PMI PMI Certifications PMI-RMP Questions & Answers

• Question 451:

  An organization with a large computer network identified a potential cyber security threat. Although certain measures were implemented to avoid the risk, the cyber security threat occurs. The measures were partially successful and a new unforeseen risk emerges.

  What should the risk owner do?

  A. Develop an efficient network protection solution quickly to mitigate the risk.

  B. Escalate the case to the risk manager and wait for their instructions.

  C. Conduct an analysis to determine the root cause of the failed response.

  D. Apply a work around to eliminate or mitigate the impact of the threat.

  Correct Answer: C

  Explanation: According to the PMBOK Guide, one of the tools and techniques for the implement risk responses process is root cause analysis. Root cause analysis is a technique that focuses on identifying the fundamental reason for the occurrence of a problem or a risk. By conducting a root cause analysis, the risk owner can determine why the implemented measures were only partially successful and what caused the new unforeseen risk to emerge. This can help the risk owner to identify and implement more effective risk responses, as well as to update the risk register and the risk report with the new information1 . References: PMBOK Guide, 6th edition, pages 452-453, 474-4751; PMI-RMP ontent Outline, 2015, page 8.

• Question 452:

  A risk manager is confident that they have identified and quantified the risks and opportunities for a project. When presenting their work to management, on what areas should the risk manager focus? (Choose two.)

  A. Risks that are tied to the success of the organization

  B. Risks as they apply to the organization's overall risk management philosophy and strategic ambition

  C. Huge opportunities that possibly bring an additional 30% return for 10 projects in the next year

  D. Risks related to cost that will impact the major projects that are currently in the execution phase

  E. Risk mitigation actions that will require work from stakeholders

  Correct Answer: AB

  Explanation: According to the PMBOK Guide, 6th edition, Section 11.1.3.1, Enterprise Environmental Factors, one of the factors that can influence the Plan Risk Management process is the organization's risk attitude, appetite, tolerance, and thresholds. These terms describe the degree of uncertainty that an organization is willing to accept in pursuit of its goals, and how it approaches, operates, and responds to risk. Therefore, when presenting their work to management, the risk manager should focus on the risks that are tied to the success of the organization, and the risks as they apply to the organization's overall risk management philosophy and strategic ambition. These aspects can help the management to understand the alignment of the project risks with the organizational objectives and values, and to make informed decisions about risk responses. The other options are less relevant or too specific for a management presentation, and may not reflect the organization's risk attitude or priorities. References: PMBOK Guide, 6th edition, Section 11.1.3.1, Enterprise Environmental Factors1 The risk manager should focus on risks that are directly tied to the success of the organization and those that align with the organization's risk management philosophy and strategic ambition. This will ensure that management is informed about the most relevant risks and opportunities for the project.

• Question 453:

  An organization faces immense competition in the market and decides to accelerate a key project. What is the first action for the project risk manager to take?

  A. Update the risk register

  B. Meet with the project's stakeholders

  C. Revise the risk management plan

  D. Ensure sufficient resources are available

  Correct Answer: C

  Explanation: According to the PMBOK Guide1, the risk management plan is a component of the project management plan that describes how risk management activities will be structured and performed. It provides guidance on how the project team will identify, analyze, respond, monitor, and control risks throughout the project life cycle. The risk management plan should be reviewed and updated whenever there are changes in the project scope, schedule, budget, or objectives, as these changes may introduce new risks or affect the existing ones. In this case, the organization's decision to accelerate a key project is a significant change that may alter the risk profile of the project. Therefore, the first action for the project risk manager to take is to revise the risk management plan to reflect the new situation and ensure that the risk management processes are aligned with the project objectives and constraints. This is part of the Plan Risk Management process in the PMBOK Guide1. References: 1: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition

• Question 454:

  During project planning, a risk is identified for which the risk manager has defined a mitigation strategy. Later during project execution, this risk still leaves substantial residual risk.

  What should the risk manager do to handle this situation?

  A. Revisit this risk in the risk register and redefine the mitigation strategy.

  B. Activate the contingency plan to handle this risk during execution.

  C. Mark this new risk as an extremely high priority and inform all stakeholders.

  D. Ask the project sponsor for more budget to deal with this risk.

  Correct Answer: C

  Explanation: If a risk still leaves substantial residual risk after implementing the mitigation strategy, the risk manager should revisit the risk register and redefine the mitigation strategy to reduce the residual risk to an acceptable level.

  According to the PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1, an effect of adding the correlation to the Monte Carlo schedule risk analysis model is that it increases the standard deviation of the model. This is because: Correlation is the statistical relationship between two or more variables. In a schedule risk analysis, correlation can be used to model the dependency between the durations of different activities. For example, if two activities are positively correlated, it means that if one activity takes longer than expected, the other activity is also likely to take longer than expected. Conversely, if two activities are negatively correlated, it means that if one activity takes longer than expected, the other activity is likely to take shorter than expected. A Monte Carlo schedule risk analysis is a simulation technique that uses random values for uncertain variables, such as activity durations, to generate possible outcomes for the project schedule. The simulation is repeated many times to produce a probability distribution of the project completion date and duration. The standard deviation is a measure of the variability or dispersion of the distribution. A higher standard deviation means that the distribution is more spread out and less predictable. Adding correlation to the Monte Carlo schedule risk analysis model increases the standard deviation of the model because it introduces more variability and uncertainty to the simulation. Correlated activities can have a cumulative effect on the project schedule, either positively or negatively, depending on the direction and strength of the correlation. This can result in more extreme outcomes for the project completion date and duration, which increase the spread of the distribution and the standard deviation. References: PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1 Risk Management Professional (PMI-RMP) ert Guide2

• Question 455:

  A risk manager of a complex project has identified a risk and believes a deeper understanding of the source and likelihood is necessary. How should the risk manager proceed?

  A. Develop and employ an Ishikawa diagram

  B. Analyze the assumptions and constraints

  C. Perform a review of project documents

  D. Create prompt lists for expert interviews

  Correct Answer: A

  Explanation: An Ishikawa diagram (also known as a fishbone or cause-and-effect diagram) is a tool used to identify and analyze the root causes and sources of a risk. It helps the risk manager gain a deeper understanding of the risk source

  and likelihood.

  (Reference: PMBOK Guide, 6th Edition, p. 139)

  An Ishikawa diagram, also known as a fishbone diagram or a cause-and-effect diagram, is a tool that can help the risk manager to analyze the root causes of a risk and to identify the factors that influence its occurrence and impact. An

  Ishikawa diagram can also help to visualize the relationships among different causes and to prioritize the most significant ones. By developing and employing an Ishikawa diagram, the risk manager can gain a deeper understanding of the

  source and likelihood of the risk and plan appropriate responses accordingly. References: The Standard for Risk Management in Portfolios, Programs, and Projects, page 72; PMBOK Guide, 6th edition, page 398.

• Question 456:

  The risk manager of a major project needs to ensure the organizational process assets (OPAsj are updated as a result of risk management activities. How will the risk manager accomplish this?

  A. Ensuring that the project sponsor is kept well-informed

  B. Arranging periodic risk: management process audits

  C. Communicating the status of risks regularly to stakeholders

  D. Monitoring costs with intervention when necessary

  Correct Answer: B

  Explanation: The risk manager can ensure the organizational process assets (OPAs) are updated as a result of risk management activities by arranging periodic risk management process audits. These audits help evaluate the effectiveness of risk management processes and identify areas of improvement, leading to updates in the OPAs. According to the PMBOK Guide, one of the tools and techniques for the monitor risks process is audits. Audits are examinations of the risk management processes to ensure that they are aligned with the project objectives and are following the organizational policies and procedures. Audits can also identify any gaps, inconsistencies, or areas of improvement in the risk management activities. By conducting periodic audits, the risk manager can ensure that the organizational process assets are updated and reflect the current state of the project risk management. Some of the organizational process assets that can be updated as a result of audits are risk management templates, risk categories, risk databases, and lessons learned1 . References: PMBOK Guide, 6th edition, pages 456-457, 481-4821; PMI-RMP ontent Outline, 2015, page 9

• Question 457:

  A new risk manager has been hired on a project and meets with the project director. The project director supplies the project's risk register and asks the risk manager for an analysis of its effectiveness.

  What two actions should the risk manager do next? (Choose two.)

  A. Check to ensure that the risk is supported by a Monte Carlo simulation.

  B. Check to ensure that the risks are gathered using Delphi technique.

  C. Check for risk classification and that probability and impact are identified.

  D. Check to ensure that risk origin, triggering event, and ownership is identified.

  E. Check to ensure the risk meeting agenda and supporting documents are distributed.

  Correct Answer: CD

  The risk manager should first check the risk register for proper risk classification, probability, and impact (C), as these are essential components of an effective risk management process. Next, the risk manager should ensure that the risk origin, triggering events, and ownership are identified (D), as this information helps in assigning responsibilities and taking appropriate actions for each risk. References to these steps can be found in the Project Management Institute's (PMI) A Guide to the Project Management Body of Knowledge (PMBOK Guide), Sixth Edition. The risk manager should check for risk classification and that probability and impact are identified, as these are essential elements of a risk register. Risk classification helps to group risks into categories based on their sources, types, or impacts, which can facilitate risk analysis and response planning. Probability and impact are the two dimensions of risk assessment, which help to measure the likelihood and severity of a risk event, and to prioritize risks based on their significance. The risk manager should also check to ensure that risk origin, triggering event, and ownership is identified, as these are also important components of a risk register. Risk origin refers to the root cause or source of a risk, which can help to understand the nature and characteristics of a risk, and to devise effective risk responses. Triggering event is a specific occurrence or condition that indicates that a risk event has occurred or is about to occur, which can help to monitor and control risks. Ownership is the assignment of a risk to a person or a group who is responsible for managing the risk, which can help to ensure accountability and communication. The risk manager should not check to ensure that the risk is supported by a Monte Carlo simulation, as this is not a mandatory or universal requirement for a risk register. Monte Carlo simulation is a quantitative risk analysis technique that uses computer-generated random scenarios to model the possible outcomes of a project, based on the probability distributions of the input variables. While this technique can provide useful information about the overall project risk exposure and the probability of achieving project objectives, it is not a necessary or sufficient condition for an effective risk register. The risk manager should not check to ensure that the risks are gathered using Delphi technique, as this is also not a compulsory or exclusive requirement for a risk register. Delphi technique is a qualitative risk identification technique that uses a panel of experts to anonymously provide their opinions on potential risks, which are then aggregated and refined through a series of rounds until a consensus is reached. While this technique can help to elicit expert judgment and reduce bias, it is not the only or the best way to identify risks. The risk manager should not check to ensure the risk meeting agenda and supporting documents are distributed, as this is not a relevant or appropriate action for analyzing the effectiveness of a risk register. The risk meeting agenda and supporting documents are part of the risk management plan, which describes how the project team will conduct risk management activities, such as identifying, analyzing, responding, and monitoring risks. The risk meeting agenda and supporting documents are useful for planning and conducting risk meetings, but they are not part of the risk register, which is the output of the risk identification process and the input for the risk analysis and response processes. References: PMI. (2017). A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition. Chapter

  11: Project Risk Management, pp. 395-454. 5

• Question 458:

  After a number of risk workshops, risks have been identified. Which is the first element the risk owner should look for in the response plan to help mitigate the risks?

  A. Probability of a response triggering a secondary risk

  B. How the response will affect the quality of the components

  C. If the risk response is tied to an activity on the critical path

  D. Verify due dates for the actions have been identified

  Correct Answer: D

  Explanation: The first element the risk owner should look for in the response plan is to verify that due dates for the actions have been identified. This ensures that risk mitigation actions are timely and can be effectively monitored.

  After identifying the risks and assigning risk owners, the next step is to develop risk response plans that describe how to address each risk. The first element that the risk owner should look for in the response plan is the due date for the actions that are required to implement the response. The due date is important because it helps to prioritize the risk response activities, monitor the progress of the risk response, and ensure that the response is executed in a timely manner. The due date also helps to align the risk response with the project schedule and avoid any delays or conflicts. The other elements, such as the probability of a secondary risk, the impact on the quality of the components, and the relationship with the critical path, are also relevant for the risk response plan, but they are not the first element that the risk owner should look for. References: PMI, 2017. A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition. Newtown Square, PA: Project Management Institute, Inc., pp. 407-4081

• Question 459:

  A risk manager for a cross-functional project is initiating the risk identification process. The risk manager conducted some meetings for stakeholders to express their concerns, but some stakeholders are complaining that their opinions were not considered.

  How should the risk manager address these concerns?

  A. Refer to the requirements documentation to confirm stakeholder requirements as they relate to risks.

  B. Refer to the project charter to find guidelines and stakeholder communication channels.

  C. Review the stakeholder register and stakeholder engagement plan to communicate and solicit stakeholder input.

  D. Rewrite the risk register to include the additional possible risks and inform the stakeholders.

  Correct Answer: C

  Explanation: According to the PMI Risk Management Professional (PMI-RMP) Examination Content Outline1, one of the tasks in the domain of Risk Identification is to review the stakeholder register and stakeholder engagement plan to communicate and solicit stakeholder input on risks throughout the project life cycle1. The stakeholder register is a project document that identifies the project stakeholders, their roles, interests, expectations, influence, and communication requirements2. The stakeholder engagement plan is a component of the project management plan that describes the strategies and actions to promote productive involvement of stakeholders in project decision making and execution3. In this scenario, the risk manager should review these documents to address the concerns of some stakeholders who are complaining that their opinions were not considered in the risk identification process. The risk manager should communicate with the stakeholders according to their preferences and needs, and solicit their input on the project risks using various tools and techniques, such as interviews, surveys, brainstorming, etc. The risk manager should also update the stakeholder register and stakeholder engagement plan as needed to reflect any changes in the stakeholder community or their expectations. The risk manager should not refer to the requirements documentation to confirm stakeholder requirements as they relate to risks, because that is not a direct way to address the stakeholders' concerns, and it may not capture all the potential risks that the stakeholders may identify4. The risk manager should not refer to the project charter to find guidelines and stakeholder communication channels, because the project charter is a high-level document that does not provide detailed information on how to communicate and engage with the stakeholders5. The risk manager should not rewrite the risk register to include the additional possible risks and inform the stakeholders, because that is a premature and presumptuous action that may not reflect the actual views and inputs of the stakeholders, and it may create more confusion and dissatisfaction among them6. References: 1: PMI Risk Management Professional (PMI-RMP) Examination Content Outline, page 82: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition, page 5133: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition, page 5184: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition, page 1525: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition, page 776: A Guide to the Project Management Body of Knowledge (PMBOK Guide) Sixth Edition, page 414.

• Question 460:

  A risk management professional is in the process of categorizing risks when a subject matter expert (SME) suggests categorizing the risks by their impact to the project objectives. Why should the risk management professional use this approach?

  A. To enable the team in identifying the specific causes of risks associated with project objectives.

  B. To ensure that project priorities are being appropriately factored into risk response plans.

  C. To determine there more attentive project leadership and organizational involvement is needed.

  D. To assign risks and risk severities to functional discipline and departments effectively.

  Correct Answer: B

  Explanation: Categorizing risks by their impact on project objectives ensures that risk response plans are aligned with project priorities. This helps in focusing on the most critical risks and their potential impact on the project's success. Categorizing risks by their impact to the project objectives is a way of aligning the risk management process with the project goals and stakeholder expectations. By doing so, the risk management professional can ensure that the risk response plans are focused on the most critical aspects of the project and that the project priorities are being considered in the decision making. This approach can also help to communicate the value of risk management to the project team and the stakeholders, as they can see how the risk management activities are contributing to the project success. Categorizing risks by their impact to the project objectives does not necessarily help to identify the specific causes of risks, determine the level of project leadership and organizational involvement, or assign risks and risk severities to functional disciplines and departments. These are other possible ways of categorizing risks, but they are not the main purpose of using the impact to the project objectives approach. References: PMI-RMP Certification Handbook1, page 9; PMBOK Guide, page 415.