Asset Discovery and Inventory
This domain tests how you find known, unknown, and forgotten assets and reconcile them into an inventory you can trust.
Discovery techniques
Passive discovery uses certificate transparency logs, passive DNS, WHOIS/RDAP, ASN lookups, and internet-wide scan datasets. Active discovery uses ping sweeps, ARP tables, port scans, cloud provider APIs, and endpoint agents. Each produces different evidence; combine them and normalize identifiers (FQDN, IP, cloud resource ID, MAC, owner).
Inventory quality
A usable inventory records owner, business function, environment, criticality, and last-seen time. Include IPv6, non-HTTP services, ephemeral cloud instances, and shadow IT. Reconcile against the CMDB and flag assets with no owner. Discovery without reconciliation is just a scan.
Worked example
Certificate transparency reveals dev.example.com, which is absent from the CMDB. The reasoning: CT logs show issuance, not ownership, so resolve the name, inspect the certificate organization, and check a DNS TXT record controlled by the client. If it belongs to the client, add it with the cloud account ID and owner; if not, record it as out of scope.
Traps
Treating an IP address as a stable asset identity when cloud IPs are reused. Scanning third-party hosted services without permission. Assuming the CMDB is complete. Missing services on non-standard ports or UDP. Failing to record discovery time and source, which weakens later evidence.