A closet audit finds undocumented switches bridging segments in city hall. Which asset-management activity most directly finds such shadow devices?

Unmanaged shadow switches in closets do not announce themselves through help-desk tickets. Inventory plus enumeration or continuous discovery—scanning, network mapping, switch MAC tables, wireless surveys, and monitoring for new devices—finds gear that never entered the approved register. That visibility is how municipal security operations close gaps before rogue bridges extend VLANs, bypass network access control, create spanning-tree surprises, or leave troubleshooting black holes during citizen-facing outages. Discovery turns the unknown unknown into a tracked asset that can be approved, segmented, or removed. Deleting the asset register so unknown devices cannot appear as gaps hides the problem instead of solving it and destroys the baseline needed for future reconciliation. Relying solely on verbal claims that nothing new was installed trusts memory and hallway assurances over measurement. Waiting for users to file tickets after outages caused by rogue gear makes discovery reactive, slows incident response, and lets unauthorized hardware affect services before security ever learns it exists. Exam caveat: inventory and enumeration are proactive discovery controls; distractors often replace them with denial, hearsay, or ticket-driven surprise. Operational check: run scheduled discovery against wiring closets and access layers, reconcile findings to the asset register at least weekly, photograph or tag closet gear during walkthroughs, and escalate any switch or access point that lacks an approved change record before it remains in production.