A company is decommissioning a legacy application that is installed on 50 servers. The security team must ensure the application is removed and the inventory is updated. Which sequence of actions best ensures a complete and accurate retirement?

Uninstall the application from all servers and immediately delete all records from the CMDB.

Update the CMDB status to 'retired' before uninstalling the application from the servers.

Rely on the application owner's confirmation that it was uninstalled and update the CMDB accordingly.

Mark the application as 'retiring' in the CMDB, uninstall it from all servers, run a discovery scan to verify removal, and then update the status to 'retired'.

Which of the following correctly represents the typical lifecycle stages of a software asset?

Purchase, installation, and deletion

Procurement, deployment, operation, maintenance, and retirement

Development, testing, and production only

Which of the following is an example of automating an inventory process?

Scheduling a nightly scan that updates the inventory database automatically

Requiring users to email their installed software list to IT each month

Having an intern manually enter data from spreadsheets

Using a paper-based sign-out sheet for software

A security analyst is building a software inventory and notices that some endpoints report an application version as 'unknown' or 'not applicable'. The analyst needs accurate version information for vulnerability management. Which action would best improve the completeness of the version data?

Remove any application with incomplete version data from the inventory.

Configure the discovery tool to read version information from multiple sources, such as the registry, file metadata, and package managers.

Ask users to manually report the version of each application on their machine.

Accept the 'unknown' values and focus only on applications with complete version data.

What is a benefit of linking software inventory data with configuration items in a CMDB?

It guarantees that no unauthorized software is installed

It automatically patches all software vulnerabilities

It enables impact analysis of software changes on other configuration items

It reduces the need for software licensing

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 2)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 6–10

6application · medium
A company is decommissioning a legacy application that is installed on 50 servers. The security team must ensure the application is removed and the inventory is updated. Which sequence of actions best ensures a complete and accurate retirement?
Select an answer first
7foundation · easy
Which of the following correctly represents the typical lifecycle stages of a software asset?
Select an answer first
8foundation · easy
Which of the following is an example of automating an inventory process?
Select an answer first
9application · medium
A security analyst is building a software inventory and notices that some endpoints report an application version as 'unknown' or 'not applicable'. The analyst needs accurate version information for vulnerability management. Which action would best improve the completeness of the version data?
Select an answer first
10foundation · easy
What is a benefit of linking software inventory data with configuration items in a CMDB?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.