Software Inventories and Application Control GMON Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization needs to inventory software on a mix of Windows, Linux, and macOS endpoints. Many endpoints are offline for extended periods, and the organization wants to avoid deploying agents to every system. Which approach best balances coverage and practicality?

   • AUse a combination of agent-based collection on always-on systems and network scans for transient endpoints.
   • BRequire all endpoints to be online and use a single agent-based tool for all platforms.
   • CRely solely on network scanning to identify software from open ports and banners.
   • DUse only configuration management database (CMDB) integration, assuming it is always current.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization uses AppLocker with a publisher-based allowlist. A user needs to run a new internal tool that is signed by the company's certificate, but the tool is blocked. The administrator discovers that the AppLocker rule only allows a specific version of the certificate. The tool is signed with a new certificate that is not yet trusted. What is the best way to resolve this while maintaining security?

   • AAsk the developer to sign the tool with the old certificate.
   • BCreate a hash rule for the new tool's executable.
   • CTemporarily disable AppLocker for the user's machine.
   • DAdd the new certificate to the trusted publishers list and update the AppLocker rule to allow it.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is choosing between AppLocker and Windows Defender Application Control (WDAC) for a high-security environment. The environment has a mix of legacy and modern applications, and the team needs to block unsigned executables while allowing signed ones. They also need to support future applications without frequent policy updates. Which solution is more appropriate?

   • AAppLocker with hash rules for all known executables.
   • BWDAC with deny rules for unsigned executables.
   • CWDAC with publisher rules, because it provides stronger protection and supports signing-based allowlisting.
   • DAppLocker with path rules, because it is easier to manage.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a software inventory review, an analyst notices that a user has installed a freeware media player that is not on the approved software list. The user claims it is needed for a one-time project. The organization's policy requires all software to be approved. What is the best course of action?

   • ARemove the software and direct the user to request approval through the standard process.
   • BAllow the software to remain because the user has a legitimate business need.
   • CDeny all media players by adding them to the denylist.
   • DAdd the software to the allowlist without review because it is freeware.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a quarterly software inventory review, an analyst finds that several engineering workstations have an outdated version of a Java runtime that is no longer supported by the vendor. The organization has a policy requiring all software to be supported. What should the analyst do first?

   • AAdd the outdated Java runtime to the allowlist to ensure it continues to run.
   • BUpdate the software inventory baseline to mark the Java runtime as acceptable.
   • CImmediately uninstall the outdated Java runtime from all affected workstations.
   • DIdentify which applications depend on the outdated Java version and plan an upgrade or replacement.
   Reveal Solution Discussion Select an answer first