Identifying a list of all approved software on a system is a step in which of the following practices?

Passively testing security controls involves observing system behavior without active interaction to assess control effectiveness; it does not include building an inventory of approved software.

Application hardening focuses on reducing the attack surface of individual applications through patching, disabling unnecessary features, and enforcing secure configurations, not cataloging all approved software across a host.

A host software baseline is an established reference point that catalogs all authorized applications, services, and processes on a system. Identifying the list of approved software is a foundational step in creating this baseline, which security teams then use to detect deviations - such as newly installed malware or unauthorized applications - by comparing the current state against the approved baseline.

Client-side targeting refers to attack techniques that exploit vulnerabilities in client applications such as browsers or document readers; it is an offensive concept unrelated to software inventory practices.