Software Inventories and Application Control GMON Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company uses an application allowlist that includes a specific version of a business application. The vendor releases a security update that changes the executable's file hash. Users report that the application no longer launches after the update. What is the most appropriate response?

   • AAdd a rule to allow all executables from the vendor's publisher.
   • BRevert the application to the previous version and add the old hash back to the allowlist.
   • CTemporarily disable application control until the application is updated.
   • DUpdate the allowlist to include the new file hash after verifying the update's authenticity.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team needs to build a software inventory for a network that includes both managed Windows workstations and unmanaged IoT devices. They want to minimize the number of agents deployed. Which approach is most appropriate?

   • AUse only network scanning for all devices.
   • BUse only agent-based collection for all devices.
   • CUse network scanning for unmanaged IoT devices and agent-based collection for managed workstations.
   • DIntegrate with the CMDB and rely solely on its data.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst at a mid-sized company is reviewing the software inventory collected from all endpoints. The inventory was gathered via an agent that reports installed applications weekly. The analyst notices that a legacy browser version appears on 40% of endpoints, but the vendor has announced end-of-life and known vulnerabilities. The company policy requires all software to be supported. What should the analyst do first?

   • AImmediately block the browser using application control to prevent exploitation.
   • BCreate a compliance report and notify the endpoint owners to upgrade the browser.
   • CIgnore the finding because the browser is still functioning.
   • DRemove the browser from all endpoints using remote uninstall.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is planning to implement a software inventory program. They have a mix of physical and virtual endpoints, including some that are ephemeral (created and destroyed frequently). They want to ensure that the inventory is accurate and up-to-date. What is the most important consideration?

   • AThe inventory should be collected manually by administrators.
   • BThe inventory collection must be automated and integrated with the virtualization platform to capture ephemeral endpoints.
   • CThe inventory should be collected once per year.
   • DThe inventory should only track physical endpoints.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security administrator is implementing application control on a fleet of Windows servers. The servers run a mix of in-house and third-party applications. The administrator wants to minimize administrative overhead while maintaining strong security. Which application control approach is most appropriate?

   • AUse a publisher-based allowlist for third-party applications and a path-based allowlist for in-house applications.
   • BDisable application control on servers to avoid performance impact.
   • CUse a hash-based allowlist for every executable on each server.
   • DUse a denylist of known malicious executables.
   Reveal Solution Discussion Select an answer first