PMI-RMP PMI Risk Management Professional (PMI-RMP) Exam Free Practice Exam Questions (2026 Updated)

The risk manager should have their team review the scope of work and requirements to ensure they understand the project ' s objectives and deliverables. Additionally, reviewing the risk management plan will help the team understand the risk management process, roles, and responsibilities, and prepare for the risk identification workshop.

According to the PMBOK® Guide – Sixth Edition1, the scope of work and requirements are key inputs for the risk identification process, as they define the project boundaries, deliverables, assumptions, and constraints. The risk management plan is also an essential input, as it provides the guidelines and framework for how risk management will be performed throughout the project. The other options are not relevant for risk identification, as they are either related to other processes (such as Monte Carlo analysis for quantitative risk analysis) or not directly related to the project risks (such as the list of pre-approved contractors or the organization chart for city permit department). References: PMBOK® Guide – Sixth Edition, pages 397-398.

Lessons learned from previous projects are critical for effective risk identification because they provide insights into what risks materialized, how they were managed, and what could have been improved. According to the PMBOK® Guide:

“Lessons learned from previous projects are organizational process assets that should be reviewed during risk identification to avoid repeating past mistakes and to leverage successful risk responses.”

— PMBOK® Guide, 6th Edition, Section 11.2.2.1 (Organizational Process Assets)

These assets enable proactive identification and management of similar risks in the new project.

Qualitative risk analysis requires consideration of both the likelihood and the impact of each risk to properly prioritize them, rather than focusing only on probability or only on impact. The PMBOK® Guide states:

" During qualitative risk analysis, risks are prioritized for further analysis or action by assessing and combining their probability of occurrence and impact on project objectives. "

— PMBOK® Guide, 6th Edition, Section 11.3

Therefore, the risk manager should evaluate all identified risks, considering both likelihood and impact.

To determine whether to purchase the new component, we can perform an Expected Monetary Value (EMV) analysis for both scenarios: purchasing the component and not purchasing it.

1. Purchasing the New Component:

Probability of Success: 70% (0.7)

Profit if Successful: US$500,000

EMV of Success: 0.7 * $500,000 = $350,000

Probability of Failure: 30% (0.3)

Additional Cost if Failed: US$50,000

EMV of Failure: 0.3 * (-$50,000) = -$15,000

Cost of Component: -$100,000

Total EMV: $350,000 (success) - $15,000 (failure) - $100,000 (cost) = $235,000

2. Not Purchasing the New Component:

Probability of Failure: 80% (0.8)

Cost if Failed: US$250,000

EMV of Failure: 0.8 * (-$250,000) = -$200,000

Probability of Success: 20% (0.2)

Profit if Successful: US$0 (assuming no additional profit without the component)

EMV of Success: 0.2 * $0 = $0

Total EMV: $0 (success) - $200,000 (failure) = -$200,000

Comparing the two scenarios, purchasing the new component yields a positive EMV of $235,000, whereas not purchasing it results in a negative EMV of -$200,000. Therefore, from a risk management perspective, it is advisable to purchase the new component.

PMI Risk Management Study Guide References:

The PMI-RMP Exam Preparation Study Guide discusses the application of Expected Monetary Value (EMV) analysis in decision-making under uncertainty, providing a structured approach to evaluate potential financial outcomes.

In agile projects, the risk burndown chart is used to monitor the reduction of project risk over time. If risk exposure is found to be increasing, it is essential to act immediately by selecting and implementing risk mitigation actions that can reduce exposure in upcoming iterations. The PMI “Agile Practice Guide” and the PMBOK® Guide state:

“In agile projects, risks are identified and managed continuously. When risk exposure is high, mitigation actions (often called ‘risk mitigation stories’) should be prioritized in the next iteration or sprint to bring exposure back to acceptable levels.”

— Agile Practice Guide, PMI, Section 5.7 (Responding to Risks in Agile Projects)

“Project teams may develop risk response actions as work items and prioritize these for execution in the backlog, particularly in iterative and incremental environments.”

— PMBOK® Guide, 6th Edition, Section 11.6.2.3

Therefore, prioritizing risk mitigation stories for the next sprint (Option C) is the most effective and officially recommended response.

After analyzing the information collected from individual project team members, the risk manager ' s primary output is an updated risk register. The risk register is a key document in risk management, containing all identified risks, their analysis, and the planned responses. As new information is gathered and analyzed, the risk register is updated to reflect the current status of each risk, any changes in their probability or impact, and any adjustments to the risk response plans.

PMI emphasizes that the risk register should be continually updated throughout the project to ensure that all risks are properly managed and documented​​.

Including both internal and external stakeholders ensures diverse perspectives and comprehensive risk identification. PMBOK® Guide states:

" Stakeholder participation, including both internal and external stakeholders, is essential during risk identification to ensure a broad and complete identification of risks. "

— PMBOK® Guide, 6th Edition, Section 11.2

When a project is delayed, and all contingency reserves have been exhausted, the next step is to escalate the situation to upper management. This escalation allows for additional resources or support to be considered and for strategic decisions to be made at a higher level. According to PMI’s risk management practices, escalation is a key strategy when risks exceed the project ' s control, requiring input or intervention from senior management to resolve​.

Top of Form

Bottom of Form

An affinity diagram is a tool used to visually organize and group risks or ideas based on their similarities and categories. It helps in structuring the risks for further analysis and discussion. (Reference: PMBOK Guide, 6th Edition, p. 138)

 According to the PMBOK Guide, an affinity diagram is a tool and technique for the identify risks process that allows large numbers of ideas to be sorted into groups for review and analysis. An affinity diagram can help the risk manager to visually organize the risks identified in the pre-workshop survey by grouping them into categories based on their similarities or common characteristics. This can help the risk manager to facilitate the risk analysis and prioritization in the workshop, as well as to stimulate new patterns of thinking and generate additional risks.

Some of the other options are not relevant or appropriate for the question scenario:

The analytical hierarchy process is a technique for the plan risk management process that provides a method for comparing and ranking alternatives based on multiple criteria. It is not a tool for visually organizing risks.

A SWOT analysis is a technique for the identify risks process that examines the project from the perspective of its strengths, weaknesses, opportunities, and threats. It is not a tool for visually organizing risks, but rather for generating them.

Assigning probability and impact is a technique for the perform qualitative risk analysis process that assesses the likelihood and the potential effect of each individual risk on the project objectives. It is not a tool for visually organizing risks, but rather for evaluating them.

PMBOK Guide, 6th edition, pages 397-399, 414-415, 431-432, 441-442; PMI-RMP Exam Content Outline, 2015, page 7.

In this scenario, the risk manager is considering a response that could lead to a significant residual risk—excessive additional costs due to overtime. Before proceeding, it is crucial to confirm that the project sponsor is comfortable with the risk appetite for this potential outcome. This step is essential to ensure that the decision to allow overtime aligns with the sponsor ' s tolerance for additional costs and the overall project risk management strategy. According to the Risk Management Procedure, understanding and aligning with the sponsor ' s risk appetite is a critical step before implementing risk responses that could impact the project ' s financials​. This approach ensures that all stakeholders are aware of and agree to the potential consequences of the chosen risk response strategy.

The correct answer is C. Perform a quantitative risk analysis to determine the potential financial impact of government-related delays.

The key phrase in this question is that the sponsor wants the risk manager to estimate the potential costs associated with delays . Once cost impact needs to be measured numerically, the appropriate approach is quantitative risk analysis . Quantitative analysis is used when the organization needs a numerical estimate of risk effects on project objectives such as cost and schedule.

In this case, the delays caused by bureaucratic and administrative processes need to be translated into potential financial impact. That means the risk manager should use quantitative techniques to evaluate possible cost exposure and support decision-making.

Why the other options are incorrect:

A. Create a risk register to document all potential risks and estimated impacts, including delays due to government employees. The risk register is important for documentation, but it does not itself provide the analytical method needed to estimate financial impact in measurable terms.

B. Develop a risk response plan that includes specific mitigation strategies for government-related delays. Response planning comes after the risk has been sufficiently analyzed. The question is specifically asking how to estimate the potential costs first.

D. Conduct a qualitative risk analysis to assess the likelihood and impact of potential delays. Qualitative analysis helps rank or prioritize risks using relative scales such as low, medium, or high. It does not produce the detailed monetary estimate the sponsor requested.

Best-practice reasoning:

When management needs to understand the numeric cost consequences of uncertainty, quantitative analysis is the correct tool. It supports contingency planning, reserve estimation, and better-informed stakeholder decisions.

Reference-aligned basis:

This answer is consistent with standard risk management guidance that emphasizes:

quantitative analysis for numerical evaluation of cost and schedule impacts,

use of quantified exposure to support planning and decision-making,

distinction between qualitative prioritization and quantitative estimation.

Effective communication with sponsors and stakeholders about both primary and secondary risks is crucial. PMBOK® Guide states:

" Secondary risks... should be communicated to stakeholders and sponsors to ensure transparency and allow for appropriate responses. "

— PMBOK® Guide, 6th Edition, Section 11.5

The risk owner should implement the secondary risk response, as it is now being tolerated, and update the project documents accordingly. They should also update and communicate the assessments of the secondary risk ' s impact to ensure everyone is aware of the situation.

According to the PMI-RMP Handbook1, the risk owner is responsible for implementing the risk response plan and monitoring the risk and its secondary risks. Therefore, the risk owner should take the following two actions when the secondary risk emerges:

Implement the secondary risk response and update the project documents. This action is consistent with the risk response strategy of tolerance, which means accepting the risk and its consequences. The risk owner should execute the planned response for the secondary risk, such as contingency plans or fallback plans, and update the relevant project documents, such as the risk register, the risk report, and the lessons learned register, to reflect the current status and impact of the risk.

Update and communicate assessments of the secondary risk’s impact. This action is consistent with the risk monitoring and control process, which involves tracking the identified risks, evaluating their impact and probability, and reporting the risk information to the appropriate stakeholders. The risk owner should reassess the secondary risk’s impact on the project objectives, such as scope, schedule, cost, and quality, and communicate the results to the project manager and other relevant stakeholders, such as the sponsor, the customer, and the team members.

PMI-RMP Handbook1

PMBOK Guide, 6th edition, Chapter 11: Project Risk Management2

The project manager should have performed an analysis to ensure that the change request was valid and well-supported before submitting it to the sponsor. This would help in making a strong case for the change request and increase the chances of its approval.

The project manager should have performed an analysis to affirm the request is valid before submitting, as this would help to justify the need for the change and to demonstrate its impact on the project objectives, scope, schedule, cost, quality, and risk. The project manager should also have consulted with the project team, the subcontractor, and the risk owner to determine the best risk response strategy and to estimate the resources and time required for the change. By performing an analysis, the project manager could have increased the chances of getting the change request approved by the sponsor and avoided wasting time and effort on an invalid request. References: The Standard for Risk Management in Portfolios, Programs, and Projects, page 79; PMBOK Guide, 6th edition, page 115.

The project manager should escalate this initiative to project decision makers and sponsors, as they have the authority to approve changes in budget and scope. They can evaluate the potential benefits and associated with the new technology and make an informed decision on whether to proceed.

 According to the PMBOK® Guide1, an opportunity is a risk that would have a positive effect on one or more project objectives if it occurs. Opportunities are uncertain events or conditions that can enhance or facilitate the achievement of project goals, such as cost savings, schedule acceleration, quality improvement, or scope expansion. A project manager should take advantage of opportunities by implementing risk responses that seek to maximize their probability and/or positive impact. In this case, the project manager wants to introduce a new technology to improve the project’s performance, which is an opportunity for the project. The project manager should take advantage of this opportunity by planning and executing appropriate risk responses, such as exploiting, enhancing, sharing, or accepting the opportunity. This is part of the Plan Risk Responses and Implement Risk Responses processes in the PMBOK® Guide1. References: 1: A Guide to the Project Management Body of Knowledge (PMBOK® Guide) – Sixth Edition.

The correct answer is B. Conduct a retrospective meeting with stakeholders and inquire about what went well and what could be improved on future projects.

The question focuses on a completed project and asks what the risk manager should do after the executive sponsor requests a deep review of what went wrong for the benefit of future projects. This is a classic lessons learned and risk closure activity. A retrospective with stakeholders is the most complete and effective approach because it captures multiple perspectives on what happened, what worked, what failed, and what should be improved in future similar initiatives.

A retrospective goes beyond reviewing documents. It helps uncover root causes, process gaps, missed warning signs, ineffective responses, communication failures, and organizational learning opportunities. Because the company plans to develop more web applications, the objective is not only to analyze the past but also to improve future risk management and delivery performance.

Why the other options are incorrect:

A. Gather the project ' s status reports and meeting minutes to determine when issues occurred and how quickly the issues were addressed. These documents may support the review, but they are not enough by themselves for a full deep-dive. They provide historical evidence but not the richer insight gained from stakeholder reflection.

C. Work with the project manager to determine if additional resources could have prevented or mitigated the issues that arose on the project. This is too narrow. The project may have suffered from many causes beyond resource limitations, including planning weaknesses, requirements issues, inadequate risk responses, vendor problems, or governance gaps.

D. Review the project ' s risk register and determine how comprehensive and effective each risk and issue response was. Reviewing the risk register is useful, but it is still narrower than a full retrospective. Some realized issues may never have been captured properly in the register, and the sponsor requested a broader deep-dive into what went wrong overall.

Best-practice reasoning:

At project closure, organizations should capture lessons learned through structured review with relevant stakeholders. This supports continuous improvement, improves future risk identification and response planning, and strengthens organizational process assets.

Reference-aligned basis:

This answer is consistent with standard risk management guidance that emphasizes:

lessons learned and retrospective reviews at project or phase closure,

stakeholder participation in evaluating what worked and what did not,

updating organizational knowledge for future projects.

The risk manager should update the risk priorities in the risk register and facilitate the selection of appropriate response strategies for the risks that are now considered high priority.

Option C is correct because risk information must be updated whenever reassessment identifies a change in risk exposure. If the original schedule and budget impacts were underestimated, the risk register should be revised to reflect the new information.

Updates may include:

• Revised probability ratings.

• Revised cost and schedule impacts.

• Revised probability-and-impact scores.

• Updated risk priorities.

• Changes in urgency or proximity.

• Updated risk triggers.

• Updated risk owners and action owners.

• Revised residual and secondary risks.

• New escalation requirements.

• Changes to contingency or management reserves.

Accurate and current risk information enables stakeholders to make informed decisions and ensures that attention and resources are directed toward the most significant risks.

Option D is correct because risks that have increased to a high-priority level require appropriate response planning. A risk-planning workshop allows the relevant stakeholders, risk owners, construction specialists, cost experts, schedule experts, contractors, and project leadership to select and agree on suitable response strategies.

For threats, the available response strategies may include:

• Avoid.

• Mitigate.

• Transfer.

• Escalate.

• Accept.

The workshop should also define response actions, responsibilities, deadlines, required resources, triggers, contingency plans, fallback plans, and reporting requirements.

Option A may be useful for determining why the original assessments were inaccurate. However, it is not one of the two most immediate actions. The priority is to update the risk information and plan appropriate responses.

Option B is incorrect because automation does not correct inaccurate risk assessments or determine suitable responses. Automated tracking is only effective when the underlying data and criteria are accurate.

Option E may be useful in certain circumstances, but predictive analytics is only one possible analysis technique. The question already states that the risks are being reassessed. The immediate required actions are to update the risk priorities and develop appropriate responses.

The correct answer is B. Perform sensitivity analysis.

Sensitivity analysis is used to determine which individual risks or uncertainties have the greatest effect on overall project outcomes . It helps the risk manager understand which variables or risks matter most and therefore where response efforts are most critical. In this question, the risk manager wants to know which risk will have an impact on the project outcome and to assess the effectiveness of response planning by understanding impact drivers. Sensitivity analysis is the best fit for that purpose.

This technique is commonly used in quantitative risk analysis to identify which uncertainties most influence objectives such as cost, schedule, or performance. It often supports prioritization of risk responses by showing where management attention will produce the greatest benefit.

Why the other options are incorrect:

A. Perform Pareto analysis. Pareto analysis helps identify the most significant contributors among a group of causes or issues, but it is not the primary risk analysis technique used to determine which uncertainties most affect project outcomes in a structured risk context.

C. Perform contingency analysis. Contingency analysis is not the standard technique for identifying which risks most influence project outcomes. Contingency reserves may be determined from risk analysis results, but this option does not directly answer the question.

D. Perform qualitative analysis. Qualitative analysis assesses probability, impact, urgency, and other relative characteristics, but it does not specifically show how much each risk affects the final project outcome compared with others. Sensitivity analysis provides that deeper insight.

Best-practice reasoning:

When a project team needs to identify the risks with the greatest influence on outcomes, sensitivity analysis is the preferred method because it isolates the variables that drive uncertainty and highlights where response plans matter most.

Reference-aligned basis:

This answer is consistent with standard risk management guidance that emphasizes:

sensitivity analysis as a method to determine which risks have the greatest potential effect on project results,

use of analysis outputs to focus response planning and management attention,

support for quantitative understanding of outcome drivers.

According to the PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1, the risk manager should request the risk management plan first from the project sponsor to identify major risks. This is because:

The risk management plan is a document that describes how risk management activities will be planned, structured, and performed throughout the project life cycle. The risk management plan provides guidance and direction for the risk manager and the project team on how to identify, analyze, prioritize, respond, and monitor risks, as well as how to allocate resources, define roles and responsibilities, establish risk categories, and document risk-related information.

The risk management plan is a key input for the risk identification process, which is the process of determining which risks may affect the project and documenting their characteristics. The risk identification process involves using various tools and techniques, such as brainstorming, interviews, checklists, assumptions and constraints analysis, SWOT analysis, expert judgment, and data gathering, to generate a comprehensive list of potential risks that may impact the project objectives, such as scope, schedule, cost, quality, or stakeholder satisfaction.

The risk management plan helps the risk manager to identify major risks by providing the following information:

The risk management strategy, which defines the approach and methodology for managing risks, including the level of detail, rigor, and frequency of the risk management activities, and the alignment with the project management plan and the organization’s policies and procedures.

The risk thresholds, which specify the acceptable level of risk exposure for the project and its objectives, based on the risk appetite, tolerance, and attitude of the project sponsor and other key stakeholders.

The risk categories, which are a group of potential causes of risk that can be used to structure and organize the identified risks into a hierarchical structure, such as a risk breakdown structure (RBS). The risk categories can be derived from various sources, such as the project scope statement, the work breakdown structure (WBS), the organizational process assets, or the industry standards and practices.

The roles and responsibilities, which define the authority and accountability of the project team members and other stakeholders involved in the risk management process, such as the risk manager, the risk owner, the risk committee, the risk auditor, and the risk reviewer.

The resources, which specify the budget, time, and human resources allocated for the risk management process, as well as the tools, techniques, and software applications that will be used to support the risk management activities.

The communication and reporting, which describe the type, format, content, frequency, and distribution of the risk-related information and reports that will be shared among the project team and other stakeholders, such as the risk register, the risk report, the risk dashboard, and the risk audit report.

The other options are not the best documents to request first from the project sponsor to identify major risks because:

The clients’ credit scores are a specific type of data that can be used to assess the credit risk of the loans, but they do not provide a comprehensive view of all the potential risks that may affect the project, such as technical, operational, legal, regulatory, or market risks.

The organization’s mission and vision are high-level statements that describe the purpose, values, and goals of the organization, but they do not provide specific guidance or direction on how to manage risks for the project, such as the risk management strategy, methodology, or tools.

The historical data from the credit portfolio are a source of information that can be used to analyze the past performance and trends of the loans, but they do not reflect the current or future uncertainties and opportunities that may impact the project, such as changes in customer behavior, technology, competition, or regulation.

PMBOK Guide, 6th edition, Chapter 11: Project Risk Management1

Risk Management Professional (PMI-RMP)® Exam Cert Guide2