A company wants to ensure that all servers are configured with the same security baseline. They have an asset inventory that includes server configuration data. Which action would most effectively link inventory and configuration management?

Use the inventory to identify servers that are missing the baseline and trigger a configuration deployment.

Create a separate spreadsheet of server configurations and compare it to the inventory quarterly.

Require administrators to manually configure each server and then update the inventory.

Store the configuration baseline in the inventory record for each server.

Which asset discovery technique involves deploying software agents on endpoints to report asset information to a central inventory system?

Integration with existing systems

A company is merging with another firm and needs to create a unified asset inventory. The two companies use different inventory tools and have overlapping IP address ranges. Which approach would best ensure a complete and accurate combined inventory?

Merge the two inventory databases by IP address.

Delete all records and start fresh with a new network scan.

Use a unique asset identifier (e.g., serial number or asset tag) as the key for merging records.

Keep the two inventories separate and run a network scan to create a third list.

A hospital network includes a mix of IoT medical devices (infusion pumps, patient monitors), staff laptops, and virtual servers. The security team needs a complete asset inventory but cannot install agents on the medical devices due to FDA validation requirements. Which approach will produce the most complete inventory while respecting the constraint?

Rely on the existing DHCP server logs to enumerate all devices that have requested an IP address in the last 90 days.

Perform a single active scan of the entire network during off-hours to identify every device at once.

Deploy agent-based collection on all laptops and virtual servers, then supplement with active network scanning of the medical device subnets.

Use only passive network monitoring to observe traffic from all devices without sending any packets to the medical devices.

A multinational company must inventory assets across multiple cloud providers and on-premises data centers. The security team wants a single view of all assets. Which approach would best achieve this while maintaining accuracy?

Use a spreadsheet to track cloud assets and update it monthly.

Use each provider's native inventory tool and manually combine the results.

Deploy a cloud-agnostic asset discovery tool that integrates with each provider's API.

Run a network scan from the on-premises network to discover cloud assets.

GIAC Critical Controls Certification

Domain 2Objective 1

Inventory and Control of Enterprise Assets GCCC Practice Questions (Page 8)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36application · medium
A company wants to ensure that all servers are configured with the same security baseline. They have an asset inventory that includes server configuration data. Which action would most effectively link inventory and configuration management?
Select an answer first
37foundation · easy
Which asset discovery technique involves deploying software agents on endpoints to report asset information to a central inventory system?
Select an answer first
38application · medium
A company is merging with another firm and needs to create a unified asset inventory. The two companies use different inventory tools and have overlapping IP address ranges. Which approach would best ensure a complete and accurate combined inventory?
Select an answer first
39application · medium
A hospital network includes a mix of IoT medical devices (infusion pumps, patient monitors), staff laptops, and virtual servers. The security team needs a complete asset inventory but cannot install agents on the medical devices due to FDA validation requirements. Which approach will produce the most complete inventory while respecting the constraint?
Select an answer first
40expert · hard
A multinational company must inventory assets across multiple cloud providers and on-premises data centers. The security team wants a single view of all assets. Which approach would best achieve this while maintaining accuracy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.