Software Inventories and Application Control GMON Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An organization uses a third-party application control tool that supports both allowlist and denylist modes. They have a large number of endpoints with a wide variety of software. They want to reduce the risk of malware while minimizing administrative overhead. Which approach is most effective?

   • AUse an allowlist mode with a baseline of approved applications and a process for requesting exceptions.
   • BUse a denylist mode and rely on antivirus for unknown threats.
   • CUse a hybrid mode that allows all signed applications and blocks unsigned ones.
   • DUse a denylist mode with a regularly updated list of known malware hashes.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company has endpoints in multiple geographic regions. They want to collect software inventory centrally. They are considering using a network scanner that sends probes from a central location. However, some remote endpoints are only reachable via VPN and have limited bandwidth. What is the most important consideration?

   • AThe network scanner will require agents on all endpoints.
   • BThe network scanner may not provide complete data for endpoints that are offline or have limited connectivity.
   • CThe network scanner will not work across VPN connections.
   • DThe network scanner will consume too much bandwidth and should be avoided.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company's application control policy uses an allowlist. A critical application is updated frequently, and the security team is struggling to keep the allowlist current. Users are experiencing downtime when the application is updated. Which approach best addresses the issue?

   • ATemporarily disable application control during updates.
   • BRequire users to request approval for each update before it is installed.
   • CUse a publisher-based rule for the application's vendor instead of hash rules.
   • DUse a path-based rule for the application's installation directory.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is typically included in a software inventory for endpoint monitoring?

   • AThe user's login history and last logon time
   • BThe application name, version, publisher, and installation date
   • CThe list of running processes and their CPU usage
   • DThe IP address and MAC address of the endpoint
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large enterprise has a software inventory collected via a central agent. The inventory shows that a specific version of a productivity suite is installed on 80% of endpoints. The vendor has announced that this version will reach end-of-life in 60 days. The company has a policy that all software must be supported. The IT team is already working on a migration to a new version, but it will take 90 days. What is the most appropriate action?

   • AAccelerate the migration to complete within 60 days.
   • BIgnore the end-of-life date because the software still works.
   • CDocument the risk and request an exception to the policy for the 30-day overlap.
   • DImmediately block the software using application control.
   Reveal Solution Discussion Select an answer first