Conduct an initial comprehensive risk assessment and update the risk log at each stage gate is correct.

This approach embeds risk management into the Waterfall lifecycle by performing a thorough risk identification and analysis up front and then revisiting those risks at each formal stage gate. The stage gate updates ensure that new risks are captured and that existing risks are re assessed before the project proceeds to the next phase. Maintaining a risk log and updating it at gates supports documented mitigation plans and informed go no go decisions.

Treat risk management as an ad hoc responsibility for the project team without formal tracking is wrong because ad hoc handling and no formal tracking allow risks to be missed and make it hard to demonstrate that mitigations were executed. Formal, documented processes are required in Waterfall projects.

Postpone all risk assessment and mitigation until after deployment in the operations phase is wrong because waiting until after deployment is too late to avoid many technical and schedule impacts. Risk identification and mitigation must occur during project phases so that design and testing can address issues.

Use scheduled monthly risk reviews led by a centralized project governance office is wrong because a fixed monthly cadence may not align with the Waterfall stage gates and can miss stage specific risks. Governance can provide oversight but risk reviews need to be tied to stage gate milestones and owned by the project team for timely action.

Full AWS Practitioner Certification Question