A company has multiple business units that each maintain their own software inventory spreadsheets. The CISO wants a unified view for compliance reporting. What is the most effective approach?

Consolidate all spreadsheets into a single CMDB and establish a process for ongoing updates.

Ask each business unit to email their spreadsheet to the CISO monthly.

Use a business intelligence tool to query each spreadsheet directly without centralizing.

Create a master spreadsheet that combines all data but keep the original spreadsheets as the source of truth.

What is the primary purpose of centralizing software inventory data into a single repository or CMDB?

To eliminate the need for any other security controls

To provide a unified view of all software assets for management and reporting

To store software licenses in a separate location from other IT data

To automatically patch all software from a single console

A security team wants to automate software inventory updates but is concerned about the accuracy of automated discovery, especially for custom in-house applications. They also need to generate weekly compliance reports. What is the best approach?

Rely solely on automated discovery and accept that custom applications may be missed.

Automate discovery but generate reports manually each week.

Use automated discovery for standard software and supplement with a manual review process for custom applications, then automate report generation.

Disable automation and require manual updates for all software to ensure accuracy.

A company is being audited for software license compliance. The auditor asks for evidence that the company is not using more licenses than purchased. What should the security team provide?

A report of all software installations without usage data.

A list of all software purchases with invoice numbers.

A statement from the IT manager that the company is compliant.

A report that compares the number of active installations against the number of purchased licenses, using usage data to exclude idle installations.

An auditor finds that the software inventory is missing several applications that are known to be installed on a sample of servers. What is the most likely reason and the best fix?

The inventory is accurate but the auditor is using the wrong sample.

The applications are not in the approved software list; remove them from the servers.

The discovery tool only scans Windows; switch to a tool that supports all OSes.

The discovery tool is not scanning those servers; add them to the scan scope and verify credentials.

GIAC Critical Controls Certification

Domain 2Objective 2

Inventory and Control of Software Assets GCCC Practice Questions (Page 9)

Part of the Asset Management and Configuration domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 41–45

41application · medium
A company has multiple business units that each maintain their own software inventory spreadsheets. The CISO wants a unified view for compliance reporting. What is the most effective approach?
Select an answer first
42foundation · easy
What is the primary purpose of centralizing software inventory data into a single repository or CMDB?
Select an answer first
43expert · hard
A security team wants to automate software inventory updates but is concerned about the accuracy of automated discovery, especially for custom in-house applications. They also need to generate weekly compliance reports. What is the best approach?
Select an answer first
44application · medium
A company is being audited for software license compliance. The auditor asks for evidence that the company is not using more licenses than purchased. What should the security team provide?
Select an answer first
45application · medium
An auditor finds that the software inventory is missing several applications that are known to be installed on a sample of servers. What is the most likely reason and the best fix?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.