TENABLE VULNERABILITY MANAGEMENT PROFESSIONAL
EXAM ACCURATE REAL EXAM QUESTIONS WITH
VERIFIED ANSWERS AND RATIONALES WITH A STUDY
GUIDE | LATEST UPDATE
Q1.
Which authentication protocol is primarily used for Windows credentialed scans in Tenable .io?
A. SSH
B. SMB/WMI
C. SNMP
D. Kerberos only
Correct: B
Rationale: Tenable authenticates to Windows through SMB (TCP 445/139) and Windows
Management Instrumentation (WMI) APIs, enabling registry and patch enumeration. Kerberos
may underlie domain logins, but SMB/WMI is the operational channel. SSH is for Unix/Linux,
and SNMP offers limited inventory only.
Exam tip: Always associate SMB/WMI → Windows; SSH → Linux.
Q2.
Credentialed scans improve accuracy primarily because they —
A. Bypass network ACLs
B. Access host-level configuration and patch data
C. Use larger port ranges
D. Ignore authentication policies
,Correct: B
Rationale: Logging in lets Nessus read local OS data—registry, packages, services—which
eliminates banner-guessing and false positives. Other options confuse network reachability with
vulnerability enumeration.
Exam tip: Credentialed = deep local evidence.
Q3.
Which Tenable solution provides cloud-hosted vulnerability management?
A. Tenable.sc
B. Tenable.io
C. Nessus Expert
D. Tenable.ot
Correct: B
Rationale: Tenable.io is the SaaS VM platform; Tenable.sc is on-prem; Nessus Expert is a
single-user scanner; Tenable.ot focuses on industrial networks.
Q4.
A /16 scan completes unusually fast with few detections. What’s the most probable cause?
A. Plugin feed corruption
B. Firewall/ACL blocking probe traffic
C. Low CVSS thresholds
D. Outdated credentials
Correct: B
Rationale: When probes are filtered, scans terminate early and look “clean.” Always verify
reachability before suspecting plugins or credentials.
,Q5.
The Safe Checks option in Tenable tools —
A. Reduces accuracy by skipping all plugins
B. Prevents dangerous, potentially disruptive tests
C. Forces credential use
D. Is required for web scans
Correct: B
Rationale: Safe Checks avoids exploits or destructive payloads but still identifies vulnerabilities
through version matching. It protects fragile systems.
Q6.
To discover live assets efficiently on a /20 network with ICMP blocked, choose —
A. ICMP echo only
B. TCP SYN probes on common ports (80, 443, 22)
C. ARP sweep on all subnets
D. SNMP walk
Correct: B
Rationale: TCP SYN to allowed ports reveals responsive hosts even when ICMP is dropped.
ARP works only locally.
Q7.
Which feature dynamically adjusts severity based on threat intelligence?
A. CVSS Base Score
B. Vulnerability Priority Rating (VPR)
C. Asset Criticality Rating (ACR)
D. Temporal Score
, Correct: B
Rationale: VPR factors exploit trends, weaponization, and threat age; CVSS is static; ACR
measures business impact.
Q8.
Combining VPR and ACR allows analysts to —
A. See plugin history only
B. Prioritize remediation where threat + business risk intersect
C. Ignore low-VPR vulns
D. Disable scoring
Correct: B
Rationale: High-VPR × High-ACR = true enterprise risk. That matrix drives remediation focus.
Q9.
Which ports must be open for Linux credentialed scans?
A. 139/445
B. 22 (SSH)
C. 3389
D. 161/162
Correct: B
Rationale: SSH 22/tcp is required. SMB 139/445 is Windows; RDP 3389 and SNMP 161 are
unrelated.
Q10.
EXAM ACCURATE REAL EXAM QUESTIONS WITH
VERIFIED ANSWERS AND RATIONALES WITH A STUDY
GUIDE | LATEST UPDATE
Q1.
Which authentication protocol is primarily used for Windows credentialed scans in Tenable .io?
A. SSH
B. SMB/WMI
C. SNMP
D. Kerberos only
Correct: B
Rationale: Tenable authenticates to Windows through SMB (TCP 445/139) and Windows
Management Instrumentation (WMI) APIs, enabling registry and patch enumeration. Kerberos
may underlie domain logins, but SMB/WMI is the operational channel. SSH is for Unix/Linux,
and SNMP offers limited inventory only.
Exam tip: Always associate SMB/WMI → Windows; SSH → Linux.
Q2.
Credentialed scans improve accuracy primarily because they —
A. Bypass network ACLs
B. Access host-level configuration and patch data
C. Use larger port ranges
D. Ignore authentication policies
,Correct: B
Rationale: Logging in lets Nessus read local OS data—registry, packages, services—which
eliminates banner-guessing and false positives. Other options confuse network reachability with
vulnerability enumeration.
Exam tip: Credentialed = deep local evidence.
Q3.
Which Tenable solution provides cloud-hosted vulnerability management?
A. Tenable.sc
B. Tenable.io
C. Nessus Expert
D. Tenable.ot
Correct: B
Rationale: Tenable.io is the SaaS VM platform; Tenable.sc is on-prem; Nessus Expert is a
single-user scanner; Tenable.ot focuses on industrial networks.
Q4.
A /16 scan completes unusually fast with few detections. What’s the most probable cause?
A. Plugin feed corruption
B. Firewall/ACL blocking probe traffic
C. Low CVSS thresholds
D. Outdated credentials
Correct: B
Rationale: When probes are filtered, scans terminate early and look “clean.” Always verify
reachability before suspecting plugins or credentials.
,Q5.
The Safe Checks option in Tenable tools —
A. Reduces accuracy by skipping all plugins
B. Prevents dangerous, potentially disruptive tests
C. Forces credential use
D. Is required for web scans
Correct: B
Rationale: Safe Checks avoids exploits or destructive payloads but still identifies vulnerabilities
through version matching. It protects fragile systems.
Q6.
To discover live assets efficiently on a /20 network with ICMP blocked, choose —
A. ICMP echo only
B. TCP SYN probes on common ports (80, 443, 22)
C. ARP sweep on all subnets
D. SNMP walk
Correct: B
Rationale: TCP SYN to allowed ports reveals responsive hosts even when ICMP is dropped.
ARP works only locally.
Q7.
Which feature dynamically adjusts severity based on threat intelligence?
A. CVSS Base Score
B. Vulnerability Priority Rating (VPR)
C. Asset Criticality Rating (ACR)
D. Temporal Score
, Correct: B
Rationale: VPR factors exploit trends, weaponization, and threat age; CVSS is static; ACR
measures business impact.
Q8.
Combining VPR and ACR allows analysts to —
A. See plugin history only
B. Prioritize remediation where threat + business risk intersect
C. Ignore low-VPR vulns
D. Disable scoring
Correct: B
Rationale: High-VPR × High-ACR = true enterprise risk. That matrix drives remediation focus.
Q9.
Which ports must be open for Linux credentialed scans?
A. 139/445
B. 22 (SSH)
C. 3389
D. 161/162
Correct: B
Rationale: SSH 22/tcp is required. SMB 139/445 is Windows; RDP 3389 and SNMP 161 are
unrelated.
Q10.
