A risk manager is updating the organization's risk register after a quarterly review. A previously identified risk (data breach due to unpatched servers) has been mitigated by implementing an automated patch management system. What is the most appropriate way to document this change in the risk register?

Update the risk status to 'Mitigated', record the control implemented, and set a review date for the next quarter.

Change the risk owner and leave the risk status as 'Open' until the next annual review.

Remove the risk from the register because it has been fully addressed.

Document the mitigation in a separate report and do not update the risk register until the next major assessment.

A company has implemented a risk management program and identified a high-risk vulnerability in its web application. After deploying a patch, the risk owner wants to ensure the risk remains mitigated over time. Which action is most important for the risk monitoring and review process?

Document the patch in the risk register and close the risk item permanently.

Notify stakeholders of the patch and consider the risk management process complete.

Remove the risk from the risk register because the vulnerability has been patched.

Schedule periodic vulnerability scans and review the risk register to confirm the risk level has not changed.

What is a key purpose of communicating risk information to stakeholders?

To ensure stakeholders have the information needed to make informed decisions

To transfer all risks to stakeholders

To avoid any further risk assessments

To hide unfavorable risks from decision-makers

What is the primary purpose of a risk register?

To serve as a legal contract with third parties

To record only risks that have already occurred

To store all organizational passwords securely

To document identified risks, their assessment, and planned responses

EC-CouncilCertified Cybersecurity Technician

Domain 8Objective 2

Risk Management CCT Practice Questions (Page 7)

Part of the Business Continuity and Risk Management domain, which makes up ~8% of our current practice bank.

39questions here

8free pages

8concepts

Questions 31–35

31application · medium
A risk manager is updating the organization's risk register after a quarterly review. A previously identified risk (data breach due to unpatched servers) has been mitigated by implementing an automated patch management system. What is the most appropriate way to document this change in the risk register?
Select an answer first
32application · medium
A company has implemented a risk management program and identified a high-risk vulnerability in its web application. After deploying a patch, the risk owner wants to ensure the risk remains mitigated over time. Which action is most important for the risk monitoring and review process?
Select an answer first
33foundation · easy
An organization decides to discontinue a product line because the associated risks are too high. Which risk response strategy is being applied?
Select an answer first
34foundation · easy
What is a key purpose of communicating risk information to stakeholders?
Select an answer first
35foundation · easy
What is the primary purpose of a risk register?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.

Risk Management CCT Practice Questions (Page 7)

Questions 31–35

A company has implemented a risk management program and identified a high-risk vulnerability in its web application. After deploying a patch, the risk owner wants to ensure the risk remains mitigated over time. Which action is most important for the risk monitoring and review process?

An organization decides to discontinue a product line because the associated risks are too high. Which risk response strategy is being applied?

What is a key purpose of communicating risk information to stakeholders?

What is the primary purpose of a risk register?

Keep studying — Business Continuity and Risk Management