CompTIA CySA+ CS0-003 Practice Question

Network Access Control (NAC) systems are best suited for detecting rogue devices because they are specifically designed to control access to a network by enforcing policies that can allow or block devices based on compliance with security protocols. NAC can limit the data a rogue device can access and restrict its ability to move laterally across the network. Analyzing traffic patterns could potentially identify rogue devices but is less direct and efficient. While DHCP monitoring can detect new devices, it does not inherently determine legitimacy. Similarly, MAC address whitelisting is useful, but it is a preventative measure, not a detection method, and might not catch a rogue device impersonating a legitimate MAC address.