You are working as a project manager in your organization. You are nearing the final stages
of project execution and looking towards the final risk monitoring and controlling activities.
For your project archives, which one of the following is an output of risk monitoring and
control?

Which of the following DoD directives is referred to as the Defense Automation Resources
Management Manual?

The phase 3 of the Risk Management Framework (RMF) process is known as mitigation
planning. Which of the following processes take place in phase 3? Each correct answer
represents a complete solution. Choose all that apply.

Gary is the project manager of his organization. He is managing a project that is similar to a
project his organization completed recently. Gary has decided that he will use the
information from the past project to help him and the project team to identify the risks that
may be present in the project. Management agrees that this checklist approach is ideal and
will save time in the project. Which of the following statement is most accurate about the
limitations of the checklist analysis approach for Gary?

What are the subordinate tasks of the Initiate and Plan IA C&A phase of the DIACAP

process? Each correct answer represents a complete solution. Choose all that apply.

Information risk management (IRM) is the process of identifying and assessing risk,
reducing it to an acceptable level, and implementing the right mechanisms to maintain that
level. What are the different categories of risk? Each correct answer represents a complete
solution. Choose all that apply.

Neil works as a project manager for SoftTech Inc. He is working with Tom, the COO of his
company, on several risks within the project. Tom understands that through qualitative
analysis Neil has identified many risks in the project. Tom’s concern, however, is that the
priority list of these risk events are sorted in “high-risk,” “moderate-risk,” and “low-risk” as
conditions apply within the project. Tom wants to know that is there any other objective on
which Neil can make the priority list for project risks. What will be Neil’s reply to Tom?

In which type of access control do user ID and password system come under?

You and your project team are identifying the risks that may exist within your project. Some
of the risks are small risks that won’t affect your project much if they happen. What should
you do with these identified risk events?

Adrian is the project manager of the NHP Project. In her project there are several work
packages that deal with electrical wiring. Rather than to manage the risk internally she has
decided to hire a vendor to complete all work packages that deal with the electrical wiring.
By removing the risk internally to a licensed electrician Adrian feels more comfortable with
project team being safe. What type of risk response has Adrian used in this example?