200-201 Question 320
Select 3A cybersecurity analyst is tasked with creating an asset inventory for the organization. During this process, they discover that several unauthorized IoT devices have been connected to the corporate network. Which of the following steps should the analyst take as part of effective asset management to address this issue?
- A
Document the discovered IoT devices in the asset inventory and categorize them.
- B
Immediately disconnect all unauthorized IoT devices from the network without further investigation.
- C
Assess the potential security risks posed by the unauthorized IoT devices.
- D
Develop and enforce a policy for the proper onboarding of IoT devices.
- E
Ignore the issue as long as the devices have not caused any visible security incidents.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective asset management involves maintaining an accurate inventory of all assets, assessing risks, and implementing policies to prevent unauthorized devices from being connected. By documenting the devices, evaluating their risks, and enforcing proper onboarding processes, the organization can mitigate potential threats and improve its security posture.
- A. Correct.
Documenting and categorizing the devices is a critical step in asset management, as it ensures the organization has a record of all connected assets, including unauthorized ones.
- B. Incorrect.
Immediately disconnecting devices without investigation could disrupt legitimate operations or critical systems, and it does not address the root cause of the issue.
- C. Correct.
Assessing the security risks is essential to understand the potential impact of these devices and to prioritize mitigation actions accordingly.
- D. Correct.
Developing and enforcing an onboarding policy helps prevent the recurrence of unauthorized devices on the network and ensures proper management of IoT assets.
- E. Incorrect.
Ignoring the issue is not a valid response, as unauthorized devices can introduce significant security vulnerabilities regardless of whether incidents have occurred.