easyMultiple ChoiceObjective-mapped
What is the Primary Purpose of a Risk Register for SSCP
Which of the following is the primary purpose of a risk register?
Quick Answer
The answer is to document and track identified risks and their treatment. This is correct because a risk register serves as the central, living repository for all risk management activities, capturing not only each risk’s description but also its likelihood, impact, assigned owner, and the status of mitigation or treatment plans. On the Systems Security Certified Practitioner SSCP exam, this concept tests your understanding of the Risk Identification, Monitoring and Analysis domain, where the register is used throughout the system development life cycle to ensure risks are actively managed rather than forgotten. A common trap is confusing the register with a simple list of threats—remember it must include treatment tracking, not just identification. Memory tip: think of it as a “risk diary” that logs both the problem and the plan to fix it.
⚠ Common exam trap
It's easy for candidates to confuse the risk register with an incident log or vulnerability scanner output, but the risk register is specifically a forward-looking planning document for managing identified risks, not a reactive or automated detection tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To document and track identified risks and their treatment
The primary purpose of a risk register is to document and track identified risks along with their treatment plans, including risk owners, likelihood, impact, and mitigation status. This aligns with the Risk Identification, Monitoring and Analysis domain, where the risk register serves as a central repository for risk management activities throughout the system development life cycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To record all security incidents after they occur
Why it's wrong here
Incident logs serve that purpose.
- ✗
To track changes made to system configurations
Why it's wrong here
Configuration management database does that.
- ✓
To document and track identified risks and their treatment
Why this is correct
Correct purpose of a risk register.
- ✗
To automatically detect vulnerabilities in the network
Why it's wrong here
Vulnerability scanners do that, not a risk register.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are primary purposes of a risk register?
medium- ✓ A.Track the status of risk treatment plans
- ✓ B.Document identified risks and their characteristics
- C.Record network traffic logs
- D.Store vulnerability scan results
- E.Provide a checklist for compliance audits
Why A: A risk register is a living document used to track the status of risk treatment plans, including whether controls have been implemented, are in progress, or are overdue. This ensures that risk owners are accountable and that residual risk is managed over time. Option B is correct because the primary function of a risk register is to document identified risks along with their characteristics, such as probability, impact, risk score, and owner. These two functions are core to the risk management process as defined by frameworks like NIST SP 800-37 and ISO 31000.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.