A vulnerability manager discovers that the scanner's target list was built years ago from a spreadsheet, and a recent compromise involved an on-premises server on a subnet that had never been scanned. Which source would BEST establish the full set of address ranges and allocations in use so future scans cover every network?

Vulnerability identification starts with scope, and scope for network scanning is ultimately a list of address space. IP address management (IPAM) centralizes the allocation of subnets, DHCP scopes, reservations, and leases, so it reflects what the organization has actually assigned rather than what someone remembered to type into a spreadsheet. Reconciling scanner targets against IPAM closes the gap that let an unscanned subnet host a compromised server, and doing it on a schedule catches subnets added later. A penetration test report lists only what testers reached within their rules of engagement and time box; it is a sample, not an authoritative inventory. A cloud security posture management tool evaluates cloud account configurations and does not enumerate on-premises address space. Enabling credentialed scans improves the depth of results per host, yet it still runs only against the stale target list, so the missing subnet stays invisible. Exam caveat: IPAM shows allocated space, not necessarily every rogue device; discovery scans across the allocated ranges complement it. Operational check: export the IPAM subnet list, diff it against the scanner's configured targets, and add every unmatched range before the next scan cycle.