Explanation:
The procurement management plan is not one of the eleven inputs for the risk identification process. The eleven inputs to this process are:

• risk management plan
• activity cost estimates
• activity duration estimates
• scope baseline
• stakeholder register
• cost management plan
• schedule management plan
• quality management plan
• project documents
• enterprise environmental factors
• organizational process assets.

Explanation:
Communication has been identified as one of the biggest reasons for why projects succeeds or fails. Effective communication is essential for good project management.
Communication is a process in which information is passed from one person to another. A manager asks his subordinates to accomplish the task assigned to them. He should successfully pass the information to his subordinates. It is a means of motivating and guiding the employees of an enterprise.
Incorrect Answers:
A: While motivation is one of the important interpersonal skill, but it is not the best answer.
B: Influencing the project stakeholders is a needed interpersonal skill, but it is not the best answer.
D: Political and cultural awareness is an important part of every project, but it is not the best answer for this question

Explanation:
For effective communication, information communicated should not inundate the recipients. All ground rules of good communication apply to communication on risk. This includes the avoidance of jargon and technical terms regarding risk because the intended audiences are generally not deeply technologically skilled. Hence use of technical terms is avoided for effective communication
Incorrect Answers: A, C, D: These all are true for effective risk communication. For effective risk communication the risk information should be clear, concise, useful and timely. Risk information must be known and understood by all the stakeholders. Information or communication should not overwhelm the recipients. This includes the avoidance of technical terms regarding risk because the intended audiences are generally not much technologically skilled.
Any communication on risk must be relevant. Technical information that is too detailed or is sent to inappropriate parties will hinder, rather than enable, a clear view of risk. For each risk, critical moments exist between its origination and its potential business consequence.
Information should also be aimed at the correct target audience and available on need-to-know basis. Hence for effective risk communication risk information should be:

• Clear
• Concise
• Useful
• Timely given
• Aimed at the correct audience
• Available on need-to-know basis

Explanation:
CRO is the individual who oversees all aspects of risk management across the enterprise. Chief risk officer has the main accountability for collecting data and articulating risk. If there is any fault in these processes, then CRO should be answerable.
Incorrect Answers:
A: Enterprise risk committee are the executives who are accountable for the enterprise level collaboration and consensus required to support enterprise risk management (ERM). They are to some extent responsible for articulating risk but are not accounted for it. They are neither responsible nor accounted for collecting data on risk.
B: Business process owner is an individual responsible for identifying process requirements, approving process design and managing process performance. He/she is responsible for collecting data and articulating risk but is not accounted for them.
C: CIO is the most senior official of the enterprise who is accountable for IT advocacy; aligning IT and business strategies; and planning, resourcing and managing the delivery of IT services and information and the deployment of associated human resources. CIO has some responsibility towards collecting data and articulating risk but is not accounted for them.

Explanation: This risk event has the potential to save money on project costs and organization is hiring a vendor to assure that all these saving are being realized. Hence this risk event involves sharing with a third party to help assure that the opportunity take place.
Incorrect Answers:
A: This risk event is not accepted as this event has potential to save money as well as it is shared with a vendor so that all these savings are being realized.
B: The risk event is mitigated when it has negative impacts. But here it is positive consequences (i.e., saving), therefore it is not mitigated.
C: This risk event can be exploited but as here in this scenario, it is stated that organization is hiring vendor, therefore event is being shared not exploited.

Explanation: Physical or logical system access should be assigned on a need-to-know basis, where there is a legitimate business requirement based on least privilege and segregation of duties. This is done by user authentication.
Incorrect Answers:
A: Monitoring and recording unsuccessful logon attempts does not address the risk of appropriate access rights. In other words, it does not prevent unauthorized access.
B: Forcing users to change their passwords does not ensure that access control is appropriately assigned.
C: Challenge response system is used to verify the user’s identification but does not completely address the issue of access risk if access was not appropriately designed in the first place.

Explanation:
A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:

• A description of the risk
• The impact should this event actually occur
• The probability of its occurrence
• Risk Score (the multiplication of Probability and Impact)
• A summary of the planned response should the event occur
• A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event)
• Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.
• It records the initial risks, the potential responses, and tracks the status of each identified risk in the project.

Incorrect Answers:
A: The project scope statement does document initially defined risks but it is not a place that will record risks responses and status of risks.
B: The project charter does not define risks.
C: The risk low-level watch list is for identified risks that have low impact and low probability in the project.

Explanation: The Communications Management Plan will direct John on the information to be communicated, when to communicate, and how to communicate with external stakeholders. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project’s life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project.
Incorrect Answers:
A: The Risk Response Plan identifies how risks will be responded to.
C: The Project Management Plan is the parent of all subsidiary management plans and it is not the most accurate choice for this question
D: The Risk Management Plan defines how risks will be identified, analyzed, responded to, and controlled throughout the project.

Explanation: Conducting a feasibility study begins once initial approval has been given to move forward with a project. It includes an analysis to clearly define the need and to identify alternatives for addressing the need.
Incorrect Answers:
B: Acquiring software involves building new or modifying existing hardware or software after final approval by the stakeholder, which is not a phase in the standard SDLC process. If a decision was reached to acquire rather than develop software, this task should occur after feasibility study and defining requirements.
C: Requirements of the project is being defined after conducting feasibility study.
D: This is latter phase in project development process.

Explanation: As preventive control and prevention is preferred over detection and recovery, therefore, private and key-based encryption should be adopted for managing risks.
Incorrect Answers:
A, C, D: As explained in above section preventive control and prevention is preferred over detection and recovery, hence these are less preferred way.