Zscaler External Attack Surface Management (EASM) is designed to discover and inventory all of an organization's internet-facing assets to identify potential security risks and exposures. A service hostname that contains revealing information (e.g., dev-db-backup.company.com) is a prime example of a digital entity that EASM would flag. Such a hostname exposes internal naming conventions, infrastructure roles, or development stages, providing valuable reconnaissance information to potential attackers. EASM identifies these assets and the associated risks they present.

B. Client-side certificates for SSL inspection are internal security components, not part of the external, publicly discoverable attack surface.

C. A Zscaler App Connector is an internal infrastructure component used for ZPA and is not intended to be an internet-facing asset.

D. Lists of compromised credentials are a form of threat intelligence, not a digital asset or entity belonging to an organization's attack surface.

1. Zscaler, "Attack Surface Management Datasheet." The document states that the solution discovers "all your internet-facing assets" and identifies "high-risk exposures," including "sensitive information in hostnames."

2. Zscaler, "What Is External Attack Surface Management (EASM)?" This resource explains that EASM tools discover assets like "exposed web servers, forgotten databases," and identify "misconfigurations," which would include poorly chosen, revealing hostnames.