ACAS Questions With Solutions
Why is ACAS Important? --The only DISA approved Vulnerability Scanning tool
--USCYBERCOM Tasking Order 17- 0019 - Assured Compliance Assessment Solution (ACAS)
Operational Guidance
--Identifies a wide variety of vulnerabilities for your base
--Identifies computers, servers, printers, switches, routers and IP phones on your base
--Allows for a graphical view of your vulnerabilities for leadership
ACAS Components --ACAS components:
Tenable SecurityCenter
Nessus Scanners
--One SecurityCenter per MAJCOM and two Nessus Scanners per site
--Each Nessus Scanner can handle a Maximum of 2500 IPs
--Nessus scanners can be physical or virtual
What is an Organization? --Primary object within SecurityCenter used to group users and
assign resources and permissions
--Air Force Organizations are grouped by base location
, ACAS Questions With Solutions
Ex. Ramstein Organization, Langley Organization
Scan Zones --Defines the IP ranges associated with the scanner along with organizational
access
--SecurityCenter allows defined Organizations to be configured with two different scan zone
modes: "selectable" and "forced"
Network Address Declaration Form (NAD) --Form filled out by base comm squadrons
that lays out all IP addresses within their Communications Circuit System Designator (CCSD)
--Official document for appointment letters for VAT (Vulnerability Assessment Technician)
--NOT Classified Secret when filled out IAW DISA Circular 300-115-3 DISN SIPRNet Security
Classification Guide
--Submit via SIPR Remedy ticket assigned to the "AFNET EITSM > CSCS > Vulnerability
Assessment" queue
--Minimum once every six months
What is a Repository A database of vulnerability data defined by one or more ranges of IP
addresses or mobile data types.
, ACAS Questions With Solutions
SecurityCenter integrates repositories of vulnerability data that are shared as needed
among users and organizations based on manager-defined assets.
The NOS/COS have created each base each of the following repositories: >Credentialed
Scan Data
>Non-Credentialed Scan Data
>Compliance Scan Data
The blackout window in SecurityCenter >>specifies a timeframe where new scans are
prohibited from launching
>>Prevents remediation or ad-hoc scans from being performed during timeframes when they are
not desired, such as production hours
!! Warning - Current running scans are stopped at the beginning of the blackout window period
Blackout windows are set using the Organization account at the base by the servicing
NOS/COS.
ACAS Limitations >>ACAS CANNOT apply patches or alter configuration settings, only
reports scan findings
Why is ACAS Important? --The only DISA approved Vulnerability Scanning tool
--USCYBERCOM Tasking Order 17- 0019 - Assured Compliance Assessment Solution (ACAS)
Operational Guidance
--Identifies a wide variety of vulnerabilities for your base
--Identifies computers, servers, printers, switches, routers and IP phones on your base
--Allows for a graphical view of your vulnerabilities for leadership
ACAS Components --ACAS components:
Tenable SecurityCenter
Nessus Scanners
--One SecurityCenter per MAJCOM and two Nessus Scanners per site
--Each Nessus Scanner can handle a Maximum of 2500 IPs
--Nessus scanners can be physical or virtual
What is an Organization? --Primary object within SecurityCenter used to group users and
assign resources and permissions
--Air Force Organizations are grouped by base location
, ACAS Questions With Solutions
Ex. Ramstein Organization, Langley Organization
Scan Zones --Defines the IP ranges associated with the scanner along with organizational
access
--SecurityCenter allows defined Organizations to be configured with two different scan zone
modes: "selectable" and "forced"
Network Address Declaration Form (NAD) --Form filled out by base comm squadrons
that lays out all IP addresses within their Communications Circuit System Designator (CCSD)
--Official document for appointment letters for VAT (Vulnerability Assessment Technician)
--NOT Classified Secret when filled out IAW DISA Circular 300-115-3 DISN SIPRNet Security
Classification Guide
--Submit via SIPR Remedy ticket assigned to the "AFNET EITSM > CSCS > Vulnerability
Assessment" queue
--Minimum once every six months
What is a Repository A database of vulnerability data defined by one or more ranges of IP
addresses or mobile data types.
, ACAS Questions With Solutions
SecurityCenter integrates repositories of vulnerability data that are shared as needed
among users and organizations based on manager-defined assets.
The NOS/COS have created each base each of the following repositories: >Credentialed
Scan Data
>Non-Credentialed Scan Data
>Compliance Scan Data
The blackout window in SecurityCenter >>specifies a timeframe where new scans are
prohibited from launching
>>Prevents remediation or ad-hoc scans from being performed during timeframes when they are
not desired, such as production hours
!! Warning - Current running scans are stopped at the beginning of the blackout window period
Blackout windows are set using the Organization account at the base by the servicing
NOS/COS.
ACAS Limitations >>ACAS CANNOT apply patches or alter configuration settings, only
reports scan findings
