PMI PMP Risk Identification Analysis and Responses Practice Test

 

Topic 24 covers risk identification analysis and responses for the PMI Project Management Professional (PMP) certification. These original scenarios apply the July 2026 exam objectives across predictive, agile and hybrid projects. Use the stated constraints to select one answer unless the question specifies otherwise. For broader preparation, visit the PMP Exam Dumps page. Each option has an explanation of its role in the decision.

Question 1

A predictive laboratory project assumes that a specialist component will pass a forthcoming compatibility test. Failure would require an eight-week redesign. The test has not yet occurred. Which register entry would best support a risk response?

1. The untested component may prove incompatible, requiring redesign and delaying installation.
2. The component has a compatibility requirement in its specification.
3. The supplier should deliver the component earlier.
4. Installation is already eight weeks late because the component failed its test.
5. The installation target should include another eight weeks.

Correct Answer: A

 

Correct Answer

Answer A is correct because this connects the source of uncertainty, a possible event and its effect on an objective. The team can assign ownership and consider testing or alternatives before the event is known.

Incorrect Answers

Answer B is incorrect because a requirement describes the desired condition but does not expose the uncertain test outcome. The missing causal connection makes it harder to assess urgency and select a response.

Answer C is incorrect because early delivery could be part of a response, but this wording does not identify the uncertain event or its project consequence. Ownership alone would not clarify what the response must address.

Answer D is incorrect because the test has not occurred, so this turns a possible consequence into a current fact. It would direct issue management around a failure that has not been established.

Answer E is incorrect because a schedule allowance is a possible planning decision, not a description of the uncertainty. The team first needs an explicit risk and an assessment of appropriate responses.

 

Question 2

A hybrid project has identified risks only in a workshop attended by the delivery team. Operations and procurement later mention dependencies that were absent from the discussion. Which two actions would most directly improve the next identification session? Choose TWO.

1. Include people who understand the operational and supplier dependencies.
2. Restrict the session to risks with enough data for a numerical probability.
3. Ask each delivery team member to submit a longer list before involving other functions.
4. Use the previous project’s register as the final list because it passed an audit.
5. Have the sponsor rank the existing entries before inviting dependency specialists.
6. Review assumptions and dependency interfaces before confirming the risk list.

Correct Answers: A, F

 

Correct Answers

Answer A is correct because those participants hold information outside the delivery team’s daily work. Their involvement can reveal failure paths and constraints that a delivery-only discussion could reasonably miss.

Answer F is correct because assumptions can hide uncertainty, and interfaces expose reliance on other parties. Examining them gives the discussion concrete prompts beyond recalling familiar problems.

Incorrect Answers

Answer B is incorrect because emerging uncertainties may be important before precise estimates exist. Requiring numbers at identification would exclude some of the very blind spots the team needs to explore.

Answer C is incorrect because more entries from the same information base may add detail without exposing the missing operational and commercial knowledge. List length does not remedy the identified coverage gap.

Answer D is incorrect because historical risks are useful prompts but cannot establish current coverage. The newly raised dependencies may differ from those in the audited project.

Answer E is incorrect because ranking prioritizes known risks but does not identify missing ones. The concern is incomplete information, which should be addressed before treating the list as sufficient.

 

Question 3

A predictive project uses probability multiplied by financial impact to compare threats, with all amounts in the same currency. Risk A has a 20% probability and a 100,000 impact; risk B has a 50% probability and a 30,000 impact. Both are within the same time window, and neither has a mandatory escalation condition. Which result follows from this rule?

1. A ranks above B because its expected loss is 100,000 versus 30,000.
2. B ranks above A because its probability is 50% rather than 20%.
3. Treat both as the same priority because a qualitative matrix places them in the same high-risk category.
4. A ranks above B: its expected loss is 20,000 versus 15,000.
5. B ranks above A because its expected loss is 60,000 versus 20,000.

Correct Answer: D

 

Correct Answer

Answer D is correct because multiplying 0.20 by 100,000 gives 20,000, while 0.50 by 30,000 gives 15,000. The stated comparison rule therefore gives A the higher financial priority, despite B being more likely.

Incorrect Answers

Answer A is incorrect because these are the losses if the events occur, not probability-weighted values. The ranking happens to match, but the calculation misrepresents the measure used for the decision.

Answer B is incorrect because probability alone omits consequence. The smaller impact makes B’s expected loss lower under the explicitly required multiplication rule.

Answer C is incorrect because a shared category may support a different qualitative method, but this question explicitly requires probability times financial impact. That calculation distinguishes 20000 from 15000 even if a coarse label would group them together.

Answer E is incorrect because dividing B’s impact by its probability gives 60,000, which is not the stated method. Expected loss is probability times impact, yielding 15,000 for B.

 

Question 4

A hybrid project’s risk owner is accountable for monitoring an integration threat and reporting residual exposure. A specialist is assigned to build the preventive test harness. The harness will take three weeks. Which two responsibilities should be made explicit? Choose TWO.

1. The specialist owns the agreed test-harness action and completion evidence.
2. Use the harness completion date as the risk closure date without a separate effectiveness review.
3. The specialist automatically becomes accountable for every consequence of the integration threat.
4. The risk owner closes the threat when the harness development ticket is assigned.
5. Transfer residual-risk monitoring to the specialist when the harness passes its development tests.
6. The risk owner reviews whether the completed harness reduces the threat sufficiently.

Correct Answers: A, F

 

Correct Answers

Answer A is correct because assigning the specific response task to the person able to execute it makes delivery accountable. Its due date and evidence can be tracked without confusing that task with ownership of the entire risk.

Answer F is correct because completing an action does not prove the remaining exposure is acceptable. The risk owner’s continuing role covers effectiveness, residual risk and any further decision needed.

Incorrect Answers

Answer B is incorrect because a completed control can leave significant exposure. The risk owner must assess whether the harness reduces the integration threat sufficiently before deciding the risk’s disposition.

Answer C is incorrect because ownership of one response action does not transfer the broader risk role. Such a transfer would require an explicit agreement about authority and continuing responsibilities.

Answer D is incorrect because assignment starts a response; it neither completes the action nor demonstrates reduced exposure. The three-week development period still leaves the risk active.

Answer E is incorrect because the specialist owns a response action, while the named risk owner remains accountable for residual exposure. Development tests can support effectiveness review but do not automatically transfer the broader monitoring responsibility.

 

Question 5

A predictive field project introduces packaging that lowers the estimated chance of equipment damage from 15% to 4%. Damage would still cost 50,000, and shipment has not occurred. How should the remaining exposure be treated?

1. Record a new secondary risk solely because the probability changed.
2. Retain and assess the 4% damage risk after the packaging response.
3. Keep the original 15% assessment as the only current estimate until a loss occurs.
4. Create an issue for the full 50,000 loss immediately.
5. Close the damage risk because the preventive packaging is installed.

Correct Answer: B

 

Correct Answer

Answer B is correct because the response reduces likelihood but does not eliminate the original threat. The remaining probability and consequence describe residual exposure that still requires an acceptance or further-response decision.

Incorrect Answers

Answer A is incorrect because a secondary risk is a different uncertainty introduced by the response. Here the same damage event remains possible at a lower likelihood, making it residual risk.

Answer C is incorrect because the verified response has changed the assessment basis. The original estimate remains useful history, but current decisions should use the best supported remaining exposure.

Answer D is incorrect because shipment damage is still uncertain and has not been reported. The possible consequence belongs in risk assessment rather than being recorded as an incurred loss.

Answer E is incorrect because completion of the response does not reduce the stated probability to zero. Closing the risk now would confuse implementation evidence with elimination of exposure.

 

Question 6

A hybrid project plans an extra inspection to reduce the chance of defective parts reaching installation. The inspection may create a queue that delays time-sensitive parts; no queue has formed yet. What should the team do with this new uncertainty?

1. Increase only the probability of the original defective-parts risk.
2. Wait for the first queue before considering staffing or inspection capacity.
3. Approve the inspection on its defect-reduction case and leave queue effects outside the response assessment.
4. Assess the potential queue delay as a secondary risk of the inspection response.
5. Record the queue as an existing schedule issue and immediately rebaseline installation.

Correct Answer: D

 

Correct Answer

Answer D is correct because the new inspection can introduce a different threat while reducing the defect threat. Evaluating both lets the team judge the net effect and adjust the response before the queue becomes a current problem.

Incorrect Answers

Answer A is incorrect because a queue delay is a distinct causal pathway and consequence. Changing the defect probability alone would obscure the new uncertainty introduced by the control.

Answer B is incorrect because the potential bottleneck is already identifiable. Waiting would give up the opportunity to design a response that reduces defects without creating an avoidable delivery threat.

Answer C is incorrect because the potential queue is caused by the proposed response and could affect delivery. Assessing the combined benefit and secondary exposure is needed to judge whether the inspection is a sound treatment.

Answer E is incorrect because no delay has occurred. Treating the possibility as a confirmed impact would overstate the current condition and bypass assessment of prevention or capacity options.

 

Question 7

A predictive project can reserve alternate transport only if it acts at least four days before dispatch. A port-disruption warning is issued seven days before dispatch, while confirmation of closure usually arrives two days before dispatch. Policy authorizes a refundable reservation when the warning appears. Which two elements belong in the response plan? Choose TWO.

1. Schedule the first warning review three days before dispatch.
2. Use the seven-day warning as the reservation trigger.
3. Treat the warning as automatic authorization for a nonrefundable shipment replacement.
4. Use confirmed closure as the only trigger for reserving alternate transport.
5. Name the person who monitors warnings and initiates the refundable reservation.
6. Assign the carrier to decide whether the project’s reservation policy applies.

Correct Answers: B, E

 

Correct Answers

Answer B is correct because it occurs while the four-day reservation lead time can still be met. Waiting for confirmation would make the authorized preventive option unavailable.

Answer E is correct because a useful indicator needs an accountable action route. Without monitoring and response ownership, a timely signal can still pass without the reservation being made.

Incorrect Answers

Answer A is incorrect because that review would occur after the latest time for a reservation. A monitoring cadence must leave enough time to perform the response it is intended to trigger.

Answer C is incorrect because the policy permits a refundable reservation, which preserves an option at limited commitment. It does not authorize the broader and potentially more costly action described here.

Answer D is incorrect because closure confirmation arrives inside the reservation lead time. It is stronger evidence but too late to support this particular response.

Answer F is incorrect because the carrier may provide transport information, but the project needs an owner to apply its own policy. External notification does not replace internal decision accountability.

 

Question 8

An adaptive prototype can use either a novel external connection or an approved local dataset. Both meet the prototype’s learning goal. The external connection creates a threat that an unavailable partner service will prevent the demonstration. The product owner decides that the prototype should have no dependency on that service. Which response fits this decision?

1. Ask the partner for a stronger availability forecast before choosing the dataset.
2. Retain the connection and allow an extra hour for retries.
3. Retain the connection and increase monitoring of the partner’s availability.
4. Buy service credits payable if the partner connection is unavailable.
5. Use the approved local dataset for the prototype.

Correct Answer: E

 

Correct Answer

Answer E is correct because this removes the dependency that creates the stated threat while preserving the learning goal. It avoids that specific exposure rather than merely reducing its likelihood or consequences.

Incorrect Answers

Answer A is incorrect because further evidence might change a probability estimate, but both options already meet the goal and the owner has decided to eliminate the dependency. A forecast is not the required response.

Answer B is incorrect because additional time may reduce the impact of a brief interruption. The partner dependency would remain, contrary to the product owner’s explicit boundary.

Answer C is incorrect because monitoring may provide warning but leaves the prototype dependent on the service. It does not meet the stated decision to remove that dependency.

Answer D is incorrect because compensation may shift some financial consequence, but it would not make the demonstration independent of the service. The desired response concerns removing exposure, not reimbursement.

 

Question 9

A predictive project buys shipment insurance. The stated contract reimburses covered damage above a 10,000 deductible but excludes delay costs. A damaged shipment could still postpone installation. What should the manager do next?

1. Manage the deductible and delay exposure alongside the insurance arrangement.
2. Treat the insurer as the owner of the installation recovery plan.
3. Increase the insured damage value by the estimated delay cost without revising the contract.
4. Recognize the maximum insured amount as available contingency cash before any claim.
5. Close both damage and delay risks once the premium is paid.

Correct Answer: A

 

Correct Answer

Answer A is correct because the contract transfers only the covered portion of financial loss. The project retains the deductible and schedule consequences, so those exposures still need assessment, ownership and any appropriate response.

Incorrect Answers

Answer B is incorrect because reimbursement responsibility does not assign operational schedule recovery. The project must still determine how it will manage delayed installation.

Answer C is incorrect because a register entry cannot change an exclusion. Any desired additional coverage would need a valid contractual arrangement, and schedule recovery would still require project action.

Answer D is incorrect because reimbursement depends on a covered event and the contract’s claim conditions. Potential insurance proceeds are not automatically cash available for every project response.

Answer E is incorrect because paying for coverage does not expand its stated terms. The deductible and excluded delay consequences remain with the project after purchase.

 

Question 10

A project has a hard 20,000 response budget and maximizes expected loss reduction minus response cost. Response A costs 8,000 and reduces expected loss by 12,000; B costs 12,000 and reduces it by 16,000. A and B target the same mechanism: together their loss reduction is only 18,000. Response C costs 10,000, reduces a separate expected loss by 11,000, and adds independently to either response. Which listed portfolio is best under this rule?

1. B plus C: spend 22,000 for an expected net benefit of 5,000.
2. A plus B: spend 20,000 for an expected net benefit of 8,000.
3. C alone: spend 10,000 for an expected net benefit of 1,000.
4. A plus C: spend 18,000 for an expected net benefit of 5,000.
5. B alone: spend 12,000 for an expected net benefit of 4,000.

Correct Answer: D

 

Correct Answer

Answer D is correct because the independent reductions sum to 23,000 while costs sum to 18,000, giving 5,000 net within the 20,000 cap. This exceeds the net benefit of each feasible listed alternative after accounting for the A/B overlap.

Incorrect Answers

Answer A is incorrect because the additive reduction 27,000 less 22,000 cost does give 5,000 net. However, the portfolio exceeds the hard 20,000 budget, so it is not a feasible choice under the given rule.

Answer B is incorrect because the claimed 8,000 assumes the standalone reductions 12,000 and 16,000 add. Their stated combined reduction is 18,000, so spending 20,000 produces a negative 2,000 net benefit.

Answer C is incorrect because the separate threat reduction 11,000 less 10,000 cost gives 1,000 net. Conserving budget is not the stated objective when another feasible portfolio provides a larger expected net benefit.

Answer E is incorrect because this is feasible and correctly yields 16,000 minus 12,000 equals 4,000. A plus C yields 5,000 within the same cap, so choosing the strongest standalone response misses the better portfolio.

 

Question 11

A hybrid project decides to accept a low-probability equipment interruption within its approved tolerance. A tested rental replacement can be obtained if an agreed warning threshold is reached. The decision is active acceptance, with preparation for a response if needed. Which two actions implement that decision? Choose TWO.

1. Remove the risk from review because the sponsor has accepted its current probability.
2. Monitor the agreed warning threshold and revisit acceptance if exposure changes.
3. Hire the rental equipment immediately and classify the completed substitution as acceptance.
4. Record the contingency as available even if its reservation expires before the exposure period.
5. Activate the rental only after equipment failure, even if the earlier agreed warning threshold is met.
6. Maintain a feasible rental contingency with an accountable activation owner.

Correct Answers: B, F

 

Correct Answers

Answer B is correct because acceptance depends on the current assessment and tolerance. Monitoring supports timely activation and prevents an old decision from being treated as valid after its assumptions cease to hold.

Answer F is correct because accepting the exposure can include preparing a response rather than acting preventively now. A usable contingency and owner make that preparation operational.

Incorrect Answers

Answer A is incorrect because accepted exposure remains uncertain and can change. Removing monitoring would defeat the agreed trigger and the conditional basis for acceptance.

Answer C is incorrect because immediate substitution changes the exposure now and is an active response in its own right. The scenario instead specifies preparing a rental contingency for a later threshold.

Answer D is incorrect because a response that cannot be obtained when needed is not a feasible contingency. Its availability must cover the actual interruption window.

Answer E is incorrect because active acceptance here includes a prepared response tied to an agreed warning threshold. Substituting actual failure as the trigger could lose the lead time the contingency was designed to preserve.

 

Question 12

An adaptive team has an opportunity to receive a valuable feedback session with a specialist user group. The session is guaranteed if the team reserves the sole remaining slot today and assigns two qualified facilitators. The product owner has authorized that effort because the expected learning exceeds its cost. Which action exploits this opportunity?

1. Ask for more possible dates before using the authorized slot.
2. Reserve the slot and assign the two facilitators today.
3. Reserve the slot and wait until the session starts to find facilitators.
4. Send the organizer a message expressing interest without reserving the slot.
5. Add the session to the backlog for prioritization at the next monthly review.

Correct Answer: B

 

Correct Answer

Answer B is correct because both conditions for securing the session are known and authorized. Completing them makes the identified opportunity occur rather than merely improving the chance of obtaining it.

Incorrect Answers

Answer A is incorrect because alternative dates might be useful if this slot were infeasible, but the stated conditions can already be met. Delaying the required commitment risks losing a known valuable opportunity.

Answer C is incorrect because the guaranteed session requires qualified facilitators as well as a reservation. Satisfying only one condition leaves the opportunity unsecured.

Answer D is incorrect because interest may improve communication, but it does not meet the stated reservation condition. The opportunity remains uncertain until the required commitment is made.

Answer E is incorrect because backlog visibility alone does not secure a slot that must be reserved today. Deferral would allow the opportunity to expire despite current authorization.

 

Question 13

An adaptive team’s optional onboarding session may increase the probability that pilot users try a new feature from 40% to 65%. Participation remains voluntary, and the session cannot ensure adoption. Its cost is authorized. The team wants to improve the likelihood of this opportunity. What is the appropriate response?

1. Record adoption as secured when the session is scheduled.
2. Run the session as an enhancement and monitor whether uptake improves.
3. Transfer responsibility for adoption to the session facilitator through a task assignment.
4. Report the session’s attendance rate as the achieved increase in feature adoption.
5. Wait for adoption to occur before making any authorized effort to influence it.

Correct Answer: B

 

Correct Answer

Answer B is correct because the session changes a driver of the opportunity’s probability without making the benefit certain. Calling it enhancement preserves that distinction and supports checking its actual effect.

Incorrect Answers

Answer A is incorrect because scheduling the intervention does not compel participation or use. The remaining uncertainty prevents treating this as a guaranteed realized opportunity.

Answer C is incorrect because a task assignment can establish delivery accountability but does not transfer control over voluntary user behavior. The project still needs to manage the opportunity and its uncertainty.

Answer D is incorrect because attendance is an intermediate activity, while voluntary use of the feature remains the opportunity outcome. The team should measure uptake after the session rather than equate participation in training with adoption.

Answer E is incorrect because that is passive observation rather than the desired increase in likelihood. The session offers a defined, authorized action while the opportunity can still be influenced.

 

Question 14

A hybrid project could access a new distribution channel only by partnering with a specialist that holds the necessary operating capability. The project supplies the product expertise. Both parties would invest effort and share resulting revenue under a proposed agreement. Which two arrangements support a sound opportunity-sharing response? Choose TWO.

1. Attribute all potential channel revenue to the project before subtracting the partner’s agreed share.
2. Define each party’s contribution and the agreed allocation of benefits.
3. Agree how joint decisions and delivery dependencies will be managed.
4. Assign all channel delivery responsibility to the partner while leaving the project’s product input unspecified.
5. Choose a partner solely on its fee without checking the required capability.
6. Start joint delivery before agreeing who can commit the project’s resources.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because complementary capability creates the opportunity, but explicit contributions and benefit terms make collaboration actionable. They reduce uncertainty about what each party must provide and receive.

Answer C is correct because realizing the opportunity depends on coordinated work across organizations. A decision route and interface responsibilities help prevent the shared benefit from being lost through conflicting actions.

Incorrect Answers

Answer A is incorrect because the opportunity depends on a sharing agreement, so the project’s business case should reflect its actual entitlement and contribution. Gross channel revenue is not automatically the project’s own benefit.

Answer D is incorrect because the scenario requires contributions from both parties. Omitting the project’s role leaves a necessary dependency unmanaged even if the partner has the channel capability.

Answer E is incorrect because a lower fee cannot create access if the specialist lacks the capability on which the opportunity depends. Commercial comparison should preserve the essential qualification.

Answer F is incorrect because collaboration does not remove authority boundaries. Unclear commitment rights can create conflicting obligations and undermine the intended sharing arrangement.

 

Question 15

A predictive project identifies a possible loss of an enterprise license that would affect six programs. Renewal authority and funding belong to a corporate service owner; the project manager cannot negotiate or renew it. Expiry is three months away. What should the project manager do?

1. Delete the risk from the project register once an email is sent to corporate services.
2. Approve renewal from the project budget and seek corporate agreement afterward.
3. Wait until expiry so the effect can be quantified as a current issue.
4. Escalate the enterprise risk for accepted ownership and track the project’s exposure.
5. Assign the project technical lead to negotiate a license covering all six programs.

Correct Answer: D

 

Correct Answer

Answer D is correct because the response requires authority beyond the project, so the corporate service owner needs a clear decision request and responsibility. The project still needs visibility of renewal progress and its own dependency until exposure is resolved.

Incorrect Answers

Answer A is incorrect because transmission does not prove that an authorized owner has accepted action. Removing the local dependency would also lose visibility of consequences for project planning.

Answer B is incorrect because the scenario reserves both authority and funding to the corporate service owner. Acting first would exceed the manager’s mandate rather than resolve the governance dependency.

Answer C is incorrect because the three-month warning provides time for a preventive response. Waiting would discard that opportunity and make the authority gap more urgent.

Answer E is incorrect because technical expertise does not confer enterprise commercial authority. The appropriate owner must accept the risk and arrange the response within the stated decision structure.

 

Question 16

Two hybrid project threats have the same assessed probability and impact. A preventive response to risk A must start today to be effective; the response to risk B can start any time during the next month without losing effectiveness. Only one response can be initiated today, and both will remain funded. What should guide today’s sequence?

1. Select whichever risk entered the register first.
2. Split today’s effort equally even if neither response reaches its required start condition.
3. Wait for the next risk-ranking meeting because the numerical scores tie.
4. Initiate A’s response while its effective response window remains open.
5. Initiate B because its longer response window allows more preparation.

Correct Answer: D

 

Correct Answer

Answer D is correct because equal probability and impact do not imply equal urgency. Starting A now preserves a time-limited preventive option while B’s response can still be initiated effectively later.

Incorrect Answers

Answer A is incorrect because register age does not show when a response loses effectiveness. The stated time windows provide a more decision-relevant basis for sequencing.

Answer B is incorrect because equal allocation may appear balanced but would fail to secure the expiring option. The relevant constraint is an effective start for A, not equal activity on both risks.

Answer C is incorrect because the tie leaves an important urgency difference unresolved. Delaying past today would make A’s preventive response ineffective even though action is currently possible.

Answer E is incorrect because the available preparation time makes B less urgent in this comparison. Using today’s capacity on B would allow A’s effective window to close unnecessarily.

 

Question 17

A predictive decision model uses signed expected monetary value: gains are positive and losses negative. Under one proposed plan, an opportunity has a 30% chance of adding 80,000, and a threat has a 20% chance of losing 50,000. These are the only uncertain financial effects in the model. What is their combined expected contribution?

1. Negative 26,000 because the potential 50,000 loss should offset the expected gain.
2. Positive 14,000: 24,000 expected gain less 10,000 expected loss.
3. Positive 30,000 because 80,000 minus 50,000 is the net effect.
4. Positive 24,000 because a threat should be accounted for only after it occurs.
5. Positive 34,000 because the two probability-weighted amounts should be added as benefits.

Correct Answer: B

 

Correct Answer

Answer B is correct because the opportunity contributes 0.30 times 80,000 and the threat contributes negative 0.20 times 50,000. Adding the signed expectations gives 14,000; it is an average model result, not a guaranteed outcome.

Incorrect Answers

Answer A is incorrect because that combines an expected opportunity value with an unweighted threat impact. Both uncertain effects must be treated consistently under the model.

Answer C is incorrect because this compares conditional outcomes as though both were certain. It omits the different probabilities required by the expected-value model.

Answer D is incorrect because expected monetary value explicitly includes possible losses before occurrence. Excluding the threat would overstate the model’s expected contribution.

Answer E is incorrect because the magnitudes are 24,000 and 10,000, but the threat is a loss. Treating both as positive reverses the meaning of the stated sign convention.

 

Question 18

A risk simulation uses expert estimates of rare outages because operating evidence is limited. Increasing the run count from 10,000 to 1,000,000 leaves the reported percentile almost unchanged. The analyst says this stability proves the expert input ranges and causal model are accurate. What is the appropriate interpretation?

1. Treat the million simulated outages as a larger operating sample that validates the expert ranges.
2. The estimate has stabilized numerically; the input ranges and model still need independent validation.
3. Approve the model for operational use without reviewing its assumptions because convergence has been demonstrated.
4. Validate the model by matching its mean to the experts’ central estimate, without further checking its tail or causal structure.
5. Narrow the expert uncertainty ranges because the two simulation results agree.

Correct Answer: B

 

Correct Answer

Answer B is correct because more runs can reduce random simulation error under the chosen inputs. Agreement between run counts does not establish that the assumed outage ranges or causal relationships represent the real system, particularly when operating evidence is limited.

Incorrect Answers

Answer A is incorrect because simulated outcomes are generated from the assumed model rather than independently observed in operation. Reusing those outputs to validate the inputs would confuse repeated calculation with new evidence.

Answer C is incorrect because convergence is useful computational evidence but is not a substitute for checking the model against available operating knowledge. The analyst’s claim about real-world accuracy exceeds what repeated runs can establish.

Answer D is incorrect because agreement on a central value is a useful consistency check but can coexist with inaccurate extreme outcomes or causal relationships. It does not establish the accuracy of the reported percentile or independently validate assumptions drawn from those same experts.

Answer E is incorrect because numerical stability concerns the estimate produced by the current ranges, not the real uncertainty those ranges represent. Narrowing them requires evidence about outages, not agreement between repeated calculations using the same assumptions.

 

Question 19

A hybrid project’s contingency relies on a specialist arriving within 24 hours after a trigger. The supplier’s current agreement offers a three-day response, and the substitute engineer has not used the project’s equipment. Which two preparations are needed before calling this contingency ready? Choose TWO.

1. Verify the substitute’s ability to perform the required work on this equipment.
2. Reserve travel funds but leave support timing and technical capability to be confirmed after activation.
3. Mark the contingency ready because the supplier has a general support contract.
4. Confirm an arrangement that can supply qualified support within the required 24 hours.
5. Replace the 24-hour requirement with the supplier’s current promise without an impact decision.
6. Use the supplier’s best observed one-day response as the contingency commitment despite the three-day agreement.

Correct Answers: A, D

 

Correct Answers

Answer A is correct because availability alone does not demonstrate competence in the actual operating context. A practical capability check exposes whether the proposed substitute can execute the contingency when called.

Answer D is correct because the current three-day commitment cannot meet the response objective. Readiness requires a feasible source of timely capability, whether through a revised agreement or another qualified arrangement.

Incorrect Answers

Answer B is incorrect because money may enable the response, but it cannot by itself create qualified capacity within the deadline. The two known constraints must be resolved while preparation is still possible.

Answer C is incorrect because the agreement’s response time is explicitly too slow. A contract’s existence does not establish that its terms meet this response requirement.

Answer E is incorrect because the required response time reflects the project’s need. Relaxing it may change consequences and requires an authorized reassessment, not an administrative substitution.

Answer F is incorrect because an occasional fast response does not establish assured availability within this project’s required window. The contingency needs a feasible qualified arrangement, not a best-case substitution for the current commitment.

 

Question 20

An adaptive team completes an automated control intended to reduce failed data transfers. The latest tests still show the same failure rate, and the risk remains outside the approved tolerance. The action owner marks the development task complete. What should the risk owner do?

1. Reassess the ineffective response and obtain a revised treatment decision.
2. Lower the threat rating because the control passed its code-level tests despite the unchanged transfer failures.
3. Continue using the prior response forecast without comparing it with the new test results.
4. Ask the developer to accept the remaining exposure because the code is finished.
5. Close the risk because the control’s development task met its completion criteria.

Correct Answer: A

 

Correct Answer

Answer A is correct because the action is complete, but the evidence does not show the intended reduction in exposure. Remaining outside tolerance requires further treatment or an authorized change in the decision, rather than closure based on task status.

Incorrect Answers

Answer B is incorrect because local test success is not evidence that the stated operational risk has decreased. The observed transfer failure rate remains outside tolerance, so the response needs reassessment at the outcome level.

Answer C is incorrect because the current tests are relevant evidence about effectiveness. Keeping an unsupported forecast would prevent the risk process from learning from the implemented action.

Answer D is incorrect because technical completion does not grant authority to accept an out-of-tolerance risk. The risk owner must route the residual exposure to the appropriate treatment or approval decision.

Answer E is incorrect because task completion and risk reduction are different tests. The unchanged failure rate directly contradicts the purpose of the response.

 

Question 21

A hybrid project’s low risk rating assumes that a named specialist will be available for integration testing. A new staffing plan removes that specialist during the test window, although no test has yet failed. What is the appropriate risk action?

1. Reassess the linked risk using the changed availability assumption.
2. Treat the specialist’s replacement as equally effective without checking the required capability.
3. Retain the low rating because the budget for specialist support has not changed.
4. Close the risk and create a general resource note without a link to integration.
5. Keep the rating unchanged until a test actually fails.

Correct Answer: A

 

Correct Answer

Answer A is correct because the original rating depended on capacity that is no longer planned to exist. Reassessment can evaluate substitutes, impact and response options before the uncertainty becomes a testing issue.

Incorrect Answers

Answer B is incorrect because a substitute may be a valid response, but its suitability is not established by assigning a name. The relevant competence and availability need assessment.

Answer C is incorrect because funding does not establish availability during the integration window. The original risk rating depends on a named capability that the new staffing plan removes, so the assessment basis has changed.

Answer D is incorrect because the capacity change matters because of its effect on testing. Removing the causal link would weaken ownership and make the potential consequence harder to manage.

Answer E is incorrect because a risk assessment is prospective and should use current assumptions. Waiting for failure would ignore a known change in the basis for the low rating.

 

Question 22

A predictive procurement decision must reject any option whose credible single-event loss exceeds 200,000 unless the investment board grants an exception. Option A has a 2% probability of a 500,000 loss; option B has a 10% probability of a 150,000 loss. A has the lower expected loss, and no exception has been granted. What should the manager recommend under this policy?

1. Select A using existing contingency funds, since its expected loss is affordable.
2. Reject both options because every uncertain loss requires an investment board decision.
3. Select B within delegated authority or seek an exception before recommending A.
4. Select A and treat the 200,000 limit as applying to probability-weighted loss.
5. Select A because its expected loss is 10,000 versus B’s 15,000.

Correct Answer: C

 

Correct Answer

Answer C is correct because option B’s credible loss is within the stated limit, while A exceeds it regardless of its lower expected loss. The policy permits A only through the board’s exception route.

Incorrect Answers

Answer A is incorrect because available money does not expand the delegated single-event-loss limit. The 500,000 credible consequence still needs the investment board’s exception even if expected costs fit the budget.

Answer B is incorrect because the stated policy delegates choices within the 200,000 limit. B’s 150,000 loss does not trigger the specified exception requirement.

Answer D is incorrect because the policy explicitly concerns credible single-event loss. Applying it to expected loss changes the governing rule without authority.

Answer E is incorrect because the calculation is correct but does not override the explicit single-event-loss boundary. Expected value is only one decision dimension when appetite imposes a separate limit.

 

Question 23

Without further study, a project’s best available decision has an expected total cost of 80,000. A study costs 6,000. It has a 40% chance of a favorable result, after which the best decision has conditional expected cost 70,000, and a 60% chance of an unfavorable result, after which the best decision costs 80,000. These conditional values already allow for imperfect information and exclude the study fee. All constraints are met, no other learning benefit applies, and the project minimizes expected total cost. What should it do?

1. Conduct the study because its 6,000 fee is less than the 10,000 difference between the two result-dependent costs.
2. Conduct the study because the decisions it informs reduce expected cost to 76,000.
3. Skip the study: its expected total is 82,000, compared with 80,000 without it.
4. Conduct the study because the favorable decision plus the fee costs only 76,000.
5. Skip the study because imperfect information cannot improve the expected quality of a decision.

Correct Answer: C

 

Correct Answer

Answer C is correct because the best decisions after information cost 0.40 times 70,000 plus 0.60 times 80,000, or 76,000 in expectation. Information therefore provides 4,000 gross expected value, less than its 6,000 fee; studying increases expected total cost by 2,000.

Incorrect Answers

Answer A is incorrect because the difference between branch costs is not the expected value of information. The result probabilities and the no-study decision determine the 4,000 gross improvement, which does not cover the fee.

Answer B is incorrect because 76,000 is the expected cost after using the information but before buying it. Adding the required 6,000 fee gives 82,000, so the proposed saving omits the information-acquisition cost.

Answer D is incorrect because 70,000 plus 6,000 describes only the favorable branch. The unfavorable result has 60% probability and must also contribute to the expected total before comparing the study with the current decision.

Answer E is incorrect because imperfect information can improve decisions, and the supplied conditional values imply 4,000 gross expected value here. The reason to decline is that the 6,000 acquisition cost exceeds that value, not that only perfect information is useful.

 

Question 24

A hybrid project records one threat that a customs hold may delay delivery and another that the same hold may delay installation. Both estimates include the same 40,000 standby charge. The team is preparing an aggregate exposure view. Which two steps are appropriate? Choose TWO.

1. Divide every consequence by two without checking which costs actually overlap.
2. Map the hold, delivery delay and installation effect as a linked causal path.
3. Count the shared standby charge once while retaining distinct additional consequences.
4. Add both 40,000 charges because the risks have different register identifiers.
5. Delete the installation consequence because only the earliest event can affect objectives.
6. Assume the two entries are independent because different workstream owners reported them.

Correct Answers: B, C

 

Correct Answers

Answer B is correct because the records describe connected stages of one event’s consequences. A causal view clarifies which uncertainty is shared and where genuinely additional impacts may arise.

Answer C is correct because aggregation should not add the same loss twice. Preserving separate incremental effects still gives visibility of the full impact without inflating the exposure through duplicate accounting.

Incorrect Answers

Answer A is incorrect because blanket adjustment could understate genuine additional losses. The correct reconciliation distinguishes the shared 40,000 charge from separate incremental consequences.

Answer D is incorrect because record identifiers do not create separate economic losses. The same standby cost remains one consequence even when it appears in two descriptions.

Answer E is incorrect because downstream effects can matter substantially. They should remain visible in the causal assessment even though a shared cost must not be duplicated.

Answer F is incorrect because ownership does not determine causal independence. The scenario explicitly ties both consequences to the same customs hold.

 

Question 25

A hybrid team’s qualitative risk matrix uses ordered categories from 1 to 5. The category numbers are ranking labels, not measured probabilities or monetary amounts. Managers want a consistent prioritization view across workstreams. Which three practices are appropriate? Choose THREE.

1. Use the agreed matrix to prioritize discussion and response planning.
2. Sum the category products and label the result as the required currency reserve.
3. Report a score of 4 as exactly twice the financial loss of a score of 2.
4. Retain the underlying rationale and uncertainty behind each category assignment.
5. Calibrate the category descriptions against shared project examples.
6. Convert likelihood category 3 into a 60% probability simply because the scale ends at 5.

Correct Answers: A, D, E

 

Correct Answers

Answer A is correct because the matrix can provide a structured relative ordering within its defined method. That is a suitable use of qualitative categories even though the result is not a financial exposure estimate.

Answer D is correct because a compact score can conceal different evidence quality and assumptions. Keeping that context allows reviewers to challenge a rating or update it when better information appears.

Answer E is correct because common examples help different teams apply the same likelihood and impact anchors. This improves comparability without pretending that an ordinal label is a measured quantity.

Incorrect Answers

Answer B is incorrect because dimensionless qualitative scores cannot directly establish a monetary funding amount. A reserve estimate requires an appropriate analysis of financial consequences and uncertainty.

Answer C is incorrect because ordered categories do not establish ratio-scale monetary relationships. The labels indicate an ordering under the matrix, not a measurable doubling of loss.

Answer F is incorrect because dividing a category label by the maximum invents numerical calibration that the method does not supply. Any probability range must come from defined anchors and supporting evidence.

 

Question 26

During refinement, an adaptive team adds a previously unplanned dependency on a third-party identity service. The next annual risk workshop is nine months away. No outage has occurred, but the dependency may affect future releases. What should the team do?

1. Assume the dependency is covered by the team’s original generic supplier risk.
2. Review the new dependency only in the retrospective after its first production release.
3. Wait for the annual workshop because the risk register was already approved.
4. Open a current outage issue even though the service is operating normally.
5. Identify and assess the new dependency risk during current planning.

Correct Answer: E

 

Correct Answer

Answer E is correct because risk identification should respond to new information throughout delivery. The dependency is already relevant to upcoming work, so the team can assign an owner and consider appropriate responses now.

Incorrect Answers

Answer A is incorrect because a broad entry may not contain the new service’s failure paths, ownership or release consequences. The team should examine the specific exposure rather than presume coverage.

Answer B is incorrect because retrospective learning is useful, but the dependency can affect the upcoming commitment. Identifying and assessing it now allows a response before the team becomes exposed in production.

Answer C is incorrect because approval does not make a register complete for future changes. Waiting nine months would leave a newly introduced exposure outside current release planning.

Answer D is incorrect because a possible future outage is an uncertainty, not an existing failure. The record should accurately reflect the current condition while enabling preventive action.

 

Question 27

Two predictive workstreams report a 5% interruption probability. One estimate means at least one interruption during a single day; the other means at least one interruption during the entire six-month project. Managers want to compare exposure over the project duration. What is needed first?

1. Align the exposure periods and assumptions before comparing the probabilities.
2. Multiply the daily percentage by the number of project days and cap the answer at 100%.
3. Average the two percentages and use 5% as the project-wide value.
4. Treat the risks as equally likely because both entries state 5%.
5. Discard the daily estimate because its time basis differs from the required project horizon.

Correct Answer: A

 

Correct Answer

Answer A is correct because the same numerical percentage describes different events when its time horizon changes. A meaningful project-level comparison needs consistent definitions and a justified treatment of repeated daily exposure.

Incorrect Answers

Answer B is incorrect because capping prevents an impossible displayed number but does not supply a valid cumulative-probability model. Repeated exposure requires assumptions about the event definition and dependence across days before conversion.

Answer C is incorrect because averaging retains the mismatch between event horizons. It does not transform either estimate into a comparable probability for the intended period.

Answer D is incorrect because identical percentages are not comparable when one describes a day and the other six months. The event definitions must be reconciled before drawing that conclusion.

Answer E is incorrect because the daily evidence may still inform a project-period assessment after its exposure and dependence assumptions are established. A different time basis calls for justified normalization, not automatic exclusion.

 

Question 28

A hybrid project’s steering group accepted a data-recovery threat on the condition that possible downtime remained below four hours. New evidence shows that recovery may require seven hours. The event has not occurred. Which two actions are appropriate? Choose TWO.

1. Keep the acceptance valid until the next actual outage proves the estimate.
2. Ask the technical analyst to raise the permitted downtime to seven hours in the register.
3. Update the assessment with the seven-hour consequence and its supporting evidence.
4. Close the threat and open a seven-hour outage issue immediately.
5. Return the changed exposure for an authorized treatment or acceptance decision.
6. Keep four hours in the governance report and place the seven-hour estimate only in technical notes pending approval.

Correct Answers: C, E

 

Correct Answers

Answer C is correct because the acceptance decision rested on an impact boundary that the new estimate exceeds. The current risk record should reflect the changed exposure rather than retain the obsolete four-hour basis.

Answer E is correct because the original conditional acceptance does not cover seven hours. The responsible authority needs to consider additional response options or explicitly decide on the larger exposure.

Incorrect Answers

Answer A is incorrect because the known change already invalidates a stated condition of the decision. Waiting for realization would bypass prospective risk management.

Answer B is incorrect because estimating consequences and authorizing tolerance are different responsibilities. The analyst’s evidence supports a decision but does not grant authority to change the boundary.

Answer D is incorrect because no outage has occurred. The correct action concerns a changed risk assessment, not recording an actual service interruption.

Answer F is incorrect because the revised estimate is evidence about exposure, while approval concerns what to do about it. Decision-makers need the current consequence to reconsider the conditional acceptance; withholding it from the decision report reverses that sequence.

 

Question 29

A predictive project recorded a risk that a required permit might arrive after the equipment installation date. The permit has now been issued, validated for the planned installation and made available to the team before that date. Other installation risks remain open. What should happen to this specific threat?

1. Keep the permit-arrival probability unchanged until the entire project closes.
2. Leave the permit-arrival threat open until the full installation is accepted.
3. Close every installation risk because the permit has been obtained.
4. Close the permit-arrival threat with evidence and retain other relevant risks.
5. Transfer the permit-arrival entry into the issue log as a recovery task because its milestone has been reached.

Correct Answer: D

 

Correct Answer

Answer D is correct because the uncertain late-arrival event can no longer occur under the stated facts. Documented closure removes an expired threat while preserving unrelated installation exposures.

Incorrect Answers

Answer A is incorrect because the relevant uncertainty has been resolved, so the old probability no longer represents current exposure. Historical information can be retained without presenting the threat as active.

Answer B is incorrect because the specific uncertainty concerns receipt of a valid permit before installation, and that condition is now resolved. Waiting for unrelated acceptance would keep an expired threat active instead of tracking the remaining installation risks separately.

Answer C is incorrect because permit availability addresses only one condition. It does not establish that equipment, resources or other installation dependencies are free of uncertainty.

Answer E is incorrect because the permit arrived in time and supports the planned installation, so there is no realized delay requiring recovery. Evidence-based risk closure accurately records the resolved uncertainty.

 

Question 30

A hybrid project’s approved plan specifies a primary contingency if a data feed fails. If that contingency cannot produce a verified file within two hours, a tested manual fallback is authorized. The feed has failed; two hours have passed without a verified file, and manual capacity is available. What should the owner do?

1. Continue the primary contingency indefinitely because it was the first approved response.
2. Activate the authorized manual fallback and track restoration evidence.
3. Wait for a new sponsor approval before using the already authorized fallback.
4. Send the fallback request to operations and stop tracking restoration once the request is acknowledged.
5. Activate both responses without coordinating their outputs or ownership.

Correct Answer: B

 

Correct Answer

Answer B is correct because the explicitly defined fallback condition has been met, and the required capacity exists. Continuing response tracking verifies whether the alternate method restores the needed capability.

Incorrect Answers

Answer A is incorrect because the plan includes a two-hour limit precisely to prevent unbounded reliance on an ineffective response. That limit has now been reached.

Answer C is incorrect because the stated approval covers this condition. Adding an unnecessary decision delay would postpone restoration without addressing an authority gap.

Answer D is incorrect because acknowledgment establishes a handoff, not a restored verified file. The owner must carry the authorized fallback through execution and evidence that the affected capability has recovered.

Answer E is incorrect because parallel operation can create conflicting files or duplicate work if it is not part of the approved method. The plan calls for a defined fallback after the primary fails its threshold.

 

Question 31

A predictive analysis models two independent threats during the same project period. A has a 20% probability and B a 30% probability. The stated independence assumption is accepted for this exercise. What is the probability that at least one occurs?

1. 56%, found by multiplying the probabilities that each does not occur.
2. 50%, found by adding 20% and 30% without adjustment.
3. 44%, found by subtracting the 56% chance of neither from 100%.
4. 30%, using the more likely of the two threats.
5. 6%, found by multiplying 20% by 30%.

Correct Answer: C

 

Correct Answer

Answer C is correct because under independence, neither occurs with probability 0.80 times 0.70, or 0.56. Its complement is 0.44, which includes either threat alone and both together without double counting.

Incorrect Answers

Answer A is incorrect because this correctly calculates neither event occurring, which is the complement of the requested event. Subtracting it from 100% gives the answer.

Answer B is incorrect because both threats can occur in the same period. Adding their probabilities counts that overlap twice; independence makes the overlap 6%, giving 44% after adjustment.

Answer D is incorrect because choosing the larger individual probability omits occasions when A occurs and B does not. The combined event includes more than the more likely threat alone.

Answer E is incorrect because that product is the probability that both occur under independence. The question includes cases where only one occurs, so the required probability is larger.

 

Question 32

An adaptive release has two nonnegotiable response limits: residual disruption probability at most 6% and no more than four days of additional delivery time. All proposed responses have equal cost. A leaves 2% risk but adds seven days; B leaves 5% and adds three days; C leaves 8% and adds no days. Which recommendation satisfies the authorized limits?

1. Choose C because avoiding extra delivery time has no implementation delay.
2. Average A’s and C’s results and approve both as a combined response.
3. Choose A because the smallest residual probability must take priority.
4. Defer the decision until the sponsor ranks risk reduction against delivery speed.
5. Choose B because it satisfies both the risk and delivery-time limits.

Correct Answer: E

 

Correct Answer

Answer E is correct because response B’s 5% residual likelihood is below the 6% ceiling and its three-day addition is within four days. The decision must respect both constraints rather than optimize one in isolation.

Incorrect Answers

Answer A is incorrect because response C satisfies the time boundary but leaves risk above the 6% ceiling. The absence of added days is insufficient under the two stated limits.

Answer B is incorrect because no evidence establishes that combining the responses produces their average probability or duration. That calculation invents a fourth option without a supported combined-effect assessment.

Answer C is incorrect because response A reduces the threat most but exceeds the nonnegotiable delivery-time limit. A favorable result on one dimension does not authorize violating the other.

Answer D is incorrect because the authorized limits already identify a feasible option. A preference ranking is unnecessary to reject A and C because each violates a nonnegotiable boundary in this decision.

 

Question 33

A facility project proposes a flood barrier and a backup generator as risk responses. Each meets its requirements when assessed separately. The project engineer finds that the proposed barrier would obstruct the generator cooling inlet, triggering its mandatory protective shutdown during backup operation. Both flood protection and continuous backup power are required. Funding and staffing are sufficient. Which TWO actions are needed before accepting the paired response? Choose TWO.

1. Assess the secondary power-loss exposure caused by the barrier and generator interaction.
2. Develop and verify a combined design that provides flood protection while preserving the required generator cooling.
3. Lower the barrier to clear the cooling inlet and retain its original flood-protection assessment.
4. Average the original flood and power residual-risk ratings to determine whether the pair is acceptable.
5. Approve both responses on their separate assessments because the budget and staffing are sufficient.
6. Accept the pair after assigning operations to monitor generator temperature during backup operation.

Correct Answers: A, B

 

Correct Answers

Answer A is correct because the barrier reduces flood exposure but introduces a different path to loss of backup power. The engineer’s finding must inform the combined residual and secondary risk assessment; separate response ratings do not capture this interaction.

Answer B is correct because both requirements must be met together. A compatible design and combined verification must demonstrate that the barrier preserves flood protection without causing the stated cooling obstruction and protective shutdown.

Incorrect Answers

Answer C is incorrect because changing the barrier may be part of a viable redesign, but its original flood assessment cannot establish the performance of the altered design. Both protection requirements must be reassessed and verified for the combined configuration.

Answer D is incorrect because the original ratings exclude the newly identified interaction. Averaging them cannot represent the causal path from cooling obstruction to generator shutdown or demonstrate compliance with either mandatory requirement.

Answer E is incorrect because available resources do not resolve the documented physical incompatibility. The generator can satisfy its separate assessment and still shut down when operated behind the proposed barrier.

Answer F is incorrect because monitoring may provide warning but does not remove the obstruction or demonstrate continuous backup power. With protective shutdown required under the stated condition, an assigned observer alone cannot make the combined design acceptable.

 

Question 34

A risk analyst varies uncertain demand and supplier unit price one at a time while holding other inputs fixed. The largest resulting cost increases are 120,000 and 20,000. Evidence suggests demand and price can rise together, but no joint probability model has been built. The sponsor asks whether 140,000 is therefore the 90th-percentile contingency. What should the analyst explain?

1. Use 140,000 because adding the two maximum sensitivities gives the required confidence level.
2. Use 120,000 because the largest sensitivity already includes the smaller driver’s uncertainty.
3. The separate sensitivities do not establish a joint percentile; model their uncertainty and dependence first.
4. Use the 70,000 midpoint of zero and the summed sensitivities as the 90th percentile.
5. Model the two inputs as independent because they were varied separately in the sensitivity exercise.

Correct Answer: C

 

Correct Answer

Answer C is correct because one-at-a-time changes show responsiveness to individual assumptions. A 90th-percentile allowance needs a distribution of combined outcomes, including the supported relationship between demand and price; adding two swings supplies neither that distribution nor its probability.

Incorrect Answers

Answer A is incorrect because the arithmetic sum does not identify how often that combined change occurs. A percentile requires a joint uncertainty model, and interactions may also mean the total response is not the simple sum of isolated swings.

Answer B is incorrect because the other inputs were held fixed when each sensitivity was calculated. The demand result therefore does not already capture the separate price uncertainty or its dependence on demand.

Answer D is incorrect because a midpoint is not a probability estimate, and the isolated swings do not define a joint range or distribution. Neither averaging nor adding the endpoints establishes a 90% confidence allowance.

Answer E is incorrect because varying inputs separately is an analysis technique, not evidence of independence. The observed tendency to rise together must be evaluated in the combined risk model.

 

Question 35

A hybrid project’s residual security-related threat exceeds the project’s delegated tolerance. Two feasible treatments require funding beyond the manager’s authority. Specialists have assessed both, and the steering group must decide at its next meeting. Which three elements belong in the decision package? Choose THREE.

1. A recommendation identifying the required approval and accountable follow-through.
2. Ask the steering group to fund the lowest-cost treatment without showing the residual-exposure comparison.
3. The current exposure, decisive assumptions and limits of the supporting evidence.
4. Mark the threat as accepted pending funding because two feasible treatments are available.
5. A purchase commitment for the preferred treatment made before the meeting to preserve momentum.
6. A comparison of the treatments’ costs, expected effects and secondary exposures.

Correct Answers: A, C, F

 

Correct Answers

Answer A is correct because a decision-ready package should connect the analysis to a specific request and the people who will implement and monitor the selected response. This preserves the boundary between managerial recommendation and governance authorization.

Answer C is correct because the steering group needs to understand what is uncertain and why the current state exceeds delegated tolerance. Stating confidence limits prevents a precise-looking rating from hiding weak assumptions.

Answer F is correct because the authorized decision is a tradeoff between feasible responses. Showing financial requirements and remaining or newly introduced risks allows the group to assess the full implications of each choice.

Incorrect Answers

Answer B is incorrect because price alone does not establish that a response brings the security-related exposure within an acceptable boundary. The group needs the specialists’ effect and secondary-risk analysis to make the funding tradeoff.

Answer D is incorrect because having feasible treatments does not authorize acceptance of exposure above delegated tolerance. The steering group must decide on the treatment or acceptance, and the current risk remains visible while that decision is pending.

Answer E is incorrect because the manager lacks the required funding authority. Committing first would preempt the steering group’s decision and create an obligation outside the delegated boundary.