A company uses a configuration management tool (e.g., Ansible) to enforce security settings on servers. The asset inventory is maintained separately in a spreadsheet. The security team notices that some servers are not being configured correctly because they are missing from the configuration tool's scope. What is the best way to resolve this?

Integrate the asset inventory with the configuration management tool so that all inventory items are automatically included in configuration enforcement.

Ask server owners to run the configuration tool manually on their servers.

Manually add the missing servers to the configuration tool's inventory list each time a new server is deployed.

Use the spreadsheet as the source of truth and ignore the configuration tool's scope.

What is the primary objective of controlling enterprise assets?

To maximize the number of assets connected to the network

To reduce the cost of asset procurement

To ensure all assets are running the latest operating system

To ensure only authorized assets are present and to prevent unauthorized additions

A company has a mix of legacy and modern systems. The security team must classify assets to determine which ones need immediate security patches. Which factor should be the primary consideration in this classification?

The asset's exposure to the internet and its role in the business.

The asset's physical location within the office.

The number of users who access the asset.

The age of the asset's operating system.

A financial firm's CMDB shows a server that was decommissioned six months ago, but the asset inventory still lists it as 'in production' with an assigned owner who left the company. The security team is planning a vulnerability scan and wants to prioritize efforts. What is the most appropriate first step?

Assign the server to the new IT manager and continue scanning it until a replacement is procured.

Leave the inventory unchanged and note the discrepancy in the next audit report.

Update the asset inventory to mark the server as 'retired' and remove it from active vulnerability scanning scope.

Scan the server immediately to ensure it has no vulnerabilities before removing it from the network.

GIAC Critical Controls Certification

Domain 2Objective 1

Inventory and Control of Enterprise Assets GCCC Practice Questions (Page 5)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 21–25

21application · medium
A company uses a configuration management tool (e.g., Ansible) to enforce security settings on servers. The asset inventory is maintained separately in a spreadsheet. The security team notices that some servers are not being configured correctly because they are missing from the configuration tool's scope. What is the best way to resolve this?
Select an answer first
22foundation · easy
What is the primary objective of controlling enterprise assets?
Select an answer first
23expert · hard
A company has a mix of legacy and modern systems. The security team must classify assets to determine which ones need immediate security patches. Which factor should be the primary consideration in this classification?
Select an answer first
24application · medium
A financial firm's CMDB shows a server that was decommissioned six months ago, but the asset inventory still lists it as 'in production' with an assigned owner who left the company. The security team is planning a vulnerability scan and wants to prioritize efforts. What is the most appropriate first step?
Select an answer first
25foundation · easy
Which asset discovery method is most likely to identify unauthorized devices connected to the network without relying on pre-installed software?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Inventory and Control of Enterprise Assets GCCC Practice Questions (Page 5)

Questions 21–25

What is the primary objective of controlling enterprise assets?

A company has a mix of legacy and modern systems. The security team must classify assets to determine which ones need immediate security patches. Which factor should be the primary consideration in this classification?

Which asset discovery method is most likely to identify unauthorized devices connected to the network without relying on pre-installed software?

Keep studying — Asset Management and Configuration