Hi Ram:
Think of your previous projects...in the early planning stages the Risk Management Plan is created. This plan states how you will assess risk on a project, who is involved and how often risk will be assessed. The next logical step would be to identify the risks. You do this early in the project. If the known risks far outweigh the value of the project, the project may not proceed.
As your project progresses, risks may surface, go away, are realized or continue to be monitored. They need to be revisited often. For this reason, 1 is the correct answer. Risks are initially identified in the planning stages and then reassessed as the project progresses. Lastly, this occurs for all projects regardless of the 'type' of project. I have yet to come across a project that didn't pose some time of risk - large or small. In my projects, we use our weekly or daily stand up meetings to quickly assess risks.
Good luck with your studying.
Tracey