What is the purpose of generating software inventory reports for stakeholders?

To automatically purchase new software licenses

To hide software usage from auditors

To provide visibility into software assets for decision-making and compliance

To replace the need for any other security controls

Which process helps reconcile software inventory data with actual installations?

Relying solely on user self-reports of installed software

Periodic scanning of endpoints and comparing results with the inventory database

Disabling all network access to prevent changes

Deleting all inventory records and starting over

Which of the following data elements is essential for a complete software inventory record?

Application name, version, and installation date

The number of users who have ever used the application

The software vendor's stock price

A hospital network has 2,000 workstations, many of which are off the corporate network for days at a time (field clinics). The security team needs a complete software inventory, including version numbers, for all endpoints, and must be able to reconcile the data weekly. They are considering agent-based vs. agentless discovery. Which approach best meets the requirement?

Require each user to submit a manual spreadsheet of installed software monthly.

Deploy an agent on each workstation that caches inventory data locally and reports when the device reconnects.

Run weekly agentless network scans from the data center to discover software on all workstations.

Use a combination of Active Directory and DHCP logs to infer installed software from network traffic patterns.

A company has separate tools for endpoint software discovery, license management, and configuration management. The security team wants a single source of truth for software assets and wants to reduce manual data entry. What should they do first?

Keep the tools separate but export monthly CSV files to a shared folder for manual comparison.

Replace the configuration management tool with the license management tool to reduce tool count.

Centralize all software inventory data into one CMDB and automate synchronization from discovery tools.

Ask the license management vendor to build a custom connector to the discovery tool only.

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 8)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 36–40

36foundation · easy
What is the purpose of generating software inventory reports for stakeholders?
Select an answer first
37foundation · easy
Which process helps reconcile software inventory data with actual installations?
Select an answer first
38foundation · easy
Which of the following data elements is essential for a complete software inventory record?
Select an answer first
39application · medium
A hospital network has 2,000 workstations, many of which are off the corporate network for days at a time (field clinics). The security team needs a complete software inventory, including version numbers, for all endpoints, and must be able to reconcile the data weekly. They are considering agent-based vs. agentless discovery. Which approach best meets the requirement?
Select an answer first
40application · medium
A company has separate tools for endpoint software discovery, license management, and configuration management. The security team wants a single source of truth for software assets and wants to reduce manual data entry. What should they do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.