities. It provides both the framework and the formal authority for how risk management will be conducted on the project. The Project Charter authorizes the project itself but does not detail risk methodology.

Exam trap

PMI-RMP often tests the distinction between the Project Charter (which authorizes the project) and the Risk Management Plan (which authorizes and structures risk activities), causing candidates to pick the Charter as the higher-authority document.

How to eliminate wrong answers

Option A is wrong because the Issue Log tracks and manages issues that have already occurred, not the framework or authority for proactive risk activities. Option C is wrong because the Stakeholder Register identifies stakeholders and their interests/engagement, not the methodology for risk management. Option D is wrong because the Project Charter authorizes the project and names the PM, but it does not define the risk management methodology or grant authority for risk activities.

Practice this question →

22

MCQmedium

You are the risk manager on a multi-year pharmaceutical construction program. The program sponsor has approved a risk management plan, but during the first monthly risk review you notice the team is documenting risks without linking them to the program's strategic objectives. The program director asks you to make the risk process more strategically aligned. Which action best ensures the risk management effort directly supports the program's strategic objectives?

A.Perform a Monte Carlo simulation on the program schedule to quantify strategic exposure.

B.Escalate all unresolved risks to the program steering committee for prioritization.

C.Update the Risk Breakdown Structure to reflect the program's strategic objectives and use it to guide risk identification and reporting.

D.Replace the qualitative risk assessment with a quantitative cost-risk analysis.

AnswerC

The Risk Breakdown Structure organizes risk categories hierarchically and can be tailored to mirror strategic objectives, ensuring every identified risk traces to a business goal. Using it as the framework for identification and reporting makes the linkage explicit and auditable. This directly addresses the program director's concern without adding tools that only quantify exposure.

Why this answer

Strategic alignment is achieved when the risk taxonomy mirrors the program's objectives, making traceability explicit. The Risk Breakdown Structure, when tailored to strategic goals, becomes the mechanism that guides identification, assessment, and reporting so every risk can be linked to a business outcome. Simulation, escalation, and quantitative modeling address different problems and do not create the missing strategic linkage.

Exam trap

The trap here is assuming that a more sophisticated analytical technique, such as Monte Carlo simulation, automatically improves strategic alignment when the real gap is the absence of a structured linkage between risks and objectives.

Practice this question →

23

MCQmedium

A project manager is creating a risk strategy for an international project. They realize that risk tolerance varies significantly between the parent office and the local project site. How should they resolve this?

A.Document both sets of tolerances and define a process for handling conflicts.

B.Use the local site's tolerance only.

C.Ignore the local site's preferences.

D.Ask for a new policy from the corporate board.

AnswerA

Recording both the parent office's and the local site's tolerances, plus a defined conflict-resolution process, acknowledges that tolerance genuinely differs across contexts. This satisfies the stem's constraint by giving the project manager a documented basis for deciding which threshold governs each risk.

Why this answer

When risk tolerances differ between the parent office and the local project site, the PM must not unilaterally choose one over the other. Documenting both sets of tolerances and defining a conflict-resolution process preserves transparency, respects organizational and local realities, and gives the team a repeatable way to decide which threshold applies to a given risk. This aligns with PMI-RMP guidance on documenting risk appetite/tolerance in the risk management plan and establishing escalation paths.

Exam trap

PMI-RMP often tests the misconception that one stakeholder's tolerance should simply override another's, when the correct PMI-aligned answer is to document both and define a conflict-handling process.

How to eliminate wrong answers

Option B is wrong because adopting only the local site's tolerance ignores the parent organization's governance, contractual, and strategic constraints, which can lead to risks being accepted that the enterprise cannot absorb. Option C is wrong because ignoring the local site's preferences disregards cultural, regulatory, and operational realities on the ground, undermining stakeholder buy-in and potentially violating local requirements. Option D is wrong because escalating to the corporate board for a new policy is disproportionate and slow; the PM already has the authority to document both tolerances and define a handling process within the risk management plan.

Practice this question →

24

Multi-Selectmedium

Which TWO risk planning tools are commonly used for 'qualitative' risk analysis?

Select 2 answers

A.Risk Categorization.

B.Decision Tree Analysis.

C.Monte Carlo simulation.

D.Sensitivity Analysis.

E.Probability and Impact Matrix.

AnswersA, E

Risk categorisation groups identified risks by source or impact area, directly satisfying qualitative analysis's need to prioritise risks using subjective judgement rather than numerical modelling. It feeds the probability-impact matrix and watchlist, enabling the team to focus attention on high-priority threats without quantitative simulation.

Why this answer

Risk Categorization (A) is correct because qualitative risk analysis groups risks by source or category (e.g., technical, external, organizational, or RBS-based categories) to improve understanding and response planning. The Probability and Impact Matrix (E) is correct because it is the primary qualitative tool that rates each risk's likelihood and consequence using defined scales to assign a priority or risk score. Decision Tree Analysis (B) is not correct because it is a quantitative technique using expected monetary value (EMV) to evaluate alternative courses of action.

Monte Carlo simulation (C) is not correct because it is a quantitative technique that models thousands of iterations to produce a probability distribution of outcomes. Sensitivity Analysis (D) is not correct because it is a quantitative technique (often a tornado diagram) that determines which variables most affect project outcomes.

Exam trap

PMI-RMP often tests whether candidates can separate qualitative tools (categorization, probability-impact matrix, risk data quality assessment) from quantitative tools (decision trees, Monte Carlo, sensitivity analysis); mixing the two categories is the most common error.

Practice this question →

25

MCQeasy

When planning for risk, what does the term 'Tailoring' refer to?

A.Adjusting the risk management process to fit the project's complexity and needs.

B.Reducing the project team size.

C.Changing the project scope to avoid all risks.

D.Buying specialized software.

AnswerA

Tailoring scales the risk management approach — its processes, tools, and documentation depth — to match the project's size, complexity, and risk exposure. A small, low-risk project needs lighter treatment than a large, complex one, so effort stays proportionate rather than applying a rigid, one-size-fits-all process.

Why this answer

Tailoring in risk management refers to adjusting the risk management processes, tools, and techniques to fit the specific project's size, complexity, industry, and organizational context. It ensures the risk approach is proportionate and relevant rather than applying a one-size-fits-all methodology.

Exam trap

PMI-RMP often tests whether candidates understand tailoring as deliberate process adaptation — the trap is confusing it with scope reduction, resource cuts, or tool purchases.

How to eliminate wrong answers

Option B is wrong because reducing team size is a resource decision, not a risk tailoring concept. Option C is wrong because changing scope to avoid all risks is risk avoidance at the project level, not tailoring — and avoiding all risks is neither feasible nor desirable. Option D is wrong because buying specialized software is a tool procurement decision, not the definition of tailoring the risk process.

Practice this question →

26

MCQmedium

A project manager is planning to use 'Monte Carlo Simulation' for schedule risk analysis. What does this require from the risk planning phase?

A.A verbal agreement from the team.

B.A simple list of risks.

C.Approval from the legal department.

D.Defined ranges for duration and cost, not just single-point estimates.

AnswerD

Monte Carlo simulation samples repeatedly from probability distributions, so it needs three-point or range estimates for duration and cost rather than single deterministic values. Defined ranges satisfy this input requirement, enabling probabilistic outputs such as confidence levels for schedule completion.

Why this answer

Monte Carlo simulation is a quantitative risk analysis technique that iteratively samples values from probability distributions assigned to schedule activities and cost elements. It requires three-point estimates (optimistic, most likely, pessimistic) or full probability distributions rather than single-point estimates, so that thousands of iterations can produce a probability distribution of possible project outcomes. Without defined ranges, the simulation has no variability to model and cannot generate meaningful P50, P80, or confidence-level results.

Exam trap

PMI-RMP often tests whether candidates know that Monte Carlo requires probabilistic inputs (ranges/distributions), not just a risk list — the trap is selecting the 'simple' answer that sounds sufficient but lacks quantitative data.

How to eliminate wrong answers

Option A is wrong because a verbal agreement from the team provides no quantitative input; Monte Carlo requires numeric distributions, not consensus. Option B is wrong because a simple list of risks lacks the probability distributions and duration/cost ranges the simulation needs to run iterations. Option C is wrong because legal department approval is irrelevant to the technical requirements of Monte Carlo simulation; it is a governance step, not a modeling input.

Practice this question →

27

MCQmedium

A project manager is developing the Risk Management Plan for a complex infrastructure project. The stakeholders have expressed concerns about potential financial volatility. Which action should the project manager take to align the plan with organizational expectations?

A.Assign a risk owner to every potential financial risk identified.

B.Immediately perform a qualitative risk analysis on all identified risks.

C.Define the project's risk appetite and tolerance levels with key stakeholders.

D.Update the project scope to remove high-risk components.

AnswerC

Defining risk appetite and tolerance with stakeholders directly addresses the financial volatility concern by establishing agreed thresholds for acceptable exposure. This satisfies the stem's requirement to align the Risk Management Plan with organisational expectations, since appetite and tolerance are foundational inputs that shape funding reserves, escalation triggers and response strategies.

Why this answer

The Risk Management Plan must reflect how much risk the organization is willing to accept before risk responses can be planned. Defining risk appetite (the degree of uncertainty an entity is willing to accept) and risk tolerance (the acceptable variation around objectives) with key stakeholders directly aligns the plan with organizational expectations, especially regarding financial volatility. This is a core input to Plan Risk Management per the PMBOK Guide.

Exam trap

PMI-RMP often tests the distinction between risk appetite/tolerance (strategic, set during Plan Risk Management) and risk response actions (tactical, executed later), so candidates who jump to assigning owners or analyzing risks pick the wrong process.

How to eliminate wrong answers

Option A is wrong because assigning risk owners is part of Plan Risk Responses and cannot occur before the Risk Management Plan establishes the framework, and it does not address stakeholder concerns about financial volatility. Option B is wrong because qualitative risk analysis is performed in the Identify/Analyze Risks processes after the Risk Management Plan is approved, not during its development. Option D is wrong because unilaterally removing high-risk components from scope is scope avoidance without stakeholder consultation and does not align the risk plan with organizational expectations.

Practice this question →

28

MCQhard

Your organization is implementing an 'Agile Risk Management' strategy. What is the most critical change from a traditional approach?

A.Moving from heavy documentation to lightweight, iterative risk updates.

B.Requiring board approval for every risk.

C.Replacing the project manager with a risk owner.

D.Eliminating all risk documentation.

AnswerA

Agile risk management replaces comprehensive risk registers and periodic formal reviews with lightweight, iterative updates embedded in each sprint or iteration. This continuous cadence lets teams surface and respond to emerging risks quickly, satisfying the strategy's demand for faster, less documentation-heavy risk handling.

Why this answer

Agile risk management replaces the traditional heavy, phase-gated risk documentation cycle with lightweight, iterative practices: risks are identified and re-ranked every sprint or iteration, often on a visible risk board or backlog, and burn-down style tracking replaces formal risk reports. The emphasis shifts from producing a comprehensive risk management plan up front to continuously adapting as new information emerges. This cadence change is the defining difference from traditional plan-driven risk management.

Exam trap

The trap is the absolutist wording in options like 'eliminating all risk documentation' or 'requiring board approval for every risk'; PMI-RMP tests whether candidates recognize that agile changes the cadence and weight of risk work, not whether it removes governance or documentation entirely.

How to eliminate wrong answers

Option B is wrong because requiring board approval for every risk is bureaucratic and anti-agile; agile teams push risk decisions to the lowest responsible level and only escalate when a risk exceeds the team's authority or tolerance. Option C is wrong because agile does not replace the project manager with a risk owner; the Scrum Master or product owner role persists, and risk ownership is distributed among team members rather than substituted for a leadership role. Option D is wrong because agile does not eliminate risk documentation; it makes documentation lightweight and just-enough, but risks are still recorded on the risk backlog, in sprint reviews, and in retrospectives.

Practice this question →

29

MCQhard

You are leading a project where the stakeholders have a 'neutral' risk attitude. Which risk strategy is most appropriate for this environment?

A.Accept all risks without analysis.

B.Outsource everything to external experts.

C.Avoid all risks regardless of cost.

D.Perform balanced analysis to ensure risks are treated proportionally to their impact.

AnswerD

Neutral stakeholders neither seek nor avoid risk, so neither aggressive exploitation nor heavy avoidance fits. Balanced analysis weighs each risk's probability and impact, applying responses proportional to exposure, which matches a neutral appetite rather than uniformly maximising or minimising risk.

Why this answer

A neutral risk attitude means the organization neither seeks nor avoids risk but evaluates it on its merits, so the appropriate approach is balanced analysis that treats each risk proportionally to its impact. This aligns with the PMI-RMP principle of tailoring risk responses to the organization's risk appetite and tolerance. Option D reflects that measured, proportionate treatment rather than blanket acceptance or avoidance.

Exam trap

PMI-RMP often tests the confusion between risk attitude (averse, neutral, seeking) and risk response strategies (avoid, transfer, mitigate, accept), so candidates incorrectly pick a response strategy when the question is really asking about the decision-making posture.

How to eliminate wrong answers

Option A is wrong because accepting all risks without analysis is the behavior of a risk-seeking or risk-tolerant attitude taken to an extreme, and it ignores the 'proportional to impact' requirement of neutral risk management. Option B is wrong because outsourcing everything to external experts is a risk transfer strategy, not a response to a neutral risk attitude, and it is not universally appropriate or cost-effective. Option C is wrong because avoiding all risks regardless of cost reflects a risk-averse attitude, which contradicts the neutral stance that weighs risk against opportunity and cost.

Practice this question →

30

Multi-Selectmedium

Which THREE criteria are commonly used to score risks during qualitative analysis?

Select 3 answers

A.The office address.

B.The age of the project manager.

C.Probability of occurrence.

D.Impact on project objectives.

E.Urgency of the response required.

AnswersC, D, E

Probability of occurrence directly satisfies the likelihood dimension that qualitative risk scoring requires, letting assessors rank each risk by how likely it is to happen. Combined with impact and detectability, it forms the standard scoring triad, enabling prioritisation without quantitative modelling. This criterion is fundamental to any PMI-RMP qualitative assessment.

Why this answer

Qualitative risk analysis scores each identified risk by combining two core dimensions: the likelihood that the risk event will happen, which is option C, probability of occurrence, and the severity of its effect on scope, schedule, cost, or quality, which is option D, impact on project objectives. These two factors are typically multiplied on a probability-impact matrix to produce a relative risk score that drives prioritization. Option E, urgency of the response required, is also a common qualitative scoring criterion because risks needing near-term action (for example, those with short response windows or imminent triggers) are rated higher so they can be escalated and addressed first.

Options A and B are not risk-scoring criteria: an office address is irrelevant to the likelihood or consequence of a project risk, and the project manager's age has no bearing on risk exposure or prioritization.

Exam trap

PMI-RMP often tests whether candidates can distinguish qualitative scoring criteria (probability, impact, urgency) from irrelevant personal or logistical factors, so distractors like office address or PM age are designed to be obviously wrong but test process discipline.

Practice this question →

31

MCQmedium

A project is utilizing a 'Risk-Adjusted Schedule'. What does this imply about the project's risk planning?

A.The schedule was created by a software tool without human input.

B.The schedule accounts for identified risks via time buffers or logic changes.

C.The schedule has no risks involved.

D.The schedule is fixed and cannot be changed.

AnswerB

A risk-adjusted schedule incorporates contingency reserves or buffer durations and may reorder activities to reflect identified risk exposure. The buffers absorb potential delays from realised threats, so the baseline reflects risk rather than assuming none occurs.

Why this answer

A Risk-Adjusted Schedule is a project schedule that has been deliberately modified to reflect the impact of identified risks and agreed-upon risk responses. This is typically achieved by adding time buffers (such as contingency reserves or feeding buffers) or by altering the logical sequence of activities (e.g., adding lag, changing dependencies, or re-sequencing work) to reduce the probability or impact of risk events. In PMI's risk management framework, this schedule is an output of the Plan Risk Responses process and is used to establish a realistic baseline that accounts for uncertainty rather than assuming a risk-free environment.

Exam trap

PMI-RMP often tests the misconception that a Risk-Adjusted Schedule simply means adding extra time (padding) without linking it to identified risks or logic changes, or that it implies a schedule with no risks or a fixed baseline.

How to eliminate wrong answers

Option A is wrong because a Risk-Adjusted Schedule is not defined by whether a software tool created it; even automated schedules require human input to identify risks and define responses, and the term refers to the content of the schedule, not its creation method. Option C is wrong because no project schedule can be completely free of risks; the Risk-Adjusted Schedule explicitly acknowledges and incorporates risks, so claiming it has no risks contradicts the definition. Option D is wrong because a Risk-Adjusted Schedule is not fixed; it is a dynamic baseline that can be updated as risks materialize or change, and it is specifically designed to allow for adjustments through buffers and logic changes.

Practice this question →

32

Multi-Selectmedium

Which THREE categories are typically found in a standard Risk Breakdown Structure (RBS)?

Select 3 answers

A.External risk category.

B.The color preference category.

C.Technical risk category.

D.Management risk category.

E.The lunch break category.

AnswersA, C, D

External risk covers uncertainties outside the project team's control, such as regulatory, market, supplier and environmental factors. It forms a standard RBS category because these sources require distinct response strategies and ownership separate from internal technical or management risks.

Why this answer

In a standard Risk Breakdown Structure (RBS), risks are organized into hierarchical categories, and the External risk category (A) is correct because it captures risks originating outside the project team's control, such as regulatory, market, weather, or supplier-related risks. The Technical risk category (C) is correct because it covers risks tied to requirements, technology, design, interfaces, and performance, which are core technical sources of project uncertainty. The Management risk category (D) is correct because it addresses risks from project management processes such as estimating, planning, resourcing, communication, and control.

The color preference category (B) and the lunch break category (E) are not recognized RBS risk categories; they are irrelevant to standard risk classification and do not represent sources of project risk.

Exam trap

The trap is including non-risk operational or trivial items as RBS categories, so candidates must distinguish genuine risk source categories from irrelevant distractors.

Practice this question →

33

Multi-Selecthard

Which TWO factors should be documented in a 'Risk Management Plan' to ensure successful stakeholder buy-in?

Select 2 answers

A.The names of every person on the project.

B.Accessible and clear reporting mechanisms.

C.A promise that no risks will occur.

D.The amount of money the project manager is paid.

E.The value and benefits of risk management to the project.

AnswersB, E

Clear, accessible reporting mechanisms let stakeholders see risk status, ownership, and escalation paths without chasing updates, which sustains their engagement throughout the project. This satisfies the stem's buy-in requirement by making the risk process transparent and accountable rather than opaque.

Why this answer

Option B is correct because a Risk Management Plan must define accessible and clear reporting mechanisms — the communication paths, formats, frequency, and escalation routes (e.g., risk register reviews, status reports) — so stakeholders know how risks will be surfaced and tracked, which builds the transparency and trust needed for buy-in. Option E is correct because documenting the value and benefits of risk management to the project articulates the business case — how proactive risk handling protects schedule, cost, scope, and quality — giving stakeholders a concrete rationale to support and fund the risk process. The remaining options do not belong: A (listing every person's name) is a resource/stakeholder register detail, not a risk management factor; C (promising no risks will occur) is unrealistic and contradicts the purpose of risk management; and D (the project manager's pay) is irrelevant confidential compensation data with no bearing on stakeholder buy-in.

Exam trap

The trap is selecting options that seem like good project management practices (A, D) but are not relevant to stakeholder buy-in or are not part of the Risk Management Plan, while missing the communication and value proposition elements that directly address buy-in.

Practice this question →

34

MCQhard

A project manager is facing pushback from a functional manager who refuses to allocate resources to risk response activities. What is the most appropriate risk strategy planning response?

A.Remove the identified risks from the risk register.

B.Escalate the issue to the project board for a decision on resource prioritization.

C.Accept all risks without mitigation.

D.Lower the probability rating of the risks associated with those resources.

AnswerB

Escalation suits this scenario because the functional manager sits outside the project manager's authority, so resource prioritisation must be decided at portfolio or governance level. The project board holds the mandate to arbitrate competing demands across functions, satisfying the constraint that the risk response requires resources the project manager cannot command directly.

Why this answer

When a functional manager refuses to allocate resources for risk responses, the issue exceeds the project manager's authority because it involves cross-functional resource prioritization. Escalating to the project board (or sponsor/steering committee) is the appropriate risk strategy response, as escalation is a recognized PMI risk response strategy for risks outside the project manager's control. The board can make an organizational-level decision on resource trade-offs.

Exam trap

PMI-RMP often tests the misconception that project managers should resolve resource conflicts unilaterally or alter risk data to avoid escalation, when the correct action is to escalate risks beyond their authority.

How to eliminate wrong answers

Option A is wrong because removing risks from the register does not eliminate them; it merely hides them, which is a documentation failure and violates the integrity of the risk management process. Option C is wrong because accepting all risks without mitigation is a passive strategy that is only appropriate for low-priority risks and ignores the project manager's duty to plan responses for significant threats. Option D is wrong because lowering probability ratings to avoid conflict is data manipulation that falsifies the risk analysis and leads to under-reserved budgets and schedules.

Practice this question →

35

Multi-Selecthard

Which THREE factors influence the choice of a 'risk management methodology' for a project?

Select 3 answers

A.Project complexity and uncertainty level.

B.Organizational risk management maturity.

C.The project office's desk arrangement.

D.Project governance and regulatory requirements.

E.The project manager's favorite color.

AnswersA, B, D

Greater project complexity and uncertainty demand more elaborate, iterative risk processes, such as quantitative analysis and frequent reassessment, rather than a simple checklist. This directly shapes methodology selection because the chosen approach must match the scale of ambiguity the project faces.

Why this answer

Option A is correct because project complexity and uncertainty level directly determine how much structure the risk methodology needs — highly complex, uncertain projects require more formal, iterative approaches such as quantitative analysis and continuous risk reassessment, while simple projects can use lighter methods. Option B is correct because organizational risk management maturity dictates which methodologies are feasible and sustainable; an organization with immature processes cannot effectively adopt advanced techniques like Monte Carlo simulation or detailed risk registers without foundational capability. Option D is correct because project governance and regulatory requirements impose mandatory risk processes, documentation, and compliance standards (e.g., ISO 31000, PMBOK, or industry-specific regulations) that constrain and shape the selected methodology.

Option C is incorrect because a project office's desk arrangement is a physical workspace detail with no bearing on risk management methodology selection. Option E is incorrect because a project manager's favorite color is a personal preference irrelevant to professional risk management decisions.

Exam trap

PMI-RMP often tests the factors influencing methodology selection, and candidates may be distracted by irrelevant options (like desk arrangement or favorite color) that are obviously nonsensical, but they might also overlook governance as a key factor.

Practice this question →

36

MCQmedium

You are selecting a risk management methodology for a high-security government project. Which factor is most important to consider?

A.The cost of the software tools used.

B.The speed of risk identification.

C.The flexibility to change the process daily.

D.The level of formal governance, documentation, and compliance required.

AnswerD

High-security government projects demand rigorous formal governance, documentation and compliance, so the methodology must support these constraints. Selecting one that matches this level of formality ensures auditability and regulatory adherence, which outweighs flexibility or speed considerations.

Why this answer

For a high-security government project, the dominant consideration when selecting a risk methodology is the level of formal governance, documentation, and compliance required. Government projects typically must satisfy regulatory frameworks (e.g., FISMA, FedRAMP, DoD standards), so the methodology must support audit trails, formal approvals, and rigorous documentation.

Exam trap

PMI-RMP often tests whether candidates prioritize governance and compliance over cost or speed in regulated environments — the trap is selecting the 'efficient' or 'cheap' answer when the scenario signals high-security or regulatory oversight.

How to eliminate wrong answers

Option A is wrong because software tool cost is a minor procurement consideration and does not drive methodology selection for a high-security context. Option B is wrong because speed of risk identification, while useful, is subordinate to compliance and governance requirements in a regulated environment. Option C is wrong because flexibility to change the process daily is the opposite of what a high-security project needs — it requires stability, repeatability, and auditability, not daily process churn.

Practice this question →

37

MCQhard

A PMO is standardizing risk management across multiple projects. They want to ensure that risk appetite is consistent across the organization. What is the most effective approach?

A.Only allow senior management to identify risks.

B.Publish an Enterprise Risk Management (ERM) policy that defines standard risk tolerance levels.

C.Mandate the use of a single, complex quantitative software tool.

D.Require all project managers to define their own risk appetite.

AnswerB

An ERM policy codifies organisation-wide risk tolerance levels, giving every project a common benchmark for evaluating and prioritising risks. This directly satisfies the PMO's goal of consistent risk appetite across multiple projects rather than relying on per-project judgement.

Why this answer

An Enterprise Risk Management (ERM) policy defines the organization's risk appetite, tolerance levels, and standard risk processes, ensuring consistency across all projects and aligning with strategic objectives. Publishing such a policy is the most effective way to standardize risk appetite across multiple projects and the organization as a whole.

Exam trap

PMI-RMP often tests the difference between risk appetite and risk tolerance, and candidates may incorrectly think that individual project managers should define their own appetite, rather than following an enterprise-wide policy.

How to eliminate wrong answers

Option A is wrong because restricting risk identification to senior management excludes valuable input from project teams and stakeholders, and does not ensure consistent risk appetite. Option C is wrong because mandating a single complex quantitative tool does not address risk appetite consistency; tools are enablers, not policies, and may not suit all projects. Option D is wrong because allowing each project manager to define their own risk appetite leads to inconsistency and defeats the purpose of standardization.

Practice this question →

38

MCQeasy

In the context of the Risk Management Plan, what is a 'Risk Threshold'?

A.The start date of the risk assessment phase.

B.A value that triggers a specific risk response or escalation path.

C.The total budget allocated to the project.

D.The maximum number of risks allowed in the register.

AnswerB

A risk threshold is a predefined measurable value that, once breached, triggers a specific response or escalation path defined in the Risk Management Plan. It differs from risk appetite, which expresses overall willingness to accept risk, by being an actionable, quantified trigger for escalation.

Why this answer

A Risk Threshold is a predefined value or level of risk exposure (e.g., cost, schedule, or quality impact) that, when reached or exceeded, triggers a specific risk response or escalation to a higher authority. It is documented in the Risk Management Plan and helps determine when a risk is no longer acceptable and requires action. For example, a threshold might state that any risk with a potential cost overrun greater than $50,000 must be escalated to the project sponsor.

Thus, it acts as a decision trigger, not a date, budget total, or register limit.

Exam trap

PMI-RMP often tests the confusion between risk threshold and other project constraints like budget, schedule, or risk register limits, so candidates must remember that a threshold is a trigger value for risk response, not a general project parameter.

How to eliminate wrong answers

Option A is wrong because the start date of the risk assessment phase is a schedule milestone, not a threshold; thresholds are about risk exposure levels, not timing. Option C is wrong because the total budget allocated to the project is a financial baseline, not a risk threshold; thresholds define acceptable risk limits, not overall funding. Option D is wrong because the maximum number of risks allowed in the register is an arbitrary limit, not a threshold; risk thresholds are about impact or probability values that trigger responses, not a count of risks.

Practice this question →

39

MCQhard

Your organization is transitioning to a hybrid methodology. During risk management planning, you must select an approach that accommodates both Agile delivery and Waterfall governance. Which strategy is most effective?

A.Use a central Risk Register managed exclusively by the PMO.

B.Tailor the Risk Management Plan to include iterative risk review sessions during sprint planning.

C.Adopt a purely Waterfall risk register for all work packages.

D.Eliminate the Risk Management Plan to reduce bureaucratic overhead.

AnswerB

Tailoring the Risk Management Plan embeds iterative risk reviews within sprint planning, satisfying the hybrid constraint of Agile delivery alongside Waterfall governance. This preserves the formal, documented plan that governance requires while enabling frequent reassessment, so emerging risks surface each sprint rather than only at phase gates.

Why this answer

In a hybrid methodology, the Risk Management Plan must be tailored to integrate both Agile and Waterfall practices. Including iterative risk review sessions during sprint planning accommodates Agile's adaptive nature while maintaining governance through the overall plan. This approach ensures risks are continuously identified and addressed in short cycles.

Exam trap

The trap is choosing an extreme approach (A, C, or D) that favors one methodology over the other, whereas PMI-RMP expects a tailored, integrated approach that leverages the strengths of both Agile and Waterfall.

How to eliminate wrong answers

Option A is wrong because a central Risk Register managed exclusively by the PMO may create bottlenecks and reduce team ownership, which is contrary to Agile principles of self-organizing teams. Option C is wrong because adopting a purely Waterfall risk register for all work packages ignores the iterative nature of Agile delivery and may not capture emergent risks. Option D is wrong because eliminating the Risk Management Plan reduces governance and oversight, which is necessary for Waterfall governance and overall project success.

Practice this question →

40

MCQhard

During planning, you identify that your project relies on a 'Single Point of Failure' (SPOF) in the supply chain. What is the best strategy to integrate into your plan?

A.Add the SPOF to the risk register with a mitigation strategy to develop secondary suppliers.

B.Reduce the project scope immediately.

C.Accept the risk and hope it does not materialize.

D.Ignore the risk because it is external.

AnswerA

Documenting the single point of failure in the risk register with a mitigation to develop secondary suppliers directly addresses the supply chain vulnerability. This converts the identified SPOF into a tracked, owned risk with a planned response, satisfying the planning requirement rather than leaving it unmanaged.

Why this answer

A Single Point of Failure in the supply chain is a classic risk that must be captured in the risk register and addressed with a proactive response. Developing secondary suppliers is a mitigation strategy that reduces the probability and impact of supply disruption by removing the single-source dependency. This integrates risk management into planning rather than reacting after the failure occurs.

Exam trap

PMI-RMP often tests whether candidates recognize that external risks still belong in the risk register, so the trap is picking 'ignore because external' or 'accept and hope' instead of a documented mitigation.

How to eliminate wrong answers

Option B is wrong because reducing scope is a drastic, unvalidated response that does not address the root cause of the SPOF and may destroy project value without any risk analysis. Option C is wrong because 'accept and hope' is not a strategy — passive acceptance without analysis or contingency reserves is risk negligence, not risk management. Option D is wrong because external risks are still project risks; PMI explicitly requires external risks to be identified, analyzed, and responded to in the risk register.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Risk Strategy And Planning questions.

Start 20-question session