A security analyst is evaluating application control solutions for a high-security environment. The organization wants to prevent execution of any unapproved executable, including those that are newly created or renamed. Which approach is most effective?

Use a hash-based allowlist that includes the hash of every approved executable.

Use a path-based allowlist that includes only the Program Files directory.

Use a publisher-based allowlist that trusts all executables signed by approved vendors.

Use a denylist of known malware hashes.

What is the core principle of application control?

Allowing only approved applications to run

Encrypting all data stored on endpoints

Monitoring network traffic for malicious activity

Requiring users to change passwords regularly

A security team is building a software inventory for a newly acquired subsidiary. The subsidiary uses a variety of operating systems and has no existing inventory. The team's goal is to identify all installed software and assess risk. Which scope should the inventory cover?

Only applications that are network-accessible, such as web servers and databases.

Only software that is currently running on each endpoint.

Only software that is licensed or purchased through the organization.

All software installed on all endpoints, including operating systems, applications, and drivers.

A security architect is designing an application control policy for a Windows environment. The policy must allow standard users to run approved applications but prevent them from installing new software. The environment includes a mix of signed and unsigned legacy applications. Which approach best meets the requirement?

Use only publisher rules for signed applications.

Use only path rules for the Program Files folder.

Use a denylist of known malicious applications.

Use AppLocker with a combination of publisher rules for signed applications and path rules for legacy applications, scoped to standard users.

A security analyst needs to produce a monthly report of all installed software across the organization, including version numbers and installation dates. The environment consists of 5,000 Windows endpoints, all connected to the corporate network. Which data collection method is most efficient and accurate for this requirement?

Ask each department to submit a spreadsheet of installed software.

Perform a network scan of all endpoints to enumerate installed software.

Deploy an agent to each endpoint that reports to a central inventory system.

Query the configuration management database (CMDB) for software information.

GIAC Continuous Monitoring Certification

Domain 3Objective 3

Software Inventories and Application Control GMON Practice Questions (Page 1)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 1–5

1application · medium
A security analyst is evaluating application control solutions for a high-security environment. The organization wants to prevent execution of any unapproved executable, including those that are newly created or renamed. Which approach is most effective?
Select an answer first
2foundation · easy
What is the core principle of application control?
Select an answer first
3application · medium
A security team is building a software inventory for a newly acquired subsidiary. The subsidiary uses a variety of operating systems and has no existing inventory. The team's goal is to identify all installed software and assess risk. Which scope should the inventory cover?
Select an answer first
4expert · hard
A security architect is designing an application control policy for a Windows environment. The policy must allow standard users to run approved applications but prevent them from installing new software. The environment includes a mix of signed and unsigned legacy applications. Which approach best meets the requirement?
Select an answer first
5application · medium
A security analyst needs to produce a monthly report of all installed software across the organization, including version numbers and installation dates. The environment consists of 5,000 Windows endpoints, all connected to the corporate network. Which data collection method is most efficient and accurate for this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Software Inventories and Application Control GMON Practice Questions (Page 1)

Questions 1–5

A security analyst is evaluating application control solutions for a high-security environment. The organization wants to prevent execution of any unapproved executable, including those that are newly created or renamed. Which approach is most effective?

What is the core principle of application control?

A security team is building a software inventory for a newly acquired subsidiary. The subsidiary uses a variety of operating systems and has no existing inventory. The team's goal is to identify all installed software and assess risk. Which scope should the inventory cover?

Keep studying — Endpoint and Host Monitoring