What is the primary purpose of documenting risk events in a risk register?

To replace the need for risk analysis

To capture and track risk events and their attributes for ongoing management

To provide a historical record for regulatory compliance only

To assign blame for risk events that have occurred

A hospital is assessing the risk of a ransomware attack on its patient records system. The risk team has determined that the likelihood is moderate, but the impact is very high, as it could compromise patient safety and lead to regulatory fines. The hospital has limited budget for risk mitigation. Which risk response strategy would be most appropriate?

Accept the risk because the likelihood is moderate.

Implement robust backup and recovery procedures.

Disconnect the patient records system from the network.

Purchase cyber insurance to transfer the risk.

Certified in Risk and Information Systems Control

Domain 2Objective 1

Risk Events CRISC Practice Questions (Page 3)

Part of the Domain 2: Risk Assessment domain, which accounts for 22% of the CRISC exam.

28questions here

6free pages

7concepts

22%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of documenting risk events in a risk register?
Select an answer first
12expert · hard
A hospital is assessing the risk of a ransomware attack on its patient records system. The risk team has determined that the likelihood is moderate, but the impact is very high, as it could compromise patient safety and lead to regulatory fines. The hospital has limited budget for risk mitigation. Which risk response strategy would be most appropriate?
Select an answer first
13foundation · easy
An organization wants to identify risk events by reviewing past incidents and lessons learned. Which technique is most appropriate?
Select an answer first
14foundation · easy
Which technique for identifying risk events involves gathering a group of stakeholders to generate a wide range of potential events without immediate criticism?
Select an answer first
15foundation · easy
A company experiences a fire in its data center that destroys critical servers. How would this risk event be categorized by nature?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRISC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CRISC” is a trademark of its owner, used for identification only.

Risk Events CRISC Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of documenting risk events in a risk register?

An organization wants to identify risk events by reviewing past incidents and lessons learned. Which technique is most appropriate?

Which technique for identifying risk events involves gathering a group of stakeholders to generate a wide range of potential events without immediate criticism?

A company experiences a fire in its data center that destroys critical servers. How would this risk event be categorized by nature?

Keep studying — Domain 2: Risk Assessment