A security team must generate a monthly software compliance report for the board. The team currently has a manual process that takes three days and often contains errors. The team also needs to track software usage to identify unused licenses. Which automation strategy would best improve both reporting accuracy and license optimization?

Use a third-party service to generate the board report from a sample of the inventory data.

Automate the collection of inventory and usage data into a central repository, and use a reporting tool that generates the board report on a schedule.

Automate the usage tracking but keep the manual inventory process for the board report.

Automate only the report generation, using the existing manual inventory data as the source.

Which of the following is typically included in the scope of a software inventory?

Only applications that are licensed from external vendors

Operating systems, applications, and software updates installed on servers, desktops, and laptops

Only software that is installed on user workstations, not servers

Only software that is used on a daily basis by employees

A DevOps team uses a configuration management tool (e.g., Ansible or Puppet) to enforce the desired state of servers. The security team wants the software inventory to reflect the actual installed packages, not just the desired configuration. Which integration approach would best achieve this?

Disable the configuration management tool's package management features so that the inventory reflects only manually installed software.

Run a separate agentless scanner once a month and manually compare the results with the configuration management tool's reports.

Have the configuration management tool report its enforcement results and discovered package versions back to the central inventory system.

Use the configuration management tool's manifest file as the authoritative software inventory for all servers.

A software asset manager needs to track a new enterprise application from the moment it is requested until it is decommissioned. Which lifecycle stage should be recorded FIRST in the software inventory?

Installation on the first server

Why is it important to collect the exact version number of each installed application?

To know which users have launched the application most frequently

To identify which security patches are applicable and to ensure license compliance

To calculate the total disk space used by all applications

To determine the color scheme of the application's user interface

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 5)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 21–25

21expert · hard
A security team must generate a monthly software compliance report for the board. The team currently has a manual process that takes three days and often contains errors. The team also needs to track software usage to identify unused licenses. Which automation strategy would best improve both reporting accuracy and license optimization?
Select an answer first
22foundation · easy
Which of the following is typically included in the scope of a software inventory?
Select an answer first
23application · medium
A DevOps team uses a configuration management tool (e.g., Ansible or Puppet) to enforce the desired state of servers. The security team wants the software inventory to reflect the actual installed packages, not just the desired configuration. Which integration approach would best achieve this?
Select an answer first
24application · medium
A software asset manager needs to track a new enterprise application from the moment it is requested until it is decommissioned. Which lifecycle stage should be recorded FIRST in the software inventory?
Select an answer first
25foundation · easy
Why is it important to collect the exact version number of each installed application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.