A company wants to enforce application control on Windows endpoints. They need to allow only signed executables from trusted publishers and block everything else. Which mechanism is best suited for this requirement?

Group Policy to disable the command prompt.

Software Restriction Policies (SRP) with path rules.

Windows Defender Application Control (WDAC) with publisher rules.

AppLocker with path rules for Program Files.

An organization has a mix of Windows and Linux servers. The security team wants to collect software inventory data without installing agents on every server. They have a configuration management database (CMDB) that is updated by the IT team. What is a limitation of relying solely on the CMDB for software inventory?

The CMDB automatically detects all software without manual input.

The CMDB may not reflect real-time software changes made outside of change management.

The CMDB is only available for Windows systems.

The CMDB cannot store software version information.

What is the primary goal of analyzing software inventory data?

To measure the network bandwidth consumed by each application

To monitor user keystrokes and input activity

To determine the physical location of each endpoint

To identify software that is unauthorized, outdated, or vulnerable

What is the recommended approach for handling exceptions to application control policies?

Ignore the exception and rely on user feedback

Add the application to the denylist

Disable application control for the affected user

Document the exception, obtain approval, and apply a temporary rule with a review date

What is a primary advantage of using network-based scanning to collect software inventory data?

It can discover software on endpoints that are powered off

It provides real-time CPU and memory usage of each application

It is immune to firewall and authentication restrictions

It does not require installing software on each endpoint

GIAC Continuous Monitoring Certification

Domain 3Objective 3

Software Inventories and Application Control GMON Practice Questions (Page 3)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 11–15

11application · medium
A company wants to enforce application control on Windows endpoints. They need to allow only signed executables from trusted publishers and block everything else. Which mechanism is best suited for this requirement?
Select an answer first
12application · medium
An organization has a mix of Windows and Linux servers. The security team wants to collect software inventory data without installing agents on every server. They have a configuration management database (CMDB) that is updated by the IT team. What is a limitation of relying solely on the CMDB for software inventory?
Select an answer first
13foundation · easy
What is the primary goal of analyzing software inventory data?
Select an answer first
14foundation · easy
What is the recommended approach for handling exceptions to application control policies?
Select an answer first
15foundation · easy
What is a primary advantage of using network-based scanning to collect software inventory data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.