A security analyst is reviewing the software inventory and finds that a user has installed a screen-sharing tool that is not on the approved list. The user states it is needed for a remote presentation to a client. The organization's policy requires all software to be approved, but the presentation is in two hours. What is the best course of action?

Add the tool to the allowlist permanently because it is needed for client presentations.

Ignore the tool because it is only needed for a short time.

Allow the tool temporarily for the presentation and then remove it, documenting the exception.

Remove the tool immediately and tell the user to use an approved alternative.

An organization uses AppLocker to allowlist applications. A new version of a critical business application is released, but the AppLocker publisher rule only allows the old version. Users cannot launch the new version. What is the best way to handle this?

Ask users to run the application from a different folder.

Temporarily disable AppLocker for the affected users.

Create a new hash rule for the new executable.

Update the publisher rule to allow the new version and test in a pilot group.

A company is implementing application control for the first time. They have a diverse environment with many legacy applications that are not signed. They want to minimize user disruption while still blocking unknown executables. Which implementation strategy is best?

Immediately enforce a strict allowlist of only signed applications.

Start in audit mode to identify all applications in use, then create allowlist rules based on the collected data.

Use a denylist of known malicious hashes.

Deploy the policy to all endpoints at once without testing.

A security administrator is designing an application control policy for a fleet of kiosk computers that run a single, fixed set of applications. The kiosks are in public areas and should not allow any other software to run. Which approach is most appropriate?

Use a path-based allowlist that includes the system drive.

Use a strict allowlist that includes only the required kiosk applications.

Use a user-based policy that requires admin approval for each run.

Use a denylist of known malicious software.

Which method of collecting software inventory data relies on a lightweight program installed on each endpoint?

Configuration management database (CMDB) integration

GIAC Continuous Monitoring Certification

Domain 3Objective 3

Software Inventories and Application Control GMON Practice Questions (Page 5)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 21–25

21expert · hard
A security analyst is reviewing the software inventory and finds that a user has installed a screen-sharing tool that is not on the approved list. The user states it is needed for a remote presentation to a client. The organization's policy requires all software to be approved, but the presentation is in two hours. What is the best course of action?
Select an answer first
22application · medium
An organization uses AppLocker to allowlist applications. A new version of a critical business application is released, but the AppLocker publisher rule only allows the old version. Users cannot launch the new version. What is the best way to handle this?
Select an answer first
23application · medium
A company is implementing application control for the first time. They have a diverse environment with many legacy applications that are not signed. They want to minimize user disruption while still blocking unknown executables. Which implementation strategy is best?
Select an answer first
24application · medium
A security administrator is designing an application control policy for a fleet of kiosk computers that run a single, fixed set of applications. The kiosks are in public areas and should not allow any other software to run. Which approach is most appropriate?
Select an answer first
25foundation · easy
Which method of collecting software inventory data relies on a lightweight program installed on each endpoint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.