Shoulder surfing is a type of in-person attack in which the attacker gathers information
about the premises of an organization. This attack is often performed by looking
surreptitiously at the keyboard of an employee’s computer while he is typing in his password
at any access point such as a terminal/Web site. Which of the following is violated in a
shoulder surfing attack?

Harry is the project manager of the MMQ Construction Project. In this project Harry has
identified a supplier who can create stained glass windows for 1,000 window units in the
construction project. The supplier is an artist who works by himself, but creates windows for
several companies throughout the United States. Management reviews the proposal to use
this supplier and while they agree that the supplier is talented, they do not think the artist
can fulfill the 1,000 window units in time for the project’s deadline. Management asked
Harry to find a supplier who will guarantee the completion of the windows by the needed
date in the schedule. What risk response has management asked Harry to implement?

You are the project manager of the BlueStar project in your company. Your company is
structured as a functional organization and you report to the functional manager that you are

ready to move onto the qualitative risk analysis process. What will you need as inputs for
the qualitative risk analysis of the project in this scenario?

Henry is the project manager of the QBG Project for his company. This project has a budget
of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the
project, has introduced a scope change request for additional deliverables as part of the
project work. What component of the change control system would review the proposed
changes’ impact on the features and functions of the project’s product?

Security Test and Evaluation (ST&E) is a component of risk assessment. It is useful in
discovering system vulnerabilities. For what purposes is ST&E used? Each correct answer
represents a complete solution. Choose all that apply.

Which of the following are the goals of risk management? Each correct answer represents a
complete solution. Choose three.

Elizabeth is a project manager for her organization and she finds risk management to be
very difficult for her to manage. She asks you, a lead project manager, at what stage in the
project will risk management become easier. What answer best resolves the difficulty of risk
management practices and the effort required?

Which of the following RMF phases identifies key threats and vulnerabilities that could
compromise the confidentiality, integrity, and availability of the institutional critical assets?

You are the project manager of the NHQ project for your company. Management has told
you that you must implement an agreed upon contingency response if the Cost
Performance Index in your project is less than 0.90. Consider that your project has a budget
at completion of $250,000 and is 60 percent complete. You are scheduled to be however,
75 percent complete, and you have spent $165,000 to date. What is the Cost Performance
Index for this project to determine if the contingency response should happen?

In what portion of a project are risk and opportunities greatest and require intense planning
and anticipation of risk events?