What is a rogue device and which approach helps detect it on a network?

• A. Maintain an up-to-date network inventory and enforce network access control.
• B. Rely on antivirus scans of servers only.
• C. Disable monitoring to reduce noise.
• D. Ignore anomalous ARP activity.

Answer: (A)

A rogue device is an unauthorized device connected to the network, such as an unapproved laptop, access point, or switch. The best way to detect them is to have a current, accurate view of what should be on the network and to enforce who can connect. Maintaining an up-to-date network inventory establishes a baseline of approved devices, so you can spot anything unfamiliar. Network access control then gates access based on authentication and policy, so only trusted devices can connect and noncompliant or unknown devices can be blocked or quarantined. Together, knowing what should be on the network and actively enforcing access provides visibility and control that makes rogue devices detectable and actionable.

Relying on antivirus scans of servers only won’t reveal rogue devices that are not servers or that exist at the network layer. Disabling monitoring removes the very visibility needed to notice unauthorized hardware or suspicious activity. Ignoring anomalous ARP activity misses typical indicators of ARP spoofing or other network-layer threats that could signal a rogue device.