How is attack surface enumeration defined, and what are two example sources?

• A. The process of encrypting all assets to prevent exposure.
• B. The process of assessing incident impact by interviewing users.
• C. The process of identifying exposed assets, services, and configurations; examples include asset inventories and network discovery scans.
• D. The process of erasing logs to cover tracks.

Answer: (C)

Attack surface enumeration is the practice of cataloging all the elements that could be targeted by an attacker. It focuses on identifying every exposed asset, service, and misconfiguration so defenders know where the weaknesses lie and what to secure. Two common sources for this work are asset inventories, which provide a centralized list of assets, their owners, and configurations, and network discovery scans, which actively probe the environment to reveal live hosts, open ports, and running services that an attacker could reach.

Other options describe actions unrelated to mapping what could be attacked: encrypting assets to prevent exposure is a protective control, not enumeration; assessing incident impact by interviewing users is about understanding consequences after an event; erasing logs to cover tracks is an anti-forensic action and not about identifying the attack surface.