You are the project manager of HFD project. You have identified several project risks. You have adopted alternatives to deal with these risks which do not attempt to reduce the probability of a risk event or its impacts. Which of the following response have you implemented?

• A.Acceptance
• B.Mitigation
• C.Avoidance
• D.Contingent response

Correct Answer: D

Explanation/Reference:
Explanation:
Contingent response strategy, also known as contingency planning, involves adopting alternatives to deal with the risks in case of their occurrence. Unlike the mitigation planning in which mitigation looks to reduce the probability of the risk and its impact, contingency planning doesn't necessarily attempt to reduce the probability of a risk event or its impacts. Contingency comes into action when the risk event actually occurs.
Incorrect Answers:
A: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active.
Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to

accept the consequences of the risk.
Active acceptance is the second strategy and might include developing contingency plans and reserves

to deal with risks.
B: Risk mitigation attempts to reduce the probability of a risk event and its impacts to an acceptable level.
Risk mitigation can utilize various forms of control carefully integrated together. The main control types are:
Managerial(e.g.,policies)

Technical (e.g., tools such as firewalls and intrusion detection systems)

Operational (e.g., procedures, separation of duties)

Preparedness activities

C: Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager for your company and a new change request has been approved for your project. This change request, however, has introduced several new risks to the project. You have communicated these risk events and the project stakeholders understand the possible effects these risks could have on your project. You elect to create a mitigation response for the identified risk events. Where will you record the mitigation response?

• A.Risk register
• B.Risk log
• C.Project management plan
• D.Risk management plan

Correct Answer: A

Explanation/Reference:
Explanation:
The Identified risks and potential responses are documented in the risk register. A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
A description of the risk

The impact should this event actually occur

The probability of its occurrence

Risk Score (the multiplication of Probability and Impact)

A summary of the planned response should the event occur

A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the

event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

Incorrect Answers:
B: This is not a valid choice for this question
C: The project management plan is the parent of the risk management plan, but the best choice is the risk register.
D: The risk management plan is an input to the risk response planning, but it is not the best choice for this question

Comment: *

Name: *

Email: *

Verification: *

A web-based service provider with a low risk appetite for system outages is reviewing its current risk profile for online security. Which of the following observations would be MOST relevant to escalate to senior management?

• A.An increase in attempted distributed denial of service (DDoS) attacks
• B.An increase in attempted website phishing attacks
• C.A decrease in remediated web security vulnerabilities
• D.A decrease in achievement of service level agreements (SLAs)

Comment: *

Name: *

Email: *

Verification: *

A risk practitioner has just learned about new malware that has severely impacted industry peers worldwide data loss?

• A.Audit committee
• B.Customer data custodian
• C.Data privacy officer
• D.Customer database manager

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the FIRST step in risk assessment?

• A.Inherent risk identification
• B.Identify risk factors
• C.Review risk governance
• D.Asset identification

Comment: *

Name: *

Email: *

Verification: *