A security team wants to ensure that only approved software versions are allowed on servers. They have a CMDB with software inventory and a configuration management tool that enforces baselines. What is the most effective way to maintain consistency?

Have the configuration management tool overwrite any unapproved software automatically.

Use the CMDB to generate a monthly report of installed software and email it to administrators.

Require administrators to manually check the CMDB before installing any software.

Integrate the CMDB with the configuration management tool so that discovered software is compared against approved baselines and deviations are flagged.

A software asset manager is retiring an old application. What must be done in the inventory to maintain accuracy and support compliance?

Delete the asset record entirely from the inventory.

Update the inventory record to reflect the retirement date and remove the asset from active status.

Move the record to a separate spreadsheet for retired assets.

Keep the record unchanged for historical purposes.

How does integrating software inventory with configuration management improve control?

It eliminates the need for change management processes

It only works for open-source software

It ensures that software changes are tracked and aligned with configuration baselines

It automatically prevents all configuration changes

A company's software inventory currently tracks only commercial applications installed on Windows workstations. The security team wants to expand the inventory to cover all software assets. Which item should be ADDED to the inventory scope?

The IP addresses of all network printers

The hardware serial numbers of all workstations

Open-source libraries embedded in internally developed applications

Only the operating system version on each workstation

A security team spends several days each month manually updating the software inventory and generating compliance reports. The team wants to reduce this effort and improve accuracy. Which approach would best meet both goals?

Increase the frequency of manual inventory updates from monthly to weekly.

Implement automated discovery that updates the inventory continuously and generates reports on a schedule.

Use a spreadsheet template that automatically calculates compliance metrics.

Outsource the manual inventory updates to a third-party vendor.

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 3)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 11–15

11application · medium
A security team wants to ensure that only approved software versions are allowed on servers. They have a CMDB with software inventory and a configuration management tool that enforces baselines. What is the most effective way to maintain consistency?
Select an answer first
12application · medium
A software asset manager is retiring an old application. What must be done in the inventory to maintain accuracy and support compliance?
Select an answer first
13foundation · easy
How does integrating software inventory with configuration management improve control?
Select an answer first
14application · medium
A company's software inventory currently tracks only commercial applications installed on Windows workstations. The security team wants to expand the inventory to cover all software assets. Which item should be ADDED to the inventory scope?
Select an answer first
15application · medium
A security team spends several days each month manually updating the software inventory and generating compliance reports. The team wants to reduce this effort and improve accuracy. Which approach would best meet both goals?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.