When updating a risk register with the results of an IT risk assessment, the risk practitioner should log the known risk scenarios, because they are the risk scenarios that have been identified and assessed in the IT risk assessment process. The risk register should document and track the known risk scenarios, their characteristics, their status, and their responses. The other options are not the ones that should be logged, because:
Option A: High impact scenarios are the risk scenarios that have a high potential impact on the business objectives and processes, but they are not the only ones that should be logged. The risk register should include all the known risk scenarios, regardless of their impact level.
Option B: High likelihood scenarios are the risk scenarios that have a high probability of occurrence, but they are not the only ones that should be logged. The risk register should include all the known risk scenarios, regardless of their likelihood level.
Option C: Treated risk scenarios are the risk scenarios that have been addressed by the risk response actions, but they are not the only ones that should be logged. The risk register shouldinclude all the known risk scenarios, regardless of their treatment status. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 108.
