SY0-701 Question 287
Single answerInventoryA security administrator is preparing for a vulnerability management initiative after several unmanaged devices were discovered during an audit. The organization has laptops, on-premises servers, virtual machines, network printers, and a growing number of cloud-hosted systems. Leadership wants to reduce blind spots before the first vulnerability scan is scheduled. Which action should the administrator take FIRST to most effectively improve security visibility?
- A
Create and maintain a complete asset inventory that includes hardware, software, ownership, and network location
- B
Run credentialed vulnerability scans across all IP ranges immediately to identify missing patches
- C
Block all unknown MAC addresses at the switch level until each device can be reviewed
- D
Deploy a SIEM to collect logs from critical servers and firewalls before cataloging assets
Show answer and explanation
Correct answer: A
Explanation
The best first action is to establish a complete asset inventory. In Security+ contexts, inventory is a core administrative and technical control because organizations need to know what hardware, software, virtual assets, and cloud resources they own or manage before they can secure them effectively. This supports vulnerability management, patch management, access control, incident response, and configuration management. Industry best practices align with this approach. For example, NIST guidance and the CIS Critical Security Controls emphasize enterprise asset management and software inventory as foundational controls. Once assets are identified and categorized, the administrator can more effectively perform credentialed scans, assign remediation to system owners, prioritize critical systems, and validate that monitoring tools such as a SIEM have complete coverage.
- A. Correct.
Correct. Building and maintaining an accurate asset inventory is the foundational first step for security operations, including vulnerability management. You cannot reliably assess, prioritize, or remediate systems you do not know exist. A useful inventory should identify devices and systems, their owners, business purpose, software, and where they reside on the network or in cloud environments. This reduces blind spots and supports later activities such as scanning, patching, and incident response.
- B. Incorrect.
Incorrect. Vulnerability scanning is important, but running scans before establishing an inventory can miss unmanaged or untracked assets, produce incomplete results, and make remediation harder because ownership and criticality are unknown. Scanning is more effective after the organization understands what assets exist and who is responsible for them.
- C. Incorrect.
Incorrect. Blocking unknown MAC addresses may sound like a strong control, but it is not the best first step for improving visibility across a mixed environment that includes cloud-hosted systems and virtual machines. It can also disrupt operations and does not create a reliable inventory of software, servers, cloud resources, or device ownership. This reflects the misconception that access control alone replaces asset management.
- D. Incorrect.
Incorrect. A SIEM improves log aggregation and monitoring, but it depends on known systems being onboarded. If the organization has unmanaged devices, the SIEM will not automatically solve the visibility problem because unknown assets may not be sending logs at all. Inventory should come first so the administrator knows which assets should be integrated into monitoring.