Which of the following should be of MOST concern to an IS auditor reviewing an organization's ability to detect Internet of Things (IoT) devices?

The correct answer is B. There is no evidence that network discovery is conducted. The most significant concern is the lack of evidence that network discovery is conducted. Without network discovery, the organization cannot identify all connected devices, including IoT devices, which may lead to security risks. Regular network discovery is essential for…

Submitted by takeshi77· Apr 18, 2026Protection of Information Assets

Question

Which of the following should be of MOST concern to an IS auditor reviewing an organization’s ability to detect Internet of Things (IoT) devices?

Options

AThe network ports in conference rooms are enabled even when not in use
BThere is no evidence that network discovery is conducted
CThere is no documented procedure in place to address findings from network discovery
DA network access control (NAC) solution has not been implemented

How the community answered

(30 responses)

A
10% (3)
B
80% (24)
C
7% (2)
D
3% (1)

Explanation

The most significant concern is the lack of evidence that network discovery is conducted. Without network discovery, the organization cannot identify all connected devices, including IoT devices, which may lead to security risks. Regular network discovery is essential for detecting unauthorized or unmanaged IoT devices, ensuring they are properly secured and monitored.

Topics

#IoT security#Asset discovery#Network auditing#Security monitoring

Community Discussion

No community discussion yet for this question.

Full CISA Practice