What is the difference between an allowlist and a denylist in application control?

An allowlist is used for users; a denylist is used for administrators

An allowlist is for operating system files; a denylist is for third-party applications

An allowlist blocks known malware; a denylist permits all software

An allowlist permits only listed applications; a denylist blocks listed applications

Why is it important to regularly review and update application control policies?

To disable application control during maintenance windows

To ensure all users have administrator privileges

To accommodate new software and remove obsolete rules

To increase the number of denylist entries

An organization is deploying application control to 10,000 endpoints. The security team wants to use an allowlist approach but is concerned about the administrative overhead of maintaining hash rules for every application. Which strategy reduces overhead while maintaining strong security?

Use hash-based rules for every executable on every endpoint.

Use a denylist of known malware and allow everything else.

Use publisher-based rules for signed applications and path-based rules for in-house applications.

Use path-based rules for all applications, including those in user-writable directories.

A security analyst is reviewing the software inventory for a Windows workstation that was recently compromised. The inventory shows the standard corporate image plus a portable version of a password-cracking tool in the user's Downloads folder. The organization's application control policy uses an allowlist. What is the most appropriate immediate action for the analyst to take?

Remove the tool from the inventory and update the allowlist to include it so the user can continue working.

Add the password-cracking tool to the denylist and initiate an incident response investigation.

Ignore the tool because portable applications do not appear in the Windows registry and are not subject to application control.

Rebuild the workstation from the standard image and update the software inventory baseline.

GIAC Continuous Monitoring Certification

Domain 3Objective 3

Software Inventories and Application Control GMON Practice Questions (Page 7)

Part of the Endpoint and Host Monitoring domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
Which Microsoft Windows feature is commonly used to implement application control through rules based on file path, publisher, or hash?
Select an answer first
32foundation · easy
What is the difference between an allowlist and a denylist in application control?
Select an answer first
33foundation · easy
Why is it important to regularly review and update application control policies?
Select an answer first
34expert · hard
An organization is deploying application control to 10,000 endpoints. The security team wants to use an allowlist approach but is concerned about the administrative overhead of maintaining hash rules for every application. Which strategy reduces overhead while maintaining strong security?
Select an answer first
35application · medium
A security analyst is reviewing the software inventory for a Windows workstation that was recently compromised. The inventory shows the standard corporate image plus a portable version of a password-cracking tool in the user's Downloads folder. The organization's application control policy uses an allowlist. What is the most appropriate immediate action for the analyst to take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Software Inventories and Application Control GMON Practice Questions (Page 7)

Questions 31–35

Which Microsoft Windows feature is commonly used to implement application control through rules based on file path, publisher, or hash?

What is the difference between an allowlist and a denylist in application control?

Why is it important to regularly review and update application control policies?

An organization is deploying application control to 10,000 endpoints. The security team wants to use an allowlist approach but is concerned about the administrative overhead of maintaining hash rules for every application. Which strategy reduces overhead while maintaining strong security?

Keep studying — Endpoint and Host Monitoring