SY0-701 Question 284
Single answerMonitoring/asset trackingA security administrator is responding to an incident involving a contractor's laptop that accessed sensitive file shares after business hours. During the investigation, the administrator discovers the laptop does not appear in the company's approved asset inventory, and no endpoint monitoring agent is reporting telemetry for it. Management wants to reduce the chance of similar devices accessing corporate resources in the future while also improving visibility into what assets are actually connected to the environment. Which action would BEST address both requirements?
- A
Implement NAC to verify device compliance and inventory status before granting network access
- B
Increase the retention period of firewall logs from 30 days to 180 days
- C
Configure the SIEM to generate more alerts for failed logon attempts
- D
Require users to change passwords every 30 days
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement NAC because the scenario combines two security needs: controlling access by unmanaged devices and improving visibility into assets connected to the environment. Asset tracking is not just maintaining a spreadsheet or CMDB; it also involves technical controls that identify devices when they attempt to connect and verify they meet organizational requirements. NAC is commonly used to assess device identity and posture, such as whether the system is registered, has the required endpoint agent, or meets policy, before granting access. This aligns with common security best practices around asset management, least functionality, and continuous monitoring. CompTIA Security+ expects candidates to recognize that unknown or unmanaged assets create blind spots and increase risk. Guidance from frameworks such as NIST emphasizes maintaining accurate asset inventories and enforcing access control based on device trust and authorization. In practice, NAC complements asset inventory and endpoint monitoring by helping ensure only known, compliant systems can access corporate resources.
- A. Correct.
Correct. Network Access Control (NAC) can validate whether a device is known, authorized, and compliant before allowing it onto the network. In this scenario, the key problems are an unmanaged asset and lack of visibility. NAC helps enforce asset tracking by identifying devices as they connect and can restrict or quarantine systems that are not present in inventory or do not have required controls such as endpoint agents. This directly addresses both preventing unauthorized access and improving awareness of connected assets.
- B. Incorrect.
Incorrect. Longer firewall log retention may help future investigations, but it does not prevent unknown devices from connecting or improve real-time control over whether an asset is authorized. This is a monitoring improvement for historical analysis, not an asset tracking and access enforcement solution.
- C. Incorrect.
Incorrect. Additional SIEM alerts for failed logons may improve detection of password-related attacks, but the incident involves an unmanaged device that successfully accessed resources. This option does not solve the core issue of identifying and controlling unapproved assets on the network.
- D. Incorrect.
Incorrect. More frequent password changes do not address whether a device is approved, inventoried, or running required monitoring software. This reflects a common misconception that tighter password policies solve endpoint visibility and asset management problems. Even with valid credentials, an unmanaged device could still connect unless access controls are in place.