CSM Risk Assessment & Mitigation 2 — Questions and Answers
Question 1: A software manager uses a risk matrix to prioritize risks. Which two dimensions are typically plotted on this matrix?
- Cost and schedule
- Probability and impact (Correct answer)
- Likelihood and velocity
- Severity and detectability
Correct answer: Probability and impact
A risk matrix plots probability (likelihood of occurrence) against impact (consequence if it occurs) to prioritize risks.
Question 2: During a sprint retrospective, the team discovers a recurring dependency on a third-party API that could fail. What risk mitigation strategy involves creating an alternative API integration in advance?
- Risk acceptance
- Risk avoidance
- Contingency planning (Correct answer)
- Risk transference
Correct answer: Contingency planning
Contingency planning involves preparing backup solutions (like an alternate API) in advance so the team can respond quickly if the primary fails.
Question 3: Which risk response strategy is most appropriate when a risk's potential cost to address exceeds the expected loss from the risk itself?
- Mitigate
- Accept (Correct answer)
- Transfer
- Avoid
Correct answer: Accept
Acceptance is appropriate when mitigation costs exceed the expected loss, meaning the risk is cheaper to absorb if it occurs.
Question 4: A software project faces a risk of key developer turnover. The manager responds by cross-training team members. This is an example of:
- Risk avoidance
- Risk transference
- Risk mitigation (Correct answer)
- Risk exploitation
Correct answer: Risk mitigation
Cross-training reduces the impact of key person departure by spreading knowledge, making it a mitigation strategy.
Question 5: In qualitative risk analysis, risks are assessed based on:
- Statistical models and Monte Carlo simulations
- Subjective judgment of probability and impact (Correct answer)
- Earned value metrics
- Net present value calculations
Correct answer: Subjective judgment of probability and impact
Qualitative risk analysis uses expert judgment and descriptive scales (e.g., high/medium/low) rather than numerical data.
Question 6: A CSM recognizes that a new government regulation could impact software compliance requirements mid-project. This is classified as which type of risk?
- Technical risk
- External risk (Correct answer)
- Organizational risk
- Project management risk
Correct answer: External risk
Regulatory and legal changes originating outside the project are classified as external risks.
Question 7: Which tool helps a software manager identify potential risks by systematically examining what could go wrong at each step of a process?
- Fishbone diagram
- Failure Mode and Effects Analysis (FMEA) (Correct answer)
- Gantt chart
- Work breakdown structure
Correct answer: Failure Mode and Effects Analysis (FMEA)
FMEA systematically evaluates each process step to identify potential failures, their effects, and their likelihood, making it ideal for risk identification.
CSM Risk Assessment & Mitigation 2
A software manager uses a risk matrix to prioritize risks.
Which two dimensions are typically plotted on this matrix?