Risk Management PMP Practice Questions

Question 1 of 21

During sprint planning, the team identifies that a critical API integration may not be available on time from a third-party vendor. What is the BEST way to handle this risk?

1. A.Ignore the risk until the vendor confirms the delay — planning responses to unconfirmed third-party risks creates overhead without confirmed probability or impact data to justify the effort.
2. B.Escalate to the product owner and halt sprint planning until the vendor confirms availability — committing to a sprint without resolving this dependency creates a commitment the team cannot reliably keep.
3. C.Add the risk to the risk register, plan a mitigation strategy such as building a mock API, and add a contingency plan.
4. D.Remove the integration story from the backlog until the vendor confirms availability — planning work with an unconfirmed external dependency creates a sprint commitment that cannot be reliably fulfilled.

Question 2 of 21

During risk identification, a project manager learns that a key subcontractor may go bankrupt within the project timeline. The probability is 15% and the financial impact would be $400,000. What is the Expected Monetary Value (EMV) of this risk?

1. A.$400,000
2. B.$340,000
3. C.$415,000
4. D.$60,000

Question 3 of 21

A risk register entry shows: Probability = High (0.7), Impact = High (0.8). The probability-impact score is 0.56. According to the probability-impact matrix, how should this risk be prioritized?

1. A.High priority — a P×I score of 0.56 is in the red zone requiring immediate active response planning
2. B.Low priority — only 56% of risks require active management
3. C.Medium priority — the score should be compared to the organization's risk threshold
4. D.The risk should be accepted since the probability-impact matrix is only used for low-probability risks

Question 4 of 21

A project manager identifies a risk that a key technology vendor may raise prices by 20% mid-project. The project manager negotiates a fixed-price agreement with the vendor before the project starts. Which risk response strategy is this?

1. A.Mitigate — the probability of the price increase is reduced
2. B.Transfer — the financial risk is shifted to the vendor through the fixed-price contract
3. C.Accept — the team acknowledges the risk and does nothing proactive
4. D.Avoid — the risk is eliminated by changing the procurement approach

Question 5 of 21

An agile team discovers a significant technical risk during a sprint that could prevent delivery of the highest-priority feature. The risk was not on the risk register. What should the team do FIRST?

1. A.Stop the sprint, notify the product owner, and wait for direction
2. B.Continue the sprint and document the risk in the retrospective
3. C.Add the risk to the risk register, assess its impact
4. D.Escalate to senior management now without discussing with the product owner

Question 6 of 21

A project manager is developing risk responses for a threat with probability 0.5 and impact of $200,000. A mitigation action costs $40,000 and would reduce the probability to 0.2. Should the mitigation be implemented based on EMV analysis?

1. A.Yes — the mitigation cost of $40,000 is less than the original EMV of $100,000
2. B.No — the residual EMV after mitigation ($40,000) plus the mitigation cost ($40,000) equals the original EMV ($100,000), making it neutral.
3. C.No — mitigation is only appropriate for high-probability, high-impact risks
4. D.Yes — the mitigation saves $60,000 in EMV reduction minus the $40,000 cost, yielding a net benefit of $20,000

Question 7 of 21

A project manager is planning a complex hybrid project. The risk register has 45 risks. Which approach to risk monitoring is MOST appropriate?

1. A.Focus active monitoring on the top 10 risks by P×I score, and reassess the full register monthly or at major phase gates.
2. B.Review all 45 risks weekly with the full project team
3. C.Delegate all risk monitoring to individual risk owners and only review when an issue is escalated
4. D.Archive risks after the planning phase and only revisit if a risk materializes

Question 8 of 21

A risk register entry identifies a threat with the following response options. Which THREE are valid negative risk response strategies according to PMBOK?

Select all that apply.

1. A.Transfer — shift the financial consequence of the risk to a third party
2. B.Mitigate — reduce the probability or impact of the risk to an acceptable level
3. C.Accept — acknowledge the risk and either set aside contingency or take no action
4. D.Avoid — change the project plan to eliminate the risk or its impact entirely
5. E.Exploit — ensure the opportunity is realized by taking deliberate action

Question 9 of 21

A project manager is performing quantitative risk analysis. The Monte Carlo simulation results show a 10% probability of completing the project by the target date, and an 80% confidence completion date is 6 weeks later. What action should the project manager take?

1. A.Re-run the simulation with more optimistic probability distributions — adjusting the input ranges toward best-case scenarios will produce results that better support the current schedule commitment.
2. B.Present the simulation results to the sponsor and recommend adjusting the project deadline or scope to achieve a higher confidence level.
3. C.Accept the 10% probability and proceed — Monte Carlo simulations are often overly conservative and do not account for the team's ability to actively manage and mitigate risks during execution.
4. D.Eliminate the highest-probability risks and re-run the simulation — removing these risks from the model will increase the confidence interval and demonstrate a higher likelihood of meeting the deadline.

Question 10 of 21

A project manager is conducting a risk workshop for a hybrid project. The team identifies 30 risks in 2 hours. The project manager wants to prioritize which risks deserve detailed response planning. What tool should be used next?

1. A.Monte Carlo simulation — to quantify the cumulative probability impact of all 30 risks simultaneously and generate a probabilistic distribution of project schedule and cost outcomes.
2. B.Failure Mode and Effects Analysis (FMEA) — to evaluate each risk's failure modes, severity, and likelihood in a structured format that prioritizes the most urgent responses.
3. C.Probability-impact matrix — to quickly score each risk and focus detailed planning on high-priority risks
4. D.Decision tree analysis — to evaluate the expected financial value of each response option and support informed trade-offs between different mitigation and contingency strategies.

Question 11 of 21

A risk response plan has been implemented for a key project risk. Which THREE activities are part of ongoing risk monitoring?

Select all that apply.

1. A.Removing all risks from the register once their response plans are implemented
2. B.Identifying new risks that emerge as the project environment changes
3. C.Evaluating the effectiveness of implemented risk responses
4. D.Tracking risk triggers to determine if a risk is about to materialize
5. E.Reassessing the probability and impact of risks as the project progresses

Question 12 of 21

The project team learns that a key supplier may not obtain permits before site work begins. What should happen FIRST?

1. A.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
2. B.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 13 of 21

The project team learns that the probability of a data migration failure is rising as defects accumulate. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 14 of 21

The project team learns that a beneficial technology opportunity could reduce cycle time if adopted quickly. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
3. C.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 15 of 21

The project team learns that new legislation may affect one of the project's deliverables. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
3. C.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.
4. D.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.

Question 16 of 21

The project team identifies an uncertainty that could either delay deployment or create a chance to simplify architecture. What should happen FIRST?

1. A.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
2. B.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 17 of 21

The project team learns that an external dependency has become unstable after organizational restructuring. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 18 of 21

The project team learns that a previously low-priority risk is now affecting multiple work packages. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
3. C.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 19 of 21

The project team learns that risk owners have not updated their response actions for over a month. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
3. C.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.
4. D.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.

Question 20 of 21

The project team learns that a threat was mitigated earlier, but the environment has now changed significantly. What should happen FIRST?

1. A.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
2. B.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.

Question 21 of 21

The project team learns that a risk with an approved response plan is no longer aligned with the current project environment. What should happen FIRST?

1. A.Wait for the risk to occur so the team can respond with complete information rather than investing in response plans for events that may never materialize.
2. B.Update the risk analysis and response planning so owners, triggers, and actions reflect the current situation.
3. C.Remove discussed risks from the register — once reviewed, retaining them adds administrative overhead without improving the team's ability to manage their most active risks.
4. D.Escalate every risk to the steering committee regardless of severity — executive visibility ensures leadership can intervene proactively and is never caught off-guard by project challenges.