Question

A company has recently discovered that its network has become slow and unreliable, with frequent outages and disruptions. An IT staff member suspects that rogue devices on the network could be causing these issues.

What are the BEST ways to identify rogue devices on a network? (Select three.)

answer

Install endpoint security software on all devices connected to the network to monitor and control device access.


Use intrusion detection systems (IDS) to monitor network traffic and identify devices that do not belong on the network.


Perform network scans and ping sweeps.


Perform packet sniffing and traffic flow analysis.


Implement 802.1x network access control.


Conduct network scans using tools like Nmap to identify active devices on the network.


Implement port security on network switches to limit the number of devices connected to the network.

Answer 1

Selected (best three):

- Use intrusion detection systems (IDS) to monitor network traffic and identify devices that do not belong on the network.
- Perform network scans and ping sweeps.
- Perform packet sniffing and traffic flow analysis.

Why: Network scans/ping sweeps (or tools like Nmap) discover active hosts, IDS monitors ongoing traffic for unusual or unauthorized hosts, and packet/flow analysis lets you see communications patterns and identify devices that shouldn’t be present. The other options are useful preventive controls (802.1X, port security) or rely on the device itself (endpoint agents), but they’re not as directly suited to discovering unknown/rogue devices.