In vulnerability management, which activity is core?

• A. Firewall rule optimization
• B. Asset discovery
• C. Penetration testing
• D. Compliance auditing

Answer: (B)

Asset discovery provides visibility into every device, service, and asset in your environment. Without a complete, up-to-date inventory, vulnerability scanning and remediation can’t be done comprehensively—you may miss systems, misjudge risk, or fail to verify that fixes actually applied. The process should be continuous, as new assets appear or configurations change, so they’re discovered and added to the workflow for scanning and prioritization. This visibility is what makes vulnerability management possible in the first place.

Firewall rule optimization helps reduce exposure but relies on knowing what exists and how it’s connected, so it can’t substitute for discovery. Penetration testing evaluates how defenses hold up by actively attempting to exploit weaknesses, which is valuable but not the ongoing process of identifying and managing vulnerabilities across the environment. Compliance auditing checks adherence to policies, yet it doesn’t by itself provide the actionable visibility and remediation focus that vulnerability management requires.