Risk

Question 1

1. You are working on the Plan Risk Management process to decide how to approach, plan, and execute risk management activities. All of the following are inputs to the Plan Risk Management process EXCEPT:
A. Stakeholder register
B. Project charter
C. Risk register
D. Project management plan

Answer 1

1. C: The risk register is an output of the Identify Risks process.

Question 2

2. You are delivering specialized medical equipment, which is worth $600,000. You have
   been delivering equipment for a while without much hassle or accidents in the past.
   This time you estimate that there is a 5 percent probability that the equipment could be
   damaged or lost. While exploring the possibility of transferring this risk to an insurance
   company, you found out the insurance premium is $15,000. What will be your BEST
   course of action?
   A. You do not have much information to make a decision.
   B. Do not buy the insurance premium.
   C. Develop a contingency plan.
   D. Buy the insurance premium.

Answer 2

2. D: The cost of probable loss or damage is $600,000 times 5 percent, which equals
   $30,000. The cost of the insurance premium is $15,000; therefore, you should purchase the insurance premium.

Question 3

3. Which one of the following is contained in the risk management plan and describes a
risk category?
A. Risk response plan
B. Risk Breakdown Structure (RBS)
C. Risk register
D. Watch list

Answer 3

3. B: Risk categories are a group of potential causes for risk and can be grouped into categories, such as technical, political, external, project, and environmental. In order to systematically identify risks to a consistent level of detail, we can use the form of a simple list of categories or a Risk Breakdown Structure (RBS). It’s a comprehensive way of ordering risks according to their source.

Question 4

4. You are working on a very critical and strategic project to develop a robust dynamic
   website, which will be available to approximately five million users your company
   has around the globe. You decided to survey the experts within your organization
   on any foreseeable risks with the design, structure, and intent of the website with an
   anonymous, simple form. You later sent out subsequent anonymous surveys to a group of experts with the collected information. This is an example of:
   A. A Delphi technique
   B. Identify Risks process
   C. Nominal group technique
   D. SWOT analysis

Answer 4

4. A: The Delphi technique is mainly focused on preventing group thinking and finding out the true opinions of the participants. This is done by sending a request for information to experts who are participating anonymously, compiling their responses, and sending the results back to them for further review until a consensus is reached.

Question 5

5. You are the project manager of a data center project. You have just completed an
   analysis of project risks and have prioritized them using a probability and impact matrix.
   The approach you used to prioritize the risks is:
   A. Qualitative analysis
   B. Quantitative analysis
   C. Sensitivity analysis
   D. Earned value analysis

Answer 5

5. A: Perform Qualitative Risk Analysis is the process of prioritizing risks by assessing and combining their probability of occurrence and impact to the project if they occur. This fast, relatively easy to perform, and cost effective process ensures that the right emphasis is on the right risk areas as per their ranking and priority and helps to allocate adequate time and resources for them. This process utilizes the experience of subject matter experts, functional managers, best practices, and previous project records. Even though numbers are used for the rating in Perform Qualitative Risk Analysis, it is a subjective evaluation and should be performed throughout the project.

Question 6

6. Which one of the following is a comprehensive way of ordering risks according to their source?
A. Product description
B. Risk categories
C. Assumptions
D. Constraints

Answer 6

6. B: Risk categories are a group of potential causes for risk that can be grouped into
   categories, such as technical, political, external, project, and environmental. In order
   to systematically identify risks to a consistent level of detail, we can use the form of a
   simple list of categories or a Risk Breakdown Structure (RBS). Assumptions are information not generally considered to be based on factual data items and should be verified. Constraints are limitations that should be considered when developing project plans. The product description provides details about the complexity of the product to be delivered.

Question 7

7. You are overseeing a project to implement an accounting application and are currently
   in the Identify Risks process of identifying and documenting the project risks. All of the
   following are tools & techniques for the Identify Risks process EXCEPT:
   A. Information gathering techniques
   B. Assumptions analysis
   C. Diagramming techniques
   D. Monte Carlo simulation

Answer 7

7. D: Monte Carlo simulation is associated with the Perform Quantitative Risk Analysis process and determines the impact of identified risks by running simulations to identify the range of possible outcomes for a number of scenarios.

Question 8

8. Your team is performing a quantitative risk analysis using the Monte Carlo simulator. Which one of the following statements is FALSE about this Monte Carlo analysis?
   A. It translates the uncertainties specified at a detailed level into their potential impact on project objectives at the level of the whole project.
   B. It is a modeling technique that computes project costs one time.
   C. It involves determining the impact of the identified risks by running simulations to identify the range of possible outcomes for a number of scenarios.
   D. It usually expresses its results as probability distributions of possible costs.

Answer 8

8. B: Monte Carlo simulation generates information through iterations. Project information at the activity level is chosen at random during the process and produces data that illustrates the likelihood of achieving specific cost or schedule targets.

Question 9

9. One of your hardware vendors sends you an e-mail stating that due to severe weather
   she may not be able to deliver the networking equipment on time. Which of the following statements is TRUE?
   A. This is a residual risk.
   B. This is a risk trigger.
   C. This is a risk event.
   D. This is a secondary risk.

Answer 9

9. B: Risk triggers are symptoms or warning signs that a potential risk is about to occur
   within the project. For instance, a key team member searching for a better job opportunity is a warning sign that the person may be leaving the team soon, causing schedule delay, increased cost, and other issues. Risk events are actual occurrences of an identified risk event. Residual risks are the remaining risks after the execution of risk response planning and for which contingency and fallback plans can be created. Secondary risks are new risks created by implementing the selected risk response strategies.

Question 10

10. You have identified several problems along with their causes in your web-based
    application development project. Which one of the following have you probably used to
    show the problem and its causes and effects?
    A. Ishikawa diagram
    B. System flow diagram
    C. Process diagram
    D. Histogram

Answer 10

10. A: The Ishikawa diagram, also called a cause and effect flow chart or a fishbone diagram, shows the relationship between the causes and effects of problems.

Question 11

11. Your team is performing a risk probability and impact assessment for each risk to
    investigate the likelihood and potential effect on the project objectives, such as time,
    cost, scope, and quality. What process are you in:
    A. Plan Risk Management
    B. Identify Risks
    C. Perform Qualitative Risk Analysis
    D. Monitor Risks

Answer 11

11. C: Perform qualitative risk analysis is done by looking at the risk likelihood and effect to rank them.

Question 12

12. Expected Monetary Value (or simply expected value) is a statistical concept that
    calculates the average outcome of a decision. The two dimensions of risk used to
    determine this expected value are:
    A. Probability and threshold
    B. Probability and tolerance
    C. Consequence and contingencies
    D. Probability and impact

Answer 12

12. D: Risk ratings are determined by the product of probability and impact or consequences when using qualitative analysis and to determine Expected Monetary Value (EMV) when utilizing a decision tree (quantitative analysis). EMV is the product of the probability and consequences of an event or task.

Question 13

13. While overseeing a complex software project to develop a sophisticated golf simulator for a local golf club, you realize that the team is lacking the required technical expertise and experience. You also do not have the required tools and development environment for this kind of complicated software development. After discussing with the sponsor, you decide to give the design and development work to a vendor who specializes in the specific technical area. This is an example of:
A. Passive acceptance
B. Active acceptance
C. Risk avoidance
D. Risk transfer

Answer 13

13. D: Transferring is shifting the negative impact of a threat, along with the ownership of the response, to a third party to make it their responsibility. It only gives another party responsibility for its management but does not eliminate the risk. It nearly always involves payment to the third party for taking on the risk. Risk mitigation simply means
    a reduction in the probability and/or impact of an adverse risk event to an acceptable
    threshold. Since it is seldom possible to eliminate all risks and also since the cost or impact of avoid, transfer, and mitigate is too high, acceptance can be the preferred strategy. It indicates that the project team is simply accepting the risk and will continue with the project. Passive acceptance requires no action. The active acceptance strategy aims to establish contingency reserves to handle threats. Avoid indicates that you are eliminating the threat by eliminating the root cause of the threat.

Question 14

14. Steve, a project manager, has a robust risk response plan for his ERP implementation project. The team has utilized all of the appropriate tools & techniques and has executed
    the predefined preventive and contingency actions to respond to identified project risks. He finds out that some of the risks have been reduced in impact but still remain as potential threats. Steve decides to develop additional contingency and fallback plans for
    these risks as soon as possible. These risks are called:
    A. Secondary risks
    B. Residual risks
    C. Primary risks
    D. Workarounds

Answer 14

14. B: Residual risks are the risks that remain after the execution of risk response planning and for which contingency and fallback plans can be created. Their probability and impact have been reduced through mitigation. These risks are included in the outputs of the Plan Risk Responses process and are expected to remain as threats. Primary risks included in the initial risk identification process are generally most obvious. Secondary risks are new risks that are created due to the implementation of selected risk response strategies. Workarounds are unplanned responses developed to deal with the occurrence of unanticipated risk events.

Question 15

15. You are in the Monitor Risks process of identifying, analyzing, and planning for newly arising risks, keeping track of identified risks, reanalyzing existing risks, monitoring trigger conditions, monitoring residual risks, and reviewing the execution and effectiveness of risk responses. Outputs from the Monitor Risks process include all of the
following EXCEPT:
A. Variance and trend analysis
B. Work performance information
C. Change requests
D. Project management plan updates

Answer 15

15. A: Variance and trend analysis are tools & techniques used in the Monitor Risks process.

Question 16

16. Designing redundancy in the system, taking early action, adopting less complex
    processes, conducting more tests, and developing prototypes are all examples of:
    A. Risk avoidance
    B. Risk transfer
    C. Risk mitigation
    D. Risk acceptance

Answer 16

16. C: These are all examples of risk mitigation. Risk mitigation simply means a reduction in the probability and/or impact of an adverse risk event to an acceptable threshold. Transferring is shifting the negative impact of a threat, along with the ownership of the response, to a third party to make it their responsibility. An example of this would be insurance bonds, warranties, guarantees, and contracts. Avoidance is eliminating the threat by eliminating the cause or changing the project management plan. An example
    of this would be using a slower, but reliable, technology instead of a cutting-edge one
    to avoid associated risk. Since it is seldom possible to eliminate all risks and also since
    the cost or impact of avoid, transfer, and mitigate is too high, acceptance can be the
    preferred strategy. It indicates that the project team is simply accepting the risk and will
    continue with the project.

Question 17

17. You are the project manager assigned to a critical project that requires you to handle project risk intentionally and methodically, so you have assembled only the project team. The team has identified thirty-two potential project risks, determined what would trigger the risks, and have rated and ranked each risk using a risk rating matrix. You have also reviewed and verified all documented assumptions from the project team and verified the sources of data used in the process of identifying and rating the risks. You are continuing to move through the risk management process. Which one of the
    following important steps have you missed?
    A. Engage other stakeholders.
    B. Conduct a Monte Carlo simulation.
    C. Determine which risks are transferable.
    D. Determine the overall riskiness of the project.

Answer 17

17. A: Stakeholders may be great contributors for identifying potential risks in the project. You should have involved other stakeholders instead of only working with the team members on risk management activities.

Question 18

18. You are managing the construction of a disaster center for a financial institute. After the preliminary survey, you found out that the location that was selected for the disaster center was highly prone to earthquakes. You raised your concern to management, but due to a specific strategic reason you were told that changing the location would not be
    an option. In order to deal with this situation, you have selected a specific architectural
    design that is technologically advanced and earthquake resistant. This is an example of
    which of the following?
    A. Accept risk
    B. Transfer risk
    C. Avoid risk
    D. Mitigate risk

Answer 18

18. D: Since you are taking action to lower the probability and impact of the risk, you are
    mitigating the risk.

Question 19

19. During the initial stage of project planning, you made a guess that all the construction
    materials such as sand, cement, concrete, rods, and other items would be available
    within a reasonable price during building construction. While identifying the risk in your
    project, you found out that the price for cement significantly increased due to heavy
    demand and less supply. You decided to add this as a new risk in your project. This is an
    example of:
    A. Assumptions analysis
    B. Diagramming techniques
    C. SWOT analysis
    D. Expert judgment

Answer 19

19. A: This is an example of assumptions analysis. This is an analysis of the validity of assumptions, hypotheses, and scenarios developed in project initiation to identify risks from inaccuracies, incompleteness, and inconsistencies of assumptions. The assumptions that turn out to be invalid should be evaluated, qualitatively and quantitatively analyzed, and planned for just like other risks.

Question 20

20. Steve, an IT project manager, is overseeing a project to develop a new wireless media streaming device. He is using a fishbone diagram to figure out what could cause potential risks to his project. Which one of the following risk management processes is he in now?
A. Plan Risk Management
B. Identify Risks
C. Perform Qualitative Risk Analysis
D. Monitor Risks

Answer 20

20. B: The diagramming techniques such as Ishikawa diagrams, and system or process flow charts, are used as tools & techniques in the Identify Risks process. An influence diagram shows how a set of influencers may influence others and affect outcomes. For instance, a delay in receiving equipment may influence other factors, such as triggering overtime work or a quality issue due to a lack of time to perform tasks.

Question 21

21. You have been working on the Plan Risk Management process of establishing the
    basis to approach, plan, and execute risk management activities and have developed
    a risk management plan. Which one of the following will NOT be included in your risk
    management plan?
    A. Methodology: Defines approaches, tools, and data sources for risk management.
    B. Roles and Responsibilities: Defines the roles and responsibilities and sometimes
    includes non-team members who may have certain roles in risk management.
    C. Identified Risks: A list of identified risks in the project.
    D. Risk Categories: A group of potential causes for risk that can be grouped into
    categories, such as technical, political, external, project, environmental, and others.

Answer 21

21. C: A list of identified risks will be included in the risk register, not in your risk management plan.

Question 22

22. Which one of the following will NOT be considered a valid way of reducing risks in your project?
    A. Plan to mitigate the risk.
    B. Develop a workaround.
    C. Select a specific contract type to distribute risk between the buyer and the seller.
    D. Hire expert team members.

Answer 22

22. B: Workarounds, unplanned responses developed to deal with the occurrence of unanticipated risk events, are not valid ways of reducing risks in a project.

Question 23

23. You are in the Plan Risk Responses process of developing options and actions to reduce threats and enhance opportunities to your project objectives. The tools & techniques of the Plan Risk Responses process include:
A. Risk audits
B. Avoid, transfer, mitigate, and accept
C. Technical performance measurement
D. Variance and trend analysis

Answer 23

23. B: Risk audits, technical performance measurement, and variance and trend analysis
    are tools & techniques used in the Monitor Risks process. Strategies for negative risks or
    threats such as avoid, transfer, mitigate, and avoid are used as tools & techniques in the
    Plan Risk Responses process.

Question 24

24. You planned a trip to a destination four hundred miles away from home. You found out that there is a long stretch of construction on one of the major highways that you are planning to use. You decide to use another highway for that stretch of driving so that you do not have to wait too long in traffic. This is an example of:
A. Avoiding risk
B. Creating contingency reserves
C. Creating a workaround
D. Creating a fallback plan

Answer 24

24. A: Risk avoidance is the elimination of the threat by eliminating the cause or changing the project management plan. This is an example of avoidance since you are changing your travel plan to eliminate the threat of traffic delay.

Question 25

25. Your team has identified several risks in the project as well as their probability, impact, and priorities. The team is now exploring the response strategies to risks if they occur. The team identified that a couple of the programmers on the team might leave, which would significantly impact the project, but they decided to deal with it if and when it occurs. Which one of the following statements is true?
A. This is acceptance.
B. This is transfer.
C. This is risk avoidance.
D. This is risk mitigation.

Answer 25

25. A: Since it is seldom possible to eliminate all risks and also since the cost or impact of avoid, transfer, and mitigate is too high, acceptance can be the preferred strategy. It indicates that the project team is simply accepting the risk and will continue with the project. The team has decided to go for acceptance, which requires no action.

Question 26

26. You are overseeing a project to implement a smartphone application and are currently in the Identify Risks process of identifying and documenting the project risks. While exploring the elements of the enterprise environmental factors as inputs to the Identify Risks process, your team will be exploring all of the following elements EXCEPT:
A. Organizational risk attitudes
B. Commercial databases
C. Assumptions analysis
D. Published checklist

Answer 26

26. C: Assumptions analysis is a tool & technique in the Identify Risks process, not an input.

Question 27

27. You have been working on the Plan Risk Management process of establishing the basis to approach, plan, and execute risk management activities and have developed a risk management plan. Each of the following statements is true regarding the Plan Risk
    Management process EXCEPT:
    A. The risk management plan, which is a part of the overall project management plan,
    is an input to all other risk processes.
    B. The risk management plan includes a description of the responses to risks and
    triggers.
    C. The risk management plan is an output of the Plan Risk Management process.
    D. The risk management plan includes methodology, roles and responsibilities,
    budget, risk categories, definition of risk probability and impact, revised stakeholder
    tolerances, reporting formats, and other items.

Answer 27

27. B: The Plan Risk Management process establishes the basis to approach, plan, and
    execute risk management activities throughout the life of the project and develops the
    risk management plan. The risk management plan does not include a description of the responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.