TENABLE VULNERABILITY MANAGEMENT PROFESSIONAL: THE
COMPLETE 200-QUESTION STUDY GUIDE WITH VERIFIED
SOLUTIONS AND RISK-BASED SCORING INSIGHTS
Q1. Which authentication protocol is primarily used for Windows
credentialed scans in Tenable.io?
A. SSH
B. SMB/WMI
C. SNMP
D. Kerberos only
Correct: B
Rationale: Tenable authenticates to Windows through SMB (TCP
445/139) and Windows Management Instrumentation (WMI) APIs,
enabling registry and patch enumeration. Kerberos may underlie
domain logins, but SMB/WMI is the operational channel. SSH is for
Unix/Linux, and SNMP offers limited inventory only.
Q2. Credentialed scans improve accuracy primarily because they —
A. Bypass network ACLs
B. Access host-level configuration and patch data
C. Use larger port ranges
D. Ignore authentication policies
Correct: B
Rationale: Logging in lets Nessus read local OS data—registry, packages,
services—which eliminates banner-guessing and false positives.
,Credentialed scanning provides deep local evidence rather than relying
on network reachability.
Q3. Which Tenable solution provides cloud-hosted vulnerability
management?
A. Tenable.sc
B. Tenable.io
C. Nessus Expert
D. Tenable.ot
Correct: B
Rationale: Tenable.io is the SaaS VM platform; Tenable.sc is on-prem;
Nessus Expert is a single-user scanner; Tenable.ot focuses on industrial
networks.
Q4. A /16 scan completes unusually fast with few detections. What is
the most probable cause?
A. Plugin feed corruption
B. Firewall/ACL blocking probe traffic
C. Low CVSS thresholds
D. Outdated credentials
Correct: B
Rationale: When probes are filtered, scans terminate early and look
clean. Always verify reachability before suspecting plugins or
credentials.
Q5. The Safe Checks option in Tenable tools —
A. Reduces accuracy by skipping all plugins
B. Prevents dangerous, potentially disruptive tests
C. Forces credential use
D. Is required for web scans
,Correct: B
Rationale: Safe Checks avoids exploits or destructive payloads but still
identifies vulnerabilities through version matching. It protects fragile
systems.
Q6. To discover live assets efficiently on a /20 network with ICMP
blocked, choose —
A. ICMP echo only
B. TCP SYN probes on common ports (80, 443, 22)
C. ARP sweep on all subnets
D. SNMP walk
Correct: B
Rationale: TCP SYN to allowed ports reveals responsive hosts even when
ICMP is dropped. ARP works only locally.
Q7. Which feature dynamically adjusts severity based on threat
intelligence?
A. CVSS Base Score
B. Vulnerability Priority Rating (VPR)
C. Asset Criticality Rating (ACR)
D. Temporal Score
Correct: B
Rationale: VPR factors exploit trends, weaponization, and threat age;
CVSS is static; ACR measures business impact.
Q8. Combining VPR and ACR allows analysts to —
A. See plugin history only
B. Prioritize remediation where threat and business risk intersect
C. Ignore low-VPR vulns
D. Disable scoring
, Correct: B
Rationale: High-VPR × High-ACR = true enterprise risk. That matrix
drives remediation focus.
Q9. Which ports must be open for Linux credentialed scans?
A. 139/445
B. 22 (SSH)
C. 3389
D. 161/162
Correct: B
Rationale: SSH 22/tcp is required. SMB 139/445 is Windows; RDP 3389
and SNMP 161 are unrelated.
Q10. What is the primary purpose of host discovery in a vulnerability
management process?
A. To patch operating systems
B. To identify active devices on a network
C. To encrypt network traffic
D. To monitor user activities
Correct: B
Rationale: Host discovery identifies which devices are active on a
network. You cannot protect what you don't know exists.
Q11. Which of the following best defines vulnerability management?
A. A process that only identifies vulnerabilities
B. A reactive measure after a breach
C. A comprehensive process of identifying, assessing, prioritizing, and
mitigating vulnerabilities
D. A tool that automatically fixes all security issues
COMPLETE 200-QUESTION STUDY GUIDE WITH VERIFIED
SOLUTIONS AND RISK-BASED SCORING INSIGHTS
Q1. Which authentication protocol is primarily used for Windows
credentialed scans in Tenable.io?
A. SSH
B. SMB/WMI
C. SNMP
D. Kerberos only
Correct: B
Rationale: Tenable authenticates to Windows through SMB (TCP
445/139) and Windows Management Instrumentation (WMI) APIs,
enabling registry and patch enumeration. Kerberos may underlie
domain logins, but SMB/WMI is the operational channel. SSH is for
Unix/Linux, and SNMP offers limited inventory only.
Q2. Credentialed scans improve accuracy primarily because they —
A. Bypass network ACLs
B. Access host-level configuration and patch data
C. Use larger port ranges
D. Ignore authentication policies
Correct: B
Rationale: Logging in lets Nessus read local OS data—registry, packages,
services—which eliminates banner-guessing and false positives.
,Credentialed scanning provides deep local evidence rather than relying
on network reachability.
Q3. Which Tenable solution provides cloud-hosted vulnerability
management?
A. Tenable.sc
B. Tenable.io
C. Nessus Expert
D. Tenable.ot
Correct: B
Rationale: Tenable.io is the SaaS VM platform; Tenable.sc is on-prem;
Nessus Expert is a single-user scanner; Tenable.ot focuses on industrial
networks.
Q4. A /16 scan completes unusually fast with few detections. What is
the most probable cause?
A. Plugin feed corruption
B. Firewall/ACL blocking probe traffic
C. Low CVSS thresholds
D. Outdated credentials
Correct: B
Rationale: When probes are filtered, scans terminate early and look
clean. Always verify reachability before suspecting plugins or
credentials.
Q5. The Safe Checks option in Tenable tools —
A. Reduces accuracy by skipping all plugins
B. Prevents dangerous, potentially disruptive tests
C. Forces credential use
D. Is required for web scans
,Correct: B
Rationale: Safe Checks avoids exploits or destructive payloads but still
identifies vulnerabilities through version matching. It protects fragile
systems.
Q6. To discover live assets efficiently on a /20 network with ICMP
blocked, choose —
A. ICMP echo only
B. TCP SYN probes on common ports (80, 443, 22)
C. ARP sweep on all subnets
D. SNMP walk
Correct: B
Rationale: TCP SYN to allowed ports reveals responsive hosts even when
ICMP is dropped. ARP works only locally.
Q7. Which feature dynamically adjusts severity based on threat
intelligence?
A. CVSS Base Score
B. Vulnerability Priority Rating (VPR)
C. Asset Criticality Rating (ACR)
D. Temporal Score
Correct: B
Rationale: VPR factors exploit trends, weaponization, and threat age;
CVSS is static; ACR measures business impact.
Q8. Combining VPR and ACR allows analysts to —
A. See plugin history only
B. Prioritize remediation where threat and business risk intersect
C. Ignore low-VPR vulns
D. Disable scoring
, Correct: B
Rationale: High-VPR × High-ACR = true enterprise risk. That matrix
drives remediation focus.
Q9. Which ports must be open for Linux credentialed scans?
A. 139/445
B. 22 (SSH)
C. 3389
D. 161/162
Correct: B
Rationale: SSH 22/tcp is required. SMB 139/445 is Windows; RDP 3389
and SNMP 161 are unrelated.
Q10. What is the primary purpose of host discovery in a vulnerability
management process?
A. To patch operating systems
B. To identify active devices on a network
C. To encrypt network traffic
D. To monitor user activities
Correct: B
Rationale: Host discovery identifies which devices are active on a
network. You cannot protect what you don't know exists.
Q11. Which of the following best defines vulnerability management?
A. A process that only identifies vulnerabilities
B. A reactive measure after a breach
C. A comprehensive process of identifying, assessing, prioritizing, and
mitigating vulnerabilities
D. A tool that automatically fixes all security issues
