PMI-RMP (Risk Management Professional) Practice Exam

Correct: A — Qualitative risk analysis first. Once a risk is identified, the next step is to assess its probability and impact so it can be prioritized. Analysis precedes response — you cannot choose a proportionate response without first understanding the exposure.

Why not the others: jumping to a contingency plan (B) commits resources before the risk is sized; terminating the supplier (C) is a drastic response chosen with no analysis; waiting for the delay (D) abandons risk management entirely.

Correct: A — Probability-and-impact matrix. The P×I matrix ranks risks by combining how likely each is with how severe its effect would be, giving a fast, defensible prioritization to focus attention and response effort.

Why not the others: a Gantt chart (B) shows schedule timing; a WBS (C) decomposes scope; a stakeholder register (D) records people — none ranks risk severity.

Correct: A — Risk = future uncertainty; issue = present problem. A risk is an uncertain event that may happen and is tracked in the risk register; an issue is something that has happened and is tracked in the issue log and managed now.

Why not the others: B, C, and D invent distinctions that don’t hold — both risks and issues are documented, and neither is defined by being financial vs technical or resolved vs ignored.

Correct: A — Transfer. Transfer shifts the financial impact (and often ownership) of a threat to a third party — insurance, warranties, or contractual terms. The risk still exists, but its financial consequence is borne by someone else.

Why not the others: accept (B) keeps the consequence in-house; avoid (C) eliminates the risk by not doing the activity, not transferring it; increasing contingency (D) is a form of active acceptance, not transfer.

Correct: A — Monte Carlo simulation. Monte Carlo is a quantitative technique that runs thousands of iterations across the ranges of uncertain inputs to produce a probability distribution of outcomes — for example, the likelihood of finishing by a given date.

Why not the others: SWOT (B) is a qualitative context tool; MoSCoW (C) prioritizes requirements; a RACI matrix (D) assigns responsibilities — none produces a quantitative outcome distribution.

Correct: A — Confirm risk thresholds against risk appetite. A core planning task is translating the organization’s risk appetite into measurable thresholds (cost, schedule, quality) that define how much exposure is acceptable and when to escalate.

Why not the others: ignoring risks (B) is the opposite of planning; freezing scope (C) is a scope action, not a risk threshold; delegating all decisions (D) abdicates the risk manager’s role.

Correct: A — The risk register. The risk register is the living record of identified risks along with their probability, impact, owners, triggers, and planned responses — the primary artifact for monitoring risk over the life of the project.

Why not the others: the issue log (B) tracks problems that have already occurred; the project charter (C) authorizes the project; the stakeholder register (D) records stakeholders — none tracks risk triggers and responses.

Correct: A — Residual risks. Residual risk is the exposure left over after a response has been applied — no response eliminates risk entirely, so the remaining portion is documented, accepted, or managed further. (Contrast with a secondary risk, which is a new risk created by a response.)

Why not the others: ignored risks (B) were never assessed; fully transferred risk (C) describes a transfer response, not what remains after responses generally; “no possible mitigation” (D) is not the definition of residual risk.

Correct: A — A risk created by a response. A secondary risk is one that the response itself introduces — for example, outsourcing a task (a transfer response) creates a new vendor-dependency risk. They must be identified and managed like any other risk.

Why not the others: low probability (B), unrelated (C), and late-identified (D) describe attributes or timing of risks generally, not the cause-by-response relationship that defines a secondary risk.

Correct: A — A risk report. The risk report summarizes overall project risk exposure and the status of significant individual risks and responses, making it the primary vehicle for communicating risk to stakeholders and leadership.

Why not the others: a change log (B) tracks change requests; a WBS (C) decomposes scope; a test case (D) is a quality artifact — none communicates risk exposure.