What is a primary benefit of automating software inventory discovery?

It guarantees that all software is free of vulnerabilities

It allows users to install any software without oversight

It reduces manual effort and the likelihood of human error

It eliminates the need for any software licenses

A company uses a configuration management tool to enforce a standard server image. The security team discovers that some servers have additional software installed that is not in the standard image. The team wants to maintain both configuration control and an accurate inventory. Which approach best balances these goals?

Allow the configuration management tool to report the additional software as drift, and include that drift data in the software inventory.

Automatically remove any software not in the standard image from all servers.

Exclude the additional software from the inventory to avoid confusion with the standard image.

Add the additional software to the standard image so it is no longer considered drift.

During a quarterly audit, the security team finds that the CMDB shows 1,200 software titles, but a fresh discovery scan finds 1,350. The team also finds that 80 titles in the CMDB are no longer installed anywhere. What is the most effective way to reconcile the CMDB with the discovery results?

Replace the CMDB with the discovery tool's database as the new source of truth.

Automatically update the CMDB with the discovery results and flag any discrepancies for manual review.

Manually add the 150 missing titles and delete the 80 stale titles from the CMDB.

Ignore the discovery results and keep the CMDB as the authoritative source.

Which of the following is a benefit of using a CMDB for software inventory?

It automatically prevents unauthorized software from being installed

It guarantees that all software is free of vulnerabilities

It eliminates the need for software licensing

It provides a single source of truth for software assets and their relationships

What is a key characteristic of agent-based software discovery?

It scans the network without installing anything on the target devices

It requires installing a small program on each endpoint to collect software data

It uses only Active Directory to enumerate installed software

It relies on users manually reporting their installed software

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 6)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
What is a primary benefit of automating software inventory discovery?
Select an answer first
27expert · hard
A company uses a configuration management tool to enforce a standard server image. The security team discovers that some servers have additional software installed that is not in the standard image. The team wants to maintain both configuration control and an accurate inventory. Which approach best balances these goals?
Select an answer first
28application · medium
During a quarterly audit, the security team finds that the CMDB shows 1,200 software titles, but a fresh discovery scan finds 1,350. The team also finds that 80 titles in the CMDB are no longer installed anywhere. What is the most effective way to reconcile the CMDB with the discovery results?
Select an answer first
29foundation · easy
Which of the following is a benefit of using a CMDB for software inventory?
Select an answer first
30foundation · easy
What is a key characteristic of agent-based software discovery?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.