CISSP Asset Security Practice Question
An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Record asset relationships and configurations
A CMDB stores information about hardware and software assets and their relationships, aiding in configuration management and change impact analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manage user passwords
Why it's wrong here
A Configuration Management Database (CMDB) is designed to store information about IT assets and their relationships, not to manage user credentials. User password management is typically handled by identity and access management (IAM) systems, such as Active Directory or dedicated password vaults, which focus on authentication, authorization, and secure storage of sensitive user data. CMDBs are about configurations and their interconnections, not the security attributes of individual users.
- ✗
Monitor network performance
Why it's wrong here
Monitoring network performance involves real-time collection and analysis of operational data, such as bandwidth utilization, latency, and packet loss, to identify issues and trends. This function is performed by specialized network performance monitoring (NPM) tools and network management systems (NMS), which are distinct from a CMDB. While a CMDB might contain static configuration details of network devices, it does not actively collect or analyze dynamic performance metrics.
- ✓
Record asset relationships and configurations
Why this is correct
The primary purpose of a Configuration Management Database (CMDB) is to serve as a centralized repository for information about all Configuration Items (CIs) within an IT environment. This includes not only detailed attributes of each asset, such as hardware specifications, software versions, and network addresses, but critically, also the intricate relationships and dependencies between these CIs. By mapping these connections, a CMDB enables organizations to understand the impact of changes and facilitate effective incident and problem management.
- ✗
Track software licenses
Why it's wrong here
While a CMDB may contain information about installed software, its core function is not dedicated to tracking software licenses for compliance or optimization purposes. Dedicated Software Asset Management (SAM) systems are specifically designed to manage the lifecycle of software licenses, including procurement, deployment, usage, and compliance auditing. A CMDB provides the "what" (what software is installed on what CI), but SAM provides the "how much" and "are we compliant" regarding licenses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.