A security team discovers devices on the network that appear in no system it manages: no EDR agent, no MDM record and no known owner. Before it can protect or monitor these endpoints, what must it establish first?
Select an answer to reveal the explanation.
Short Explanation
You can't guard a house when you don't know how many doors it has. An asset inventory is that list of doors: what's out there, who owns it and what's running on it. Every other control, from EDR to posture, starts with knowing the device exists.
Full Explanation
Asset inventory is the foundation of endpoint security. Controls such as EDR, MDM, posture assessment and vulnerability management can only be applied to devices that are known, classified and assigned an owner. Discovered devices with no agent, no management record and no owner represent unmanaged risk: they are not patched or monitored, and they may not be authorized at all. Building an accurate inventory from sources such as network discovery, DHCP and switch data, NAC profiling and management platforms allows each device to be classified, assigned to an owner and either enrolled in the right controls or removed. A stricter EDR policy changes behavior only on hosts that already run the agent; agents do not spread themselves to unknown devices. A SIEM correlates log events, and while it can help surface unknown addresses, it does not determine ownership or create management on its own. DHCP lease time affects address stability and has nothing to do with whether a device can be protected or monitored. Exam caveat: inventory is continuous rather than a one-time project, because new devices appear constantly, which is why it is paired with NAC and profiling. Operational check: reconcile network-discovered devices against EDR and MDM records and list every device that appears in neither.