An organization is implementing AppLocker on Windows 10 workstations. The security team wants to allow users to run applications from the Windows and Program Files directories, but block execution from the user's Temp folder. Which AppLocker rule configuration is most appropriate?

Create a deny rule for the Temp path only; all other paths are allowed by default.

Create an allow rule for the Windows and Program Files paths and a deny rule for the Temp path.

Use a software restriction policy (SRP) instead of AppLocker because SRP supports path rules more effectively.

Create only an allow rule for the Windows and Program Files paths; the Temp folder will be blocked by default.

What is a key security benefit of implementing application control?

It encrypts all network traffic

It monitors user keystrokes for malicious activity

It prevents unauthorized or malicious software from executing

It automatically patches all software vulnerabilities

During a quarterly review, an analyst compares the software inventory from the CMDB with the actual installed software reported by endpoint agents. The analyst finds that several endpoints have a remote access tool that is not in the CMDB. What is the most likely conclusion?

The remote access tool is unauthorized and should be investigated.

The agent data is incorrect and should be ignored.

The tool is harmless because it is a common utility.

The CMDB is the authoritative source, so the tool is not installed.

An organization is considering moving from a denylist-based antivirus solution to an allowlist-based application control solution. The security team is concerned about the impact on users who frequently install new software. What is the primary trade-off?

Denylisting provides stronger protection against unknown malware but requires more administrative effort.

Allowlisting requires less administrative effort but provides weaker protection.

Denylisting and allowlisting require the same amount of administrative effort.

Allowlisting provides stronger protection against unknown malware but requires more administrative effort to maintain.

What is the primary purpose of maintaining a software inventory in endpoint monitoring?

To provide a comprehensive list of installed software for security, compliance, and lifecycle management

To track the physical location of each endpoint device

To enforce password policies on all endpoints

To monitor network traffic generated by each application

GIAC Continuous Monitoring Certification

Domain 3Objective 3

Software Inventories and Application Control GMON Practice Questions (Page 4)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 16–20

16application · medium
An organization is implementing AppLocker on Windows 10 workstations. The security team wants to allow users to run applications from the Windows and Program Files directories, but block execution from the user's Temp folder. Which AppLocker rule configuration is most appropriate?
Select an answer first
17foundation · easy
What is a key security benefit of implementing application control?
Select an answer first
18application · medium
During a quarterly review, an analyst compares the software inventory from the CMDB with the actual installed software reported by endpoint agents. The analyst finds that several endpoints have a remote access tool that is not in the CMDB. What is the most likely conclusion?
Select an answer first
19expert · hard
An organization is considering moving from a denylist-based antivirus solution to an allowlist-based application control solution. The security team is concerned about the impact on users who frequently install new software. What is the primary trade-off?
Select an answer first
20foundation · easy
What is the primary purpose of maintaining a software inventory in endpoint monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.