If the question says hospital, energy company, or public administration, think NIS2. If it says connected product, think CRA.
NIS2 governs entity risk management and incident reporting; CRA governs product cybersecurity requirements. The exam trap is misapplying one to the other when a scenario mixes an organisation and a device.