PMI Risk Management Professional PMI-RMP Exam Questions

Answer : A

A risk owner is the person assigned to manage, monitor, and report on a specific risk. When the IT manager has unique insight or control over risks associated with IT infrastructure, they should be formally assigned as a risk owner for those risks. The PMBOK Guide emphasizes:

''Risk owners are identified during the risk management planning process and should be engaged in relevant meetings and risk discussions. Assigning the IT manager as a risk owner ensures proper accountability for IT-related risks.''

--- PMBOK Guide, 6th Edition, Section 11.3.2.1 (Risk Register: Risk Owner)

This promotes ownership, accountability, and effective risk management.

PMBOK Guide, 6th Edition, Section 11.3.2.1

Practice Standard for Project Risk Management, PMI, Section 5.3

Answer : A

According to the PMI Risk Management Professional (PMI-RMP) Examination Content Outline1, a secondary risk is a risk that arises as a direct result of implementing a risk response to a specific risk. In this case, the risk response is to contract an external vendor to provide additional capacity and expertise to the project team. The secondary risk is the confidentiality risk that the contracts department has identified. The risk manager should assess the secondary risk to determine its probability, impact, and priority, and to plan appropriate responses.This is part of the Perform Qualitative Risk Analysis and Plan Risk Responses processes in the PMBOK Guide2.Reference:1: PMI Risk Management Professional (PMI-RMP) Examination Content Outline2: A Guide to the Project Management Body of Knowledge (PMBOK Guide) -- Sixth Edition

Answer : A

When the project team is unsure if a potential change in regulations will affect the project positively or negatively, a SWOT analysis is an appropriate tool to use. SWOT analysis helps the team assess the internal and external factors that might influence the project's outcome. It allows the team to evaluate the strengths, weaknesses, opportunities, and threats associated with the regulatory changes, helping them determine whether the impact will be beneficial or detrimental to the project.

Answer : B

Any change to project scope, regardless of perceived size, should trigger a risk analysis to determine potential impact. The PMBOK Guide states:

'When a change request is submitted, it should be evaluated for potential impact on project objectives, including risk. Analysis of impact is a best practice before implementing any change.'

--- PMBOK Guide, 6th Edition, Section 4.6.2 (Perform Integrated Change Control)

This ensures that the team does not overlook risks associated with even ''minimal'' changes.

PMI PMBOK Guide, 6th Edition, Section 4.6

Practice Standard for Project Risk Management, PMI, Section 5.5

Answer : C

Residual risk refers to the remaining risk after implementing risk responses or controls. In this scenario, despite the policy requiring complex passwords and regular updates, some employees' inability to comply increases the likelihood of password compromise. This non-compliance elevates the residual risk beyond acceptable levels. The risk manager should reassess the residual risk to determine its current status and evaluate whether additional controls or actions are necessary to mitigate the heightened threat. This reassessment ensures that the organization's risk management strategies remain effective and aligned with its security objectives.

PMI Risk Management Study Guide Reference:

The PMI-RMP Exam Preparation Study Guide defines residual risk as 'the risk that remains after risk responses have been implemented,' highlighting the need for continuous monitoring and reassessment to address any changes in risk exposure.

Answer : C

Assigning a risk owner is a foundational principle in risk management, ensuring that each risk has someone fully accountable for monitoring, controlling, and responding to the risk. According to the PMBOK Guide:

'Risk owners should be assigned to each risk. The risk owner is the person responsible for planning an appropriate risk response and ensuring it is implemented as planned.'

--- PMBOK Guide, 6th Edition, Section 11.3.2.1

Without a clearly assigned risk owner, responsibility can be ambiguous, leading to gaps in monitoring and response.

PMBOK Guide, 6th Edition, Section 11.3.2.1

Practice Standard for Project Risk Management, PMI, Section 5.3

Answer : B

The correct answer is B. Conduct a retrospective meeting with stakeholders and inquire about what went well and what could be improved on future projects.

The question focuses on a completed project and asks what the risk manager should do after the executive sponsor requests a deep review of what went wrong for the benefit of future projects. This is a classic lessons learned and risk closure activity. A retrospective with stakeholders is the most complete and effective approach because it captures multiple perspectives on what happened, what worked, what failed, and what should be improved in future similar initiatives.

A retrospective goes beyond reviewing documents. It helps uncover root causes, process gaps, missed warning signs, ineffective responses, communication failures, and organizational learning opportunities. Because the company plans to develop more web applications, the objective is not only to analyze the past but also to improve future risk management and delivery performance.

Why the other options are incorrect:

A . Gather the project's status reports and meeting minutes to determine when issues occurred and how quickly the issues were addressed.

These documents may support the review, but they are not enough by themselves for a full deep-dive. They provide historical evidence but not the richer insight gained from stakeholder reflection.

C . Work with the project manager to determine if additional resources could have prevented or mitigated the issues that arose on the project.

This is too narrow. The project may have suffered from many causes beyond resource limitations, including planning weaknesses, requirements issues, inadequate risk responses, vendor problems, or governance gaps.

D . Review the project's risk register and determine how comprehensive and effective each risk and issue response was.

Reviewing the risk register is useful, but it is still narrower than a full retrospective. Some realized issues may never have been captured properly in the register, and the sponsor requested a broader deep-dive into what went wrong overall.

Best-practice reasoning:

At project closure, organizations should capture lessons learned through structured review with relevant stakeholders. This supports continuous improvement, improves future risk identification and response planning, and strengthens organizational process assets.

Reference-aligned basis:

This answer is consistent with standard risk management guidance that emphasizes:

lessons learned and retrospective reviews at project or phase closure,

stakeholder participation in evaluating what worked and what did not,

updating organizational knowledge for future projects.

PMI, A Guide to the Project Management Body of Knowledge (PMBOK Guide), Monitor Risks and Project/Phase Closure

PMI, Practice Standard for Project Risk Management