Free Practice Questions for CompTIA PK0-005 Exam

Part 1:

Change Control Process:

Consult the RACI matrix.

Define new requirements and record changes.

Assess the schedule, risk, and cost.

Perform a demonstration.

Obtain a sign off.

Update and test the deliverable.

Make an announcement on the company portal.

The change control process is a sequence of steps that helps to manage and document any changes or modifications to a project scope, schedule, cost, quality, or resources. The change control process typically involves the following steps:

Consult the RACI matrix. A RACI matrix is a tool that defines and clarifies the roles and responsibilities of each team member for each task or activity in a project. RACI stands for responsible, accountable, consulted, and informed. Consulting the RACI matrix can help to identify who needs to be involved or informed about the change request and how to communicate with them.

Define new requirements and record changes. The new requirements and changes are the details of what needs to be modified or added to the project deliverables or objectives based on the customer feedback or request. Defining and recording the new requirements and changes can help to communicate and justify the need and rationale for the change and its implications on the project scope and quality.

Assess the schedule, risk, and cost. The schedule, risk, and cost are the aspects of the project that may be affected by the change request. Assessing the schedule, risk, and cost can help to determine the impact and feasibility of the change and identify any possible alternatives or corrective actions to minimize or avoid its negative effects.

Perform a demonstration. A demonstration is a presentation or show of how the modified or updated deliverable works or meets the customer expectations or requirements. Performing a demonstration can help to validate and verify that the change request has been implemented correctly and effectively and to obtain feedback or approval from the customer or stakeholders.

Obtain a sign off. A sign off is a formal acceptance and approval of the change request and its deliverables from the customer or stakeholders. Obtaining a sign off can help to confirm that the change request has been completed successfully and satisfactorily and to close the change control process.

Update and test the deliverable. The deliverable is the product or service that is produced or provided by the project. Updating and testing the deliverable can help to ensure that it meets the quality standards and criteria and that it works as expected after implementing the change request.

Make an announcement on the company portal. The company portal is a platform or channel that allows internal communication and collaboration among employees within an organization. Making an announcement on the company portal can help to inform and update other team members or departments about the change request and its outcomes and to share any lessons learned or best practices from the change control process.

Part2:

Risk register: A risk register is a document that identifies, analyzes, and records the potential risks or uncertainties that may affect a project. Updating the risk register can help to capture any new or modified risks that may arise from the change request and to plan and implement appropriate risk responses.

Schedule: A schedule is a document that shows the planned start and end dates, durations, dependencies, and progress of each task or activity in a project. Updating the schedule can help to reflect any changes or adjustments to the project timeline or milestones that may result from the change request and to monitor and control the project performance and delivery.

Statement of work: A statement of work (SOW) is a document that defines the scope, deliverables, schedule, and terms and conditions of a project or contract. Updating the SOW can help to document any changes or additions to the project scope or deliverables that may be requested or agreed upon by the customer or stakeholders and to ensure alignment and agreement on what needs to be done and how it will be done.

Change log: A change log is a document that tracks and records any changes or modifications that are made to the project scope, schedule, cost, quality, or resources during a project. Updating the change log can help to document the change request, approval, implementation, and impact of each change and ensure traceability and transparency.

Scrum is an agile methodology well-suited for projects that require frequent milestone deliveries and functionality demonstrations. It emphasizes iterative development, with regular presentations to stakeholders, which aligns with CompTIA Project+ principles for agile project management.

Encryption is the process of transforming data into an unreadable format that can only be accessed by authorized parties who have the decryption key. Encryption is the best approach for the project manager to keep the PII confidential, as it protects the data from unauthorized access during storage and transmission12.

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:

Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.

Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.

Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs’ value; Implementing and Maintaining Security Program Metrics

This work is best described as current state vs. future state analysis. The team first examined the existing process (the current state), identified areas of improvement (gaps/pain points), and then defined the desired outcomes (the future/target state). In CompTIA Project+ discovery/concept preparation activities, teams are expected to understand the problem/opportunity clearly before planning the solution; comparing the current state to the desired future state is a standard way to define what must change and what “better” looks like, and it becomes a foundation for scope definition and transition planning.

It’s not “process improvement” as the primary label here because that term typically describes the initiative type or the resulting actions, while the question is asking what the analysis itself is called. It’s also not “business objectives” (those are broader strategic goals), and it’s not “project success criteria” (the measurable conditions used to judge success). Those may come later, derived from the current-vs-future gap, but the described activity is the gap comparison between how things work now and how they should work after the project.

The project manager has taken a risk mitigation approach by buying the item from another vendor who can supply it immediately. Risk mitigation is a strategy that involves reducing the probability and/or impact of a negative risk to an acceptable level. By purchasing the item from another vendor, the project manager has reduced the impact of the delay on the project schedule, even though it may have increased the project cost. Risk mitigation is different from risk transfer, which involves shifting the responsibility or burden of a risk to a third party, usually through a contract or insurance. Risk acceptance is a strategy that involves acknowledging the risk and being prepared to deal with its consequences. Risk sharing is a strategy that involves allocating some or all of the ownership of a risk to another party who is willing to take on that risk, usually for some form of incentive or reward. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 7: Risk Management1; CompTIA Project+ Certification Study Guide, 3rd Edition, Chapter 7: Risk Management2

The project manager should review the requested change first to assess its impact, feasibility, and alignment with the project objectives and scope. Reviewing the change will help the project manager to determine if the change is necessary, beneficial, and acceptable to the stakeholders. The project manager should also consider the risks, costs, and quality implications of the change before proceeding to the next steps of the change management process123. References = CompTIA Project+ Study Guide: Exam PK0-005, 3rd Edition, Chapter 9: Project Change Management, p. 323; 5 Steps in the Change Management Process | HBS Online; 8 Steps for an Effective Change Management Process - Smartsheet

The percentage of risk investments with defined business cases is a metric that measures how well the information security program aligns with the operational objectives of the organization. It indicates how many of the security-related investments are justified by a clear analysis of the expected benefits, costs, and risks, and how they support the business goals and priorities. This metric can help the organization optimize its security spending, demonstrate the value of security to the stakeholders, and align the security strategy with the business strategy1. References = Performance Measurement Guide for Information Security, Section 3.2.3, page 16; Key Performance Indicators for Security Governance, Part 1, Section 3, page 3.

In agile methodology, an epic is a large user story or body of work that can be broken down into smaller backlog items deliverable within iteration cycles. This enables large projects to be incrementally deployed while maintaining predictable iteration lengths.