A critical vulnerability is announced in a specific version of a PDF reader. The vulnerability team must identify every laptop running that version so it can prioritize remediation. Which data source answers this most directly?
Select an answer to reveal the explanation.
Short Explanation
When the question is "who has version X installed?", you want the list that actually records what's installed. That's software inventory, from your endpoint management or EDR tooling. Network logs tell you who talked to whom, not what's sitting on each disk.
Full Explanation
Software inventory collected by endpoint management, MDM or endpoint security agents records installed applications and their versions for each managed device. Querying that inventory for the vulnerable product and version produces the list of affected laptops directly, which can then be ranked by exposure, owner and business criticality to drive remediation. Cisco Secure Endpoint, for example, can report vulnerable software found on connectors, and endpoint management platforms provide similar inventory reports. Firewall connection logs show traffic to a vendor's website, which indicates nothing reliable about which version is installed; many installations never contact the vendor, and visits can be unrelated. DNS query logs record names that were resolved and the clients that asked, not the version of the application that made the request. Wireless association records hold client MAC addresses, SSIDs and connection details; they do not contain installed application versions. Exam caveat: inventory coverage matters as much as accuracy, because devices without an agent will not appear, so unmanaged laptops need discovery first. Operational check: run an inventory report filtered on the product and version, compare the count with the managed device total, and track remediation until the vulnerable version no longer appears on any device.