CompTIA PK0-005 - CompTIA Project+ Certification (2026)

The project manager should have considered environmental, social, and governance (ESG) factors during initial planning to prevent the situation of receiving a penalty for disposing of some computers improperly. ESG factors are criteria that measure the sustainability and ethical impact of an organization’s activities. They include aspects such as environmental protection, social responsibility, human rights, diversity, and corporate governance. Considering ESG factors can help to reduce risks, improve reputation, and enhance performance of an organization12

First name, last name, and address are Personally Identifiable Information (PII) because they can identify (directly or when combined with other data) a specific individual. CompTIA Project+ includes compliance/privacy and information handling considerations relevant to projects, and knowing common sensitive data categories is part of applying appropriate controls.

The other options don’t fit: PCI refers to payment card information standards/data (e.g., card numbers, CVV) rather than general identity details. PHI is Protected Health Information, tied to healthcare/medical data and regulated in healthcare contexts. CMS typically refers to a content management system, which is a technology platform, not a data classification category.

Correctly identifying data as PII matters because it drives project requirements for security and privacy: access control (need-to-know/least privilege), encryption in transit/at rest, retention rules, logging, and potentially regulatory obligations depending on jurisdiction. As the PM coordinates database design decisions with stakeholders, labeling these fields as PII ensures the team applies the correct controls and avoids accidental exposure—like overly broad access or insecure storage—throughout development, testing, and production deployment.

A time and materials (T&M) contract is the best fit when you need temporary, specialized resources for a limited period (here, only during the testing phase) and the exact effort/hours are not fully predictable. With T&M, the buyer pays for the actual labor time (often at an agreed hourly/daily rate) and any approved materials/expenses. This aligns to CompTIA Project+ procurement objectives around selecting appropriate contract considerations and types, where time and material is a standard option used when work is phase-specific or scope is not fully defined to a fixed deliverable.

By contrast, fixed-price is most appropriate when the scope and deliverables are clearly defined upfront (less suitable for staff augmentation). Cost-plus reimburses allowable costs plus a fee and is typically used for broader, less-defined deliverables—often creating higher buyer cost risk than T&M for a small, contained staffing need. A warranty is not a primary contract type for acquiring temporary engineers; it’s usually a contract provision related to quality/defects after delivery.

Phishing is a scenario where someone claiming to be from a legitimate organization sends an email or other message to a target person asking for sensitive information or access to a system or account. Phishing is a type of cyberattack that aims to trick the target into revealing personal or financial data or installing malware on their device. Phishing can compromise the security and privacy of the target and expose them to identity theft, fraud, or other malicious activities.

In a software development project with an external customer, the project manager (PM) is responsible for coordinating and managing the project—including building, maintaining, and controlling the schedule. CompTIA Project+ specifically identifies schedule management as a core skill area (e.g., maintaining schedules and related activities), which aligns directly with option A.

The other options describe responsibilities typically owned by other roles or governance functions. Defining functional requirements is usually led by a business analyst and/or product owner/customer stakeholders, with the PM facilitating requirements activities and ensuring traceability and impact awareness—not owning definition outright. Developing software components is a developer/engineer responsibility, not the PM’s. And assessing/authorizing security policies is commonly handled by security/compliance leadership (or a governance authority), while the PM ensures the project aligns with required policies and coordinates related work.

Therefore, the clearest PM responsibility in this scenario is managing the project schedule (along with integrating scope, resources, risks, stakeholders, and communications).

A task board is a visual tool that displays team progress for stand-up meetings. A task board usually consists of columns that represent different stages or statuses of tasks, such as to do, in progress, done, or blocked. Each task is represented by a card or sticky note that can be moved across the columns as the task progresses. A task board can help to facilitate communication, collaboration, and transparency among team members and stakeholders. It can also help to track and manage work flow, prioritize tasks, identify bottlenecks, and resolve issues3

Control objectives are the desired outcomes or goals of implementing security controls to mitigate risks and protect information assets. Control objectives should be the primary basis for establishing metrics that measure the effectiveness of an information security program, as they align with the business objectives, requirements, and expectations of the organization and its stakeholders. Metrics based on control objectives can help to evaluate the performance, efficiency, and maturity of the security program, and to identify gaps, issues, and areas for improvement. The other options are not correct because:

Residual risk is the remaining risk after applying security controls. Residual risk is not a basis for establishing metrics, but rather a result of measuring the effectiveness of security controls. Residual risk should be monitored and reported, but it does not define the desired outcomes or goals of the security program.

Regulatory requirements are the external standards, laws, and regulations that the organization must comply with to avoid legal or financial penalties. Regulatory requirements are not a basis for establishing metrics, but rather a constraint or a driver for the security program. Metrics based on regulatory requirements can help to demonstrate compliance, but they may not reflect the actual effectiveness or efficiency of the security program.

Risk tolerance is the level of risk that the organization is willing to accept or bear. Risk tolerance is not a basis for establishing metrics, but rather a factor or an input for the security program. Metrics based on risk tolerance can help to prioritize and allocate resources, but they may not measure the actual outcomes or goals of the security program. References = Key Performance Indicators for Security Governance, Part 1; 14 Cybersecurity Metrics + KPIs You Must Track in 2023; KPIs in Information Security: The 10 Most Important Security Metrics; Why metrics are crucial to proving cybersecurity programs’ value; Implementing and Maintaining Security Program Metrics

The Requirements Traceability Matrix (RTM) is the best document for the PM to check when a stakeholder believes a key functionality might be missing. The RTM links requirements → design/work items → test cases → deliverables/acceptance, allowing the PM to confirm whether the functionality is already included and where it is implemented and validated. This aligns to CompTIA Project+ objectives around maintaining project artifacts and using tools that ensure requirements are tracked through delivery and verification (i.e., ensuring what was requested is what gets built and tested).

A detailed scope statement can confirm what is in/out at a high level, but it typically won’t provide the same end-to-end mapping to implementation and testing evidence that gives a PM confidence about a specific feature’s presence. A task board shows current work status, not requirement coverage. A risk register is for threats/opportunities and responses, not for proving whether functionality exists in scope and has been built/tested.

So, to avoid unnecessary change requests and to respond with evidence, the PM most likely checked the RTM to confirm the feature is already included and traceable to completed or planned work and validation.