15 Asset Management · Security+

Exam objective 4.2: Explain the security implications of proper hardware, software, and data asset management.

This objective covers the full life cycle of the things an organization owns and depends on: hardware such as servers, laptops, phones, network gear, and IoT devices; software such as installed applications, licenses, SaaS subscriptions, and cloud workloads; and data in every form and location. The official objective organizes the material around five life-cycle stages: planning and scoping, acquisition and procurement, assignment and accounting, monitoring and asset tracking, and disposal and decommissioning.

This is an "explain" objective. You need to understand why each stage matters to security, what can go wrong when it is skipped, and which practice or document addresses a given problem. Questions typically describe a situation—an unknown device on the network, a laptop that left with a departed employee, a decommissioned server sold with data still on its drives—and ask which asset management practice failed or which step should come next.

Why Asset Management Is a Security Control

The first two controls in the CIS Critical Security Controls are inventory and control of enterprise assets and inventory and control of software assets, and the NIST Cybersecurity Framework begins its Identify function with asset management. The reasoning is simple: you cannot protect what you do not know you have. A server nobody remembers will not be patched. A SaaS subscription bought with a corporate credit card will not be covered by single sign-on or logging. A copy of the customer database on a forgotten file share will not be encrypted, backed up, or deleted on schedule.

Asset management supports almost every other part of the security program:

Vulnerability management (Chapter 16) needs an accurate inventory to know what to scan and to judge how important each finding is.
Incident response (Chapter 20) needs to know who owns an affected system, what it does, and what data it holds.
Risk management (Chapter 23) begins with asset identification and valuation.
Monitoring (Chapter 17) depends on knowing which systems should be sending logs and which are missing.
Business continuity (Chapter 13) depends on knowing which assets support critical processes.
Compliance (Chapter 25) frequently requires demonstrable inventories, data maps, and disposal records.

Security failures that trace back to poor asset management are common: unmanaged internet-facing servers exploited because they were never patched, cloud storage buckets exposed because no one knew they existed, and retired equipment sold or recycled with sensitive data still readable.

Exam tip

When a question asks what should be done first to improve security in an environment nobody fully understands, or what is a prerequisite for vulnerability scanning, patching, or risk assessment, the answer is often to create or update an asset inventory.

What Counts as an Asset

An asset is anything of value to the organization that needs protection. Objective 4.2 names three kinds.

Asset type Examples Typical security concerns

Hardware Servers, workstations, laptops, mobile devices, network equipment, storage arrays, printers, IoT and

OT devices, removable media

Physical loss or theft, firmware vulnerabilities, unmanaged devices, data remaining on disposal

Software Operating systems, applications, libraries, firmware, SaaS subscriptions, virtual machines, containers, cloud services, licenses

Unpatched or end-of-life versions, unlicensed or unauthorized software, shadow IT, supply chain risk

Data Databases, files, backups, logs, email, source code, intellectual property, personal data

Exposure, unauthorized access, retention beyond

need, loss of integrity, regulatory violations

Assets can also be grouped as tangible (physical things) and intangible (data, intellectual property, licenses, reputation). Virtual and cloud resources blur the line: a virtual machine is software, but it behaves like a server and must be inventoried as one. Ephemeral resources such as containers and serverless functions may exist for only minutes, which is why modern asset management relies heavily on automated discovery.

The Asset Life Cycle

Every asset passes through a life cycle from the decision to acquire it to its final disposal. Security must be involved at every stage, not just when the asset is in use.

Stage Key question Key security activities
Planning/
scoping

What do we need, and what are the security requirements?

Requirements, risk assessment, architecture review, data classification

Acquisition/

procurement

Where and how do we obtain it? Approved vendors, supply chain checks, contract security terms, licensing

Stage Key question Key security activities
Assignment/
accounting

Who owns it, who uses it, and how is it recorded?

Inventory entry, ownership, classification, tagging, baseline configuration

Monitoring/

asset tracking

Is it still where it should be, configured as it should be?

Discovery, inventory reconciliation, enumeration, configuration
and license monitoring
Disposal/
decommissioni
ng

How do we retire it safely? Data sanitization or destruction, certification, inventory update, retention compliance

Memory aid

The life cycle in order: Plan, Acquire, Assign, Monitor, Dispose — "Please Always Assign, Monitor, and Dispose."

Planning and Scoping

Planning and scoping is the stage in which the organization decides what it needs, why, and under what constraints, before money is spent. Including security at this stage is the cheapest way to get it right; retrofitting security after deployment is expensive and often incomplete.

Security activities during planning include:

Defining the business need and scope. What problem does the asset solve? Which business processes, users, and data will it touch? A clear scope prevents both under-buying (missing capabilities) and over-buying (unneeded features that expand attack surface).
Identifying security requirements. Encryption support, authentication integration (SSO, MFA), logging capability, patching support, compliance certifications, and vendor support life.
Classifying the data involved. If the system will process regulated or confidential data, requirements for encryption, location, and retention follow (Chapter 12).
Assessing risk. What could go wrong, and how bad would it be? A risk assessment at this stage may lead to choosing a different product or architecture.
Considering the full life cycle. How long will the asset be supported? A product nearing end of life (EOL) or end of support will soon stop receiving security patches, creating legacy risk (Chapter 7).
Capacity and compatibility planning. Ensuring the asset integrates with existing security tools such as EDR, SIEM, NAC, and backup.
Budgeting for security. Including the cost of licenses for security features, training, and secure disposal at end of life—the total cost of ownership.

Scoping also applies to the asset management program itself: deciding which asset classes will be tracked, at what level of detail, and with what tools. A small business may track laptops in a spreadsheet; a large enterprise needs a configuration management database (CMDB) fed by automated discovery.

Real-world scenario

A hospital department plans to buy networked infusion pumps. Because the security team is involved during planning, it learns that the preferred model runs an operating system that reaches end of support in eighteen months and cannot receive EDR. The team requires the vendor to commit to a patching schedule, budgets for a dedicated medical-device VLAN, and documents a compensating-control plan before purchase—rather than discovering these issues after deployment.

Acquisition and Procurement

Acquisition and procurement is the process of obtaining assets, whether by purchase, lease, subscription, open-source download, or internal development. Security failures here introduce risk that is very hard to remove later.

Procurement Controls

Formal procurement process. Purchases should go through an approved process with security review, rather than individuals buying hardware or signing up for SaaS on their own. Unapproved acquisitions are a primary source of shadow IT.
Approved vendor and product lists. Pre-vetted suppliers and models simplify procurement and support standardization, which makes hardening and patching easier.
Vendor due diligence. Assessing the vendor's security practices, certifications (such as SOC 2 reports or ISO/IEC 27001 certification), vulnerability disclosure history, financial stability, and support commitments. Chapter 24 covers third-party risk management in detail.
Contractual security terms. Security requirements, breach notification obligations, right to audit, data ownership and return, and service-level agreements belong in the contract.
Licensing. Ensuring software is properly licensed avoids legal and financial penalties and ensures access to vendor updates. Pirated or "cracked" software is a common malware carrier.

Supply Chain Security

Hardware and software can be compromised before they arrive. Supply chain concerns include counterfeit hardware, firmware implants, tampered shipments, malicious code inserted into software updates, and vulnerable open-source dependencies. Mitigations include:

Buying from authorized resellers and the original manufacturer rather than gray-market sources.
Inspecting shipments for tampering and verifying serial numbers against vendor records.
Verifying software integrity through code signatures and published hashes.
Requesting a software bill of materials (SBOM), an inventory of the components and libraries in a software product, so that the organization can track vulnerable components.
Using hardware with secure boot, measured boot, and a TPM to detect tampering with firmware and boot components.

Secure Onboarding of New Assets

Before a new asset goes into production, it should receive the organization's secure baseline configuration (Chapter 14): default passwords changed, unneeded services disabled, patches applied, security agents installed, and logging configured. Many organizations stage new equipment in an isolated build network for this purpose. Firmware should be updated before deployment because devices often ship with outdated versions.

Common trap

Free trials and personal-credit-card SaaS subscriptions bypass procurement controls entirely. Corporate data uploaded to an unapproved service is outside the organization's contracts, logging, access controls, and retention policies. Cloud access security brokers (CASBs) and SSO-only access policies help detect and limit this shadow IT.

Assignment and Accounting

Once acquired, every asset must be recorded and assigned. Assignment establishes who is responsible for the asset and who uses it. Accounting keeps an accurate record of what the organization has, where it is, and its status.

Ownership

Every asset should have a clearly identified owner: the person or role accountable for it, usually a business leader rather than IT. The owner decides who should have access, approves changes, accepts risks, and ensures the asset is protected according to its classification. Asset owners are distinct from custodians (often IT or system administrators), who perform day-to-day management such as patching, backups, and access provisioning on the owner's behalf, and from users, who use the asset for their work.

Role Responsibility Example

Owner Accountable for the asset; decides on access, classification, and risk acceptance

VP of Finance owns the ERP system and its data

Custodian Implements and maintains protections on the owner's behalf

Database administrators patch and back up the ERP database

User Uses the asset in accordance with policy Accountants enter invoices in the ERP system

Ownership matters for security because unowned assets are unmanaged assets. When a vulnerability is found or an incident occurs, responders need to know whom to call and who can authorize downtime. Chapter 22 discusses data roles (owner, controller, processor, custodian, steward) in governance terms.

Classification

Assets, especially data and the systems that hold it, should be classified according to sensitivity and criticality. Common labels include public, internal, confidential, and restricted (or, in government, unclassified, confidential, secret, and top secret). Classification drives the controls applied: a laptop that stores restricted data may require full-disk encryption, EDR, and stronger authentication, while a lobby display kiosk needs far less. Criticality also determines patching priority and recovery order. Chapter 12 covers data classification in depth.

Inventory Records

An asset inventory (or asset register) records each asset and its key attributes. A useful hardware inventory record includes:

Asset tag number and serial number
Make, model, and hardware specifications
MAC address, hostname, and IP address
Location (site, building, room, rack)
Assigned user and asset owner
Classification and criticality
Purchase date, cost, vendor, warranty, and support end date
Operating system and version
Current status (in stock, deployed, in repair, retired, disposed)

Software inventories record product names, versions, install locations, license keys and counts, license expiration, and the systems on which each product runs. Data inventories, often called data maps, record what data exists, where it is stored, its classification, its owner, how it flows between systems, and how long it must be retained.

A CMDB extends the inventory by recording configuration items and the relationships between them— for example, which servers, databases, and network devices support a particular business application. These relationships are invaluable for impact analysis during change management (Chapter 2) and incident response.

Asset ID: LT-2026-04417
Type: Laptop Model: ExampleBook Pro 14
Serial: 5CG4123XYZ MAC: 3C:52:82:1A:9F:04
Assigned to: j.alvarez (Sales) Owner: IT End-User Services
Classification: Handles Confidential data
OS: Windows 11 24H2 Encryption: BitLocker (key escrowed)
EDR: Installed MDM: Enrolled
Purchased: 2026-03-14 Warranty end: 2029-03-13
Status: Deployed
Tagging and Check-Out

Physical asset tags—barcode labels, QR codes, or RFID tags—make hardware easy to identify and audit. Some organizations use tamper-evident tags. When equipment is issued to a user, a check-out or assignment record (often with a signed acknowledgment of the acceptable use policy) creates accountability. When the user changes roles or leaves, the asset must be checked in and recovered as part of offboarding. Unreturned laptops and phones after employee departures are a common audit finding.

Real-world scenario

An employee resigns, and HR processes the departure, but the laptop is not on the offboarding checklist because the inventory lists it as assigned to the employee's former manager. Months later, the former employee still has the device, which contains cached email. Accurate assignment records tied to the offboarding process would have triggered recovery of the device, and MDM could have locked or wiped it remotely.

Monitoring and Asset Tracking

Inventories decay quickly. Devices are moved, reassigned, lost, and added; software is installed and uninstalled; cloud resources appear and disappear in minutes. Monitoring and asset tracking keeps the inventory accurate and detects assets that should not be there.

Inventory

Maintaining the inventory is an ongoing process, not a one-time project. Best practice combines:

Automated discovery: network scanners, DHCP and DNS logs, switch and wireless controller tables, NAC, EDR and MDM agents, and cloud provider APIs all reveal assets.
Reconciliation: comparing discovered assets against the authoritative inventory. Anything discovered but not inventoried is investigated; anything inventoried but not seen for a period may be lost, stolen, or retired without proper records.
Periodic physical audits: walking data centers and offices with barcode or RFID scanners to confirm that equipment is where records say it is.
Integration with procurement and HR: new purchases automatically create inventory entries, and onboarding and offboarding trigger assignment changes.

Figure 15.1: Reconciling automated discovery results against the authoritative inventory sorts assets into confirmed, unknown, and missing

Enumeration

Enumeration is the process of actively identifying and listing the assets, services, and software present in an environment. In asset management, enumeration means systematically answering, "What is actually out there?" Techniques include:

Network scanning and host discovery (for example, with Nmap) to find live hosts, open ports, running services, and operating system fingerprints.
Credentialed or agent-based inventory that queries each system for installed software, versions, and patches.
Cloud enumeration through provider APIs and cloud security posture management tools, listing every virtual machine, storage bucket, database, identity, and serverless function across all accounts and regions.
External attack surface management (EASM), which discovers internet-facing assets—domains, subdomains, certificates, IP ranges, and exposed services—as an attacker would see them.
SaaS discovery through CASBs, SSO logs, expense reports, and web proxy logs to identify cloud applications in use.

$ nmap -sn 10.20.30.0/24
Nmap scan report for 10.20.30.1 (gateway, inventoried)
Nmap scan report for 10.20.30.15 (file server, inventoried)

Nmap scan report for 10.20.30.88 Host is up. MAC Address: B8:27:EB:4C:11:02 (Raspberry Pi Foundation)

Nmap scan report for 10.20.30.102 (laptop LT-2026-04417, inventoried)

In the sample output, the host at 10.20.30.88 does not appear in the inventory, and its MAC address belongs to a single-board computer vendor. It could be an unauthorized device, a forgotten project, or an attacker's implant, and it must be investigated.

Note

Attackers also enumerate. The reconnaissance phase of an attack is essentially the attacker building their own inventory of your assets. If their inventory is more complete than yours, they will find the forgotten test server before you do.

Tracking Hardware, Software, and Data

Asset tracking takes different forms for each asset type:

Hardware tracking uses asset tags, RFID, MDM location services, and network presence. Mobile devices can be located, locked, or wiped through MDM (Chapter 14). Geofencing can alert when devices leave approved areas.
Software tracking monitors installed software against approved lists, tracks versions to identify vulnerable or end-of-life software, and manages license compliance—ensuring the organization is not using more copies than it has licensed, and is not paying for licenses it no longer uses. Application allow lists (Chapter 14) prevent unauthorized software from running at all.
Data tracking uses data discovery and DLP scanning to find sensitive data where it should not be, data maps to record where it should be, and classification labels that follow documents. Data tracking also monitors data retention, flagging records that have exceeded their retention period.

Configuration and Status Monitoring

Monitoring also verifies that assets remain in their approved state. Configuration monitoring detects drift from secure baselines, missing security agents, disabled encryption, or outdated operating systems. Assets that stop checking in to management tools may be powered off, offline, or no longer under control. Status monitoring supports maintenance and warranty planning so that hardware is replaced before it fails or falls out of support.

Exam tip

Keywords such as "unknown device," "rogue system," "shadow IT," or "assets not in the CMDB" point to monitoring and asset tracking. The fix is usually automated discovery plus reconciliation against the inventory, with NAC to prevent unknown devices from connecting in the first place.

Disposal and Decommissioning

Every asset eventually reaches the end of its useful life. Decommissioning is the process of removing an asset from service: migrating its functions and data, removing it from the network, revoking its credentials and certificates, and updating records. Disposal is what happens to the physical hardware or the data afterward: reuse, resale, donation, recycling, or destruction. This stage is where many data breaches happen, because storage devices retain data long after the system that used them is forgotten.

Decommissioning Steps

A secure decommissioning process typically includes:

1. Confirm authorization to retire the asset, through change management, with the asset owner's approval.
2. Identify the data on the asset and determine retention requirements; archive anything that must be kept.
3. Migrate services and dependencies to replacement systems, using the CMDB to find what relies on the asset.
4. Remove access: disable or delete service accounts, revoke certificates and API keys, remove DNS records, firewall rules, and monitoring entries.
5. Sanitize or destroy the storage media using an approved method.
6. Document and certify the sanitization or destruction.
7. Update the inventory to show the asset as disposed, with date, method, and responsible party. Skipping steps creates risk. Leftover DNS records pointing to retired cloud resources can enable subdomain takeover. Firewall rules allowing traffic to a decommissioned server's IP address can be abused when that IP is reassigned. Orphaned service accounts can be compromised and used silently.

Figure 15.2: The seven secure decommissioning steps, with the risks created when access removal is skipped Sanitization

Sanitization is the process of removing data from media so that it cannot be recovered. NIST SP 800-88, Guidelines for Media Sanitization, defines three levels:

Method What it does Result Example

Clear Overwrites user-addressable storage with non-sensitive data using standard read/write commands

Protects against simple, non-invasive recovery;

media can be reused

Overwriting a hard drive with zeros, factory reset of a mobile device

Purge Uses physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory techniques Media can be reused

Cryptographic erase, ATA Secure Erase

or NVMe Sanitize commands, degaussing magnetic media

Destroy Physically destroys the media Media cannot be reused

Shredding, disintegrating, pulverizing, incinerating, melting

Key sanitization concepts:

Simple deletion is not sanitization. Deleting a file or quick-formatting a drive removes only pointers; the data remains and can be recovered with free tools.
Overwriting (wiping) writes patterns over every addressable sector. It works well on traditional hard disk drives (HDDs) but is unreliable on solid-state drives (SSDs) and flash media, because wear leveling and over-provisioning leave data in cells that the operating system cannot address.
Cryptographic erase (crypto-shredding) destroys the encryption key for media that has been encrypted from the start, such as self-encrypting drives or drives protected by full-disk encryption. Without the key, the data is unreadable. It is fast and effective for SSDs and cloud storage, where physical destruction may be impossible.
Degaussing uses a powerful magnetic field to erase magnetic media such as HDDs and tapes. It renders hard drives unusable and has no effect on SSDs or optical media.
Physical destruction is the most certain method and is appropriate for the most sensitive data, failed drives that cannot be wiped, and media whose sanitization cannot be verified. Shred size matters: SSD chips are small, so shredders for flash media must produce very small particles.

Figure 15.3: The media's destination selects the NIST SP 800-88 level, and the media type determines which technique achieves it

Common trap

Degaussing does not work on SSDs or flash memory, and overwriting is not reliable on them either. For SSDs, use the manufacturer's sanitize command, cryptographic erase, or physical destruction.

Memory aid

NIST 800-88 levels in increasing strength: Clear (reuse in-house), Purge (reuse outside, recovery infeasible), Destroy (no reuse). Think "C-P-D: Clean, Pretty sure, Definitely gone."

Certification of Destruction

When sanitization or destruction is performed, especially by a third-party vendor, the organization should obtain a certificate of destruction (or certificate of sanitization). This document records the asset identifiers (serial numbers), the method used, the date, the location, and the person or company that performed and verified the work. Certificates provide evidence for auditors and regulators and establish accountability if data later surfaces. Organizations using a disposal vendor should vet the vendor, review its chain-of-custody procedures for transporting media, and may witness destruction for highly sensitive media.

Data Retention

Disposal must respect data retention requirements. Laws, regulations, contracts, and internal policies may require data to be kept for a minimum period—for example, financial records for several years— and a legal hold (Chapter 25) suspends normal deletion when litigation is reasonably anticipated. At the same time, privacy regulations and good security practice require deleting data once it is no longer needed, because data that does not exist cannot be breached. Before disposing of an asset, confirm that any data subject to retention has been archived to an approved location and that no legal hold applies; after the retention period ends, ensure the data is actually deleted from all copies, including backups where feasible.

Reuse and Disposal Options

Option Security requirement

Internal reuse (redeploy to another employee)

At least clear; reimage with standard baseline; update assignment

Return to lessor or vendor (lease end, warranty swap)

Purge before return, or contractually retain failed drives ("keep your drive" support)

Resale or donation Purge with verification, plus certificate

Recycling (e-waste) Destroy media first or use certified recycler with certificate of destruction Destruction Certificate of destruction, inventory updated

Environmental and legal considerations also apply: electronic waste contains hazardous materials and is regulated in many jurisdictions, so organizations use certified e-waste recyclers.

A company replaces fifty storage array drives under warranty. The vendor's standard process requires returning failed drives, but several held unencrypted patient data and cannot be wiped because they no longer spin up. The organization uses its "keep your drive" support option, retains the failed drives, physically shreds them through a certified vendor, and files the certificate of destruction with the asset records.

Cloud and Virtual Asset Disposal

In the cloud, the organization cannot shred the provider's disks. Decommissioning cloud assets therefore relies on deleting resources and snapshots, revoking keys and identities, and, most importantly, cryptographic erase: if data was encrypted with customer-managed keys, destroying those keys renders any remaining copies unreadable. The shared responsibility model and the provider's contractual commitments govern physical media handling. Organizations must also remember to delete forgotten snapshots, backups, and replicated copies in other regions.

Asset Management Across the Life Cycle: Putting It Together

Problem in a scenario Life-cycle stage that failed

Corrective practice

New system cannot integrate with SSO or

Edr

Planning/scoping Define security requirements before selection

Counterfeit network switch with altered firmware

Acquisition/

procurement

Buy from authorized channels; verify integrity

Department signs up for unapproved SaaS Acquisition/

procurement

Formal procurement, CASB, SSO-only access

No one knows whom to call about a vulnerable server

Assignment/accounting Assign an owner in the inventory/CMDB

Departed employee still has a company laptop

Assignment/accounting Tie asset assignments to offboarding

Unknown device found on the network Monitoring/asset tracking

Automated discovery, reconciliation, NAC

Software past end of support still in production

Monitoring/asset tracking

Version tracking, life-cycle planning

Customer data recovered from a resold hard drive

Asset management is a foundational security control: you cannot protect, patch, monitor, or recover assets you do not know about. It covers hardware, software, and data.
Planning/scoping defines needs, security requirements, data classification, support life, and total cost of ownership before acquisition.
Acquisition/procurement uses formal processes, approved vendors, due diligence, contract terms, licensing, and supply chain protections (authorized channels, integrity verification, SBOMs). Bypassing procurement creates shadow IT.
Assignment/accounting records each asset in an inventory or CMDB, assigns an owner (accountable) and custodian (operational), applies classification, tags hardware, and ties assignment to onboarding and offboarding.
Monitoring/asset tracking keeps the inventory accurate through automated discovery, enumeration, reconciliation, and physical audits, and tracks configuration, versions, licenses, and data locations.
Disposal/decommissioning removes assets from service safely: migrate dependencies, revoke access, clean up DNS and firewall entries, sanitize (clear, purge, destroy per NIST SP 800-88) or destroy media, obtain a certificate of destruction, respect data retention and legal holds, and update records.
Overwriting and degaussing do not reliably sanitize SSDs; use sanitize commands, cryptographic erase, or physical destruction.

Key Terms

Asset; asset management; hardware asset; software asset; data asset; tangible asset; intangible asset; asset life cycle; planning and scoping; end of life (EOL); end of support; total cost of ownership; acquisition; procurement; approved vendor list; vendor due diligence; shadow IT; supply chain; software bill of materials (SBOM); secure baseline; assignment; accounting; asset owner; custodian; user; classification; asset inventory; asset register; data map; configuration management database (CMDB); configuration item; asset tag; RFID; check-out/check-in; monitoring; asset tracking; automated discovery; reconciliation; enumeration; external attack surface management (EASM); license compliance; configuration drift; decommissioning; disposal; subdomain takeover; sanitization; NIST SP 800-88; clear; purge; destroy; overwriting; wiping; cryptographic erase; degaussing; physical destruction; certificate of destruction; data retention; legal hold; e-waste.

Review Questions

1. A security team plans to start a vulnerability management program but discovers that nobody can say how many servers the company runs or where they are. What should the team do FIRST?

A. Purchase a vulnerability scanner license for 500 hosts
B. Build an accurate asset inventory using automated discovery
C. Conduct a penetration test
D. Write a patch management policy

2. During a routine network scan, an analyst finds a device that responds on TCP 22 and does not appear in the CMDB. Which asset management activity identified this problem?

A. Procurement
B. Enumeration
C. Decommissioning
D. Classification

3. A company sells used laptops to a refurbisher. A month later, a researcher reports recovering customer records from one of the laptops' drives. The IT team had deleted all user folders and quick-formatted the drives. Which of the following would have BEST prevented this? (Select TWO.)

A. Requiring a certificate of sanitization or destruction
B. Using a purge method such as the drive's sanitize command or cryptographic erase
C. Emptying the recycle bin before formatting
D. Reassigning the laptops to new asset owners
E. Adding the laptops to the CMDB

4. A vulnerability scan reports a critical flaw on an internal application server. The security team cannot determine who can approve emergency downtime for patching. Which asset management practice was MOST likely neglected?

A. Assigning an asset owner
B. Physical asset tagging
C. License compliance tracking
D. Degaussing

5. An organization needs to sanitize a batch of solid-state drives that will be reused by a different department. Which method is MOST appropriate?

A. Degaussing
B. A single-pass overwrite with zeros
C. Cryptographic erase or the manufacturer's sanitize command
D. Deleting all partitions

6. A marketing department signs up for a cloud file-sharing service using a corporate credit card and uploads customer lists to it. The security team learns of it only through an expense report. Which life-cycle stage's controls were bypassed?

A. Disposal/decommissioning
B. Acquisition/procurement
C. Monitoring/asset tracking
D. Assignment/accounting

7. Which role is ACCOUNTABLE for deciding who should have access to a business application's data and for accepting risks related to it?

A. Custodian
B. User
C. Owner
D. Auditor

8. A company retires a web application hosted in the cloud and deletes the virtual machines. Weeks later, an attacker claims the company's old subdomain and serves phishing content from it. Which decommissioning step was missed?

A. Obtaining a certificate of destruction
B. Removing DNS records that pointed to the retired resources
C. Degaussing the cloud provider's disks
D. Updating the license inventory

9. A security architect is evaluating two network monitoring products during planning. One is significantly cheaper but reaches end of support in one year. Why is this a security concern?

A. It will be harder to tag physically
B. It will stop receiving security patches, creating unmitigated vulnerabilities
C. It cannot be sanitized at disposal
D. It cannot be assigned an owner

10. Which of the following BEST describes the purpose of reconciliation in asset tracking?

A. Comparing discovered assets against the authoritative inventory to find unknown or missing assets
B. Destroying media that cannot be reused
C. Signing contracts with approved vendors
D. Assigning classification labels to data

11. A legal team notifies IT that the company expects litigation involving a former executive. IT is about to decommission and wipe the executive's old laptop and mailbox. What should IT do?

A. Proceed with the wipe according to the normal schedule
B. Degauss the laptop drive and provide a certificate
C. Preserve the data because a legal hold suspends normal disposal
D. Reassign the laptop to a new employee without wiping

12. A hospital wants assurance that hardware arriving for a new deployment has not been tampered with in the supply chain. Which actions would BEST support this? (Select TWO.)

A. Purchasing only from the manufacturer or authorized resellers
B. Verifying firmware signatures and serial numbers on receipt
C. Setting a DMARC policy of reject
D. Applying a block list on workstations
E. Performing a certificate of destruction

Answers and Explanations

1. B. An accurate inventory is the prerequisite for vulnerability management; the team cannot scan, prioritize, or patch systems it does not know about. Buying a license for an arbitrary number of hosts, running a penetration test, or writing a policy all depend on knowing what assets exist.
2. B. Enumeration actively identifies the hosts and services present in the environment, and comparing the results to the CMDB revealed the unknown device. Procurement is about acquiring assets, decommissioning about retiring them, and classification about labeling sensitivity.
3. A, B. Deleting files and quick-formatting leaves data recoverable. A purge method such as a sanitize command or cryptographic erase makes recovery infeasible, and requiring certification provides verification and accountability that sanitization was actually performed. Emptying the recycle bin is still simple deletion. Reassigning owners and updating the CMDB do not remove data.
4. A. The asset owner is accountable for the asset and authorizes decisions such as downtime and risk acceptance. Without an assigned owner, nobody can approve the change. Tagging, license tracking, and degaussing do not establish decision authority.
5. C. For SSDs, cryptographic erase or the manufacturer's sanitize command (a purge method) is reliable and allows reuse. Degaussing has no effect on flash memory. Overwriting is unreliable on SSDs because of wear leveling and over-provisioning. Deleting partitions is not sanitization.
6. B. The service was obtained outside the formal procurement process, which should include security review, contract terms, and approved vendors. This is classic shadow IT. Monitoring might have detected it sooner, but the controls that were bypassed were procurement controls.
7. C. The owner is accountable for the asset, decides on access and classification, and accepts risk. The custodian implements protections day to day, users use the asset, and auditors evaluate controls independently.
8. B. Leaving DNS records pointing to retired cloud resources allows an attacker to claim those resources and take over the subdomain. Decommissioning must include removing DNS entries and other dependencies. Certificates of destruction relate to physical media, cloud customers cannot degauss provider disks, and license inventory is unrelated.
9. B. Once a product reaches end of support, the vendor stops releasing security patches, so newly discovered vulnerabilities remain unfixed. Considering support life during planning avoids acquiring legacy risk. The other options are unrelated to support status.
10. A. Reconciliation compares what discovery tools find with what the inventory says should exist, revealing unknown devices (possible rogue or shadow IT) and missing devices (possibly lost or improperly retired). The other options describe destruction, procurement, and classification.
11. C. When litigation is reasonably anticipated, a legal hold requires preserving relevant data and suspends normal deletion and disposal. Wiping or degaussing would destroy evidence and could expose the company to sanctions. Reassigning the laptop without wiping risks altering the evidence and exposing data to another employee.
12. A, B. Buying from authorized channels reduces the risk of counterfeit or tampered equipment, and verifying firmware signatures and serial numbers on receipt detects tampering. DMARC addresses email spoofing, block lists control software execution, and certificates of destruction relate to disposal.