Exam CISSP topic 1 question 81 discussion

Selected D. The detection mechanism has already found out that a device has been infected which means it is too late for a vulnerability scanner. The tool that had detected the malware infection, would have given the hostname/IP address of that device. The question asks about the most effective way to "locate", if we plug in the hostname / IP address in the ITAM system, that would give the actual location (Geographical) location of that device and who to contact in case some boots on the ground is needed. Therefore ITAM is the right answer.

In order to locate the asset we need a tool like ITAM

Except if the ip address was flagged then ITAM can be used to find and remediate

Let me tell yiu o'u a scenario that happened in my laptop. My laptop was infected by malware, I quickly use anti.virus to scan my system just to know the part infected. Immediately I was able to see it and remediate it. So IDS is correct. Snort is also an example of IDS

What a terrible question. Asset System? No, you don't.

ChatGPT and Copilot give two different answers, as I feel it is a B, Copilot states it is D, and ChatGPT states B

IDS is correct because we don't know which exact host is infected to find it via ITAM, also ITAM is not mentioned in the OSG.

Option D: Information Technology Asset Management (ITAM) can also play a role in enabling the infected device to be quickly located and remediated. ITAM involves tracking and managing the inventory of IT assets within an organization, including devices such as computers, servers, and network devices. By maintaining an up-to-date record of all devices, their locations, and configurations, ITAM can help identify the specific device that is infected with malware. Once the infected device is identified through ITAM, appropriate remediation actions can be taken, such as isolating the device, conducting a thorough scan for malware, applying patches or updates, or even physically removing and replacing the device if necessary. Therefore, both option B (Intrusion detection) and option D (ITAM) can be effective in quickly locating and remedying an infected device. The choice between them may depend on the specific capabilities and implementation of the organization's security infrastructure.

I do not understand why it is D. I do not hear any IT inventory system can detect the malware and fix it. Although it can easy to detect location of the device, how can it detect which device has the malware. It sounds does not make sense. I would choose C as the IDS can detect the attack of malware and display the source IP of the attack.

Answer is D. The rest don't make sense.

C is the answer