Asset Discovery, Inventory, and Configuration Management
What the exam tests
This domain tests how you build a trustworthy inventory: discovery methods, data normalization, reconciliation rules, and the configuration disciplines that keep records current.
Core rules
- Discovery collects facts; inventory is the curated record; configuration management adds relationships and controls change. A scan output is not an asset register.
- Common sources: agent-based tools (rich detail, install overhead), agentless scanning (covers unmanaged devices, but needs credentials and firewall access), cloud provider APIs, MDM/UEM, SNMP for network gear, and procurement/ERP for financial attributes.
- Normalization maps messy vendor strings to a controlled model (manufacturer, model, OS, version). Without it, reporting and license reconciliation collapse.
- Reconciliation compares sources and applies precedence rules: which system is authoritative for which attribute. Serial number and MAC address are common match keys; hostname is not.
- Configuration baselines and drift detection turn inventory into control.
Worked example
Two subnets hold roughly 600 devices. Agents report 420. A credentialed scan adds 130, mostly lab and OT devices. Cloud APIs add 60 ephemeral VMs that never appear on a network scan. After deduplication on serial number, with MAC as fallback, the reconciled inventory is 585 unique devices, not 610 - 25 records were the same laptops appearing twice after OS reimages. Each attribute is then tagged with its authoritative source.
Traps that cost marks
- Relying on a single discovery source and calling it complete.
- Skipping normalization, then discovering that Dell Inc. and DELL are counted as two manufacturers.
- Letting stale records accumulate with no aging or decommission rule.
- Assuming cloud, IoT, and OT estates will be found by traditional network scanning.