An inventory scan reports that a server has 'Microsoft Office 365' installed, but the security team needs to know the exact version and update level to assess a vulnerability. What is the best next step?

Search the internet for the latest version of Office 365 and assume it is installed.

Ask the server administrator to manually check and report the version via email.

Accept the generic name because the vulnerability applies to all versions.

Query the local installation database or use a tool that reads file version details to obtain the precise version.

What is the primary purpose of tracking software usage?

To support license compliance and identify opportunities for cost optimization

To monitor employee productivity

To increase the number of software installations

To block users from using certain applications

A company is retiring an old line-of-business application. The security team must ensure that the application is fully removed from all systems and that the inventory reflects its retirement. Which process would best support this?

Delete all records of the application from the CMDB immediately after the retirement announcement.

Keep the application records unchanged in the CMDB but note in a separate document that it is being retired.

Rely on the software vendor's notification that the application is retired and assume all copies are removed.

Update the asset lifecycle status to 'retired' in the CMDB, then run a discovery scan to confirm the application is no longer present on any endpoint.

The CISO asks for a report that shows which departments have the most outdated software and the highest number of unused licenses. The inventory data is stored in a central CMDB, and usage data is collected from endpoints. What is the best way to produce this report?

Export the CMDB data to a spreadsheet and manually count outdated software per department.

Use the software vendor's compliance report as the sole source for the CISO's report.

Create a dashboard that joins CMDB asset data with usage logs and groups the results by department and software version.

Ask each department manager to report their own outdated software and unused licenses.

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 11)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 51–54

51application · medium
An inventory scan reports that a server has 'Microsoft Office 365' installed, but the security team needs to know the exact version and update level to assess a vulnerability. What is the best next step?
Select an answer first
52foundation · easy
What is the primary purpose of tracking software usage?
Select an answer first
53application · medium
A company is retiring an old line-of-business application. The security team must ensure that the application is fully removed from all systems and that the inventory reflects its retirement. Which process would best support this?
Select an answer first
54application · medium
The CISO asks for a report that shows which departments have the most outdated software and the highest number of unused licenses. The inventory data is stored in a central CMDB, and usage data is collected from endpoints. What is the best way to produce this report?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.