DOD C YB E R S E C U R I T Y C OMP L I A N C E
ACAS
BEST PRACTICE
KNOWLEDGE EXAM
One hundred fifty questions with complete
solutions covering ACAS architecture,
scanning requirements, STIG compliance,
Nessus agents, Tenable.sc analysis, and risk
acceptance.
2026/2027 Edition
Exams 1-6 | 7 Sections | Complete Solutions
AC A S C O M P L I A N C E E D U C AT I O N S E R I E S
,ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
ACAS BEST PRACTICE KNOWLEDGE EXAM 1,
2, 3, 4, 5 AND 6
QUESTIONS AND ANSWERS WITH COMPLETE SOLUTIONS 2026/2027
Aligned with DoD ACAS Best Practices Guides, ACAS Task Orders (TASKORDs), and
Cybersecurity Compliance Standards | 150 Questions | Complete Solutions Included
Contents
Section 1: ACAS Architecture & Core Components 2
Section 2: Vulnerability Management & Scanning Requirements 10
Section 3: Compliance Scanning & STIGs 18
Section 4: Nessus Agent Management & Deployment 26
Section 5: Tenable.sc Analysis, Dashboards & Reporting 33
Section 6: Vulnerabilities, Risk Acceptance & Remediation 39
Section 7: Comprehensive Case Studies & Scenario-Based Questions 44
DoD ACAS Compliance Education Series 1
,ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
Section 1: ACAS Architecture & Core Components
Questions 1-25 | 25 questions
Q1: A new cyber defender at a DoD installation is asked to identify what the acronym ACAS represents
within the Department of Defense vulnerability management enterprise. Which of the following correctly
defines ACAS?
A. Assured Compliance Assessment Solution [CORRECT]
B. Advanced Cyber Analysis System
C. Automated Compliance Auditing Software
D. Assured Cyber Attack Simulation
Correct Answer: A
Rationale: ACAS stands for Assured Compliance Assessment Solution, the DoD enterprise program built on
Tenable technology for continuous vulnerability and compliance assessment. The other options are fabricated
expansions that do not correspond to any DoD ACAS program element. This definition appears in the
introduction of the ACAS Best Practices Guide.
Q2: During an ACAS architecture briefing, the team lead asks which component serves as the central
console where scan results are aggregated, analyzed, and reported across the enterprise. Which component
fulfills this role?
A. Nessus Network Monitor
B. SecurityCenter (Tenable.sc) [CORRECT]
C. Nessus Agents
D. The DISA STIG Library
Correct Answer: B
Rationale: SecurityCenter, now branded Tenable.sc, is the central management console of ACAS where
repositories, scan data, analysis tools, and reports converge. Nessus Network Monitor is a passive sensor, and
Agents are lightweight endpoint scanners that feed data upward rather than acting as the console. Per the ACAS
Best Practices Guide, Tenable.sc provides centralized management for the entire deployment.
Q3: A vulnerability analyst needs to actively probe hosts across a subnet, performing authenticated
checks for missing patches and misconfigurations. Which ACAS component performs this active
vulnerability and compliance scanning?
A. Nessus Network Monitor
B. Tenable.sc dashboards
C. Nessus [CORRECT]
D. The cumulative repository
Correct Answer: C
Rationale: Nessus is the active vulnerability scanner in ACAS; it probes hosts directly, performs active
vulnerability checks, and, when credentials are supplied, performs compliance (STIG) checks. Nessus Network
Monitor only sniffs traffic passively, and repositories merely store results. The ACAS Best Practices Guide
defines Nessus as the active scanning engine of the solution.
DoD ACAS Compliance Education Series 2
, ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
Q4: An organization requires detection of vulnerabilities based purely on observation of network traffic,
without sending probes to the targets. Which ACAS capability detects vulnerabilities by sniffing network
traffic?
A. PVS (Passive Vulnerability Scanner) [CORRECT]
B. Nessus active scanner
C. Credentialed discovery scan
D. Tenable.sc Feed
Correct Answer: A
Rationale: PVS, the Passive Vulnerability Scanner (now fielded as Nessus Network Monitor), detects
vulnerabilities by passively sniffing network traffic and analyzing protocols. Active scanners probe hosts
directly, which contradicts the passive requirement in the scenario. The ACAS Best Practices Guide describes
PVS as the passive monitoring component of ACAS.
Q5: A site wants network-based monitoring that does not generate any scan traffic against its production
servers. The security team proposes deploying a sensor that characterizes hosts and services purely from
protocol analysis of observed traffic. Which deployment matches this intent?
A. Adding Nessus Agents to every server
B. Deploying Nessus Network Monitor (NNM) for passive monitoring
C. Running more frequent credentialed Nessus scans
D. Enabling the Tenable.sc Feed [CORRECT]
Correct Answer: D
Rationale: Nessus Network Monitor (NNM), the current form of PVS, provides passive monitoring based on
protocol analysis of observed traffic without probing hosts. Agents perform local checks on endpoints rather
than network observation, and credentialed Nessus scans are by definition active. The ACAS Best Practices
Guide positions NNM as the passive sensor for continuous network watching.
Q6: During an ACAS training session, an instructor asks which action a Nessus scanner performs when
conducting an active vulnerability scan. Which statement is correct?
A. It silently watches switch mirror ports for indicators of compromise
B. It probes hosts and performs active vulnerability and compliance checks [CORRECT]
C. It only queries the Tenable.sc Feed for new audit content
D. It reconfigures router ACLs to isolate vulnerable hosts
Correct Answer: B
Rationale: Nessus actively probes hosts with plugin-based checks and, with credentials, evaluates compliance
configurations such as STIG requirements. Passive observation is the role of NNM/PVS, and the Tenable.sc
Feed distributes content rather than performing scans. The ACAS Best Practices Guide defines active scanning
as the core Nessus function within ACAS.
DoD ACAS Compliance Education Series 3
ACAS
BEST PRACTICE
KNOWLEDGE EXAM
One hundred fifty questions with complete
solutions covering ACAS architecture,
scanning requirements, STIG compliance,
Nessus agents, Tenable.sc analysis, and risk
acceptance.
2026/2027 Edition
Exams 1-6 | 7 Sections | Complete Solutions
AC A S C O M P L I A N C E E D U C AT I O N S E R I E S
,ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
ACAS BEST PRACTICE KNOWLEDGE EXAM 1,
2, 3, 4, 5 AND 6
QUESTIONS AND ANSWERS WITH COMPLETE SOLUTIONS 2026/2027
Aligned with DoD ACAS Best Practices Guides, ACAS Task Orders (TASKORDs), and
Cybersecurity Compliance Standards | 150 Questions | Complete Solutions Included
Contents
Section 1: ACAS Architecture & Core Components 2
Section 2: Vulnerability Management & Scanning Requirements 10
Section 3: Compliance Scanning & STIGs 18
Section 4: Nessus Agent Management & Deployment 26
Section 5: Tenable.sc Analysis, Dashboards & Reporting 33
Section 6: Vulnerabilities, Risk Acceptance & Remediation 39
Section 7: Comprehensive Case Studies & Scenario-Based Questions 44
DoD ACAS Compliance Education Series 1
,ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
Section 1: ACAS Architecture & Core Components
Questions 1-25 | 25 questions
Q1: A new cyber defender at a DoD installation is asked to identify what the acronym ACAS represents
within the Department of Defense vulnerability management enterprise. Which of the following correctly
defines ACAS?
A. Assured Compliance Assessment Solution [CORRECT]
B. Advanced Cyber Analysis System
C. Automated Compliance Auditing Software
D. Assured Cyber Attack Simulation
Correct Answer: A
Rationale: ACAS stands for Assured Compliance Assessment Solution, the DoD enterprise program built on
Tenable technology for continuous vulnerability and compliance assessment. The other options are fabricated
expansions that do not correspond to any DoD ACAS program element. This definition appears in the
introduction of the ACAS Best Practices Guide.
Q2: During an ACAS architecture briefing, the team lead asks which component serves as the central
console where scan results are aggregated, analyzed, and reported across the enterprise. Which component
fulfills this role?
A. Nessus Network Monitor
B. SecurityCenter (Tenable.sc) [CORRECT]
C. Nessus Agents
D. The DISA STIG Library
Correct Answer: B
Rationale: SecurityCenter, now branded Tenable.sc, is the central management console of ACAS where
repositories, scan data, analysis tools, and reports converge. Nessus Network Monitor is a passive sensor, and
Agents are lightweight endpoint scanners that feed data upward rather than acting as the console. Per the ACAS
Best Practices Guide, Tenable.sc provides centralized management for the entire deployment.
Q3: A vulnerability analyst needs to actively probe hosts across a subnet, performing authenticated
checks for missing patches and misconfigurations. Which ACAS component performs this active
vulnerability and compliance scanning?
A. Nessus Network Monitor
B. Tenable.sc dashboards
C. Nessus [CORRECT]
D. The cumulative repository
Correct Answer: C
Rationale: Nessus is the active vulnerability scanner in ACAS; it probes hosts directly, performs active
vulnerability checks, and, when credentials are supplied, performs compliance (STIG) checks. Nessus Network
Monitor only sniffs traffic passively, and repositories merely store results. The ACAS Best Practices Guide
defines Nessus as the active scanning engine of the solution.
DoD ACAS Compliance Education Series 2
, ACAS Best Practice Knowledge Exam 1-6 | Questions & Answers with Complete Solutions 2026/2027
Q4: An organization requires detection of vulnerabilities based purely on observation of network traffic,
without sending probes to the targets. Which ACAS capability detects vulnerabilities by sniffing network
traffic?
A. PVS (Passive Vulnerability Scanner) [CORRECT]
B. Nessus active scanner
C. Credentialed discovery scan
D. Tenable.sc Feed
Correct Answer: A
Rationale: PVS, the Passive Vulnerability Scanner (now fielded as Nessus Network Monitor), detects
vulnerabilities by passively sniffing network traffic and analyzing protocols. Active scanners probe hosts
directly, which contradicts the passive requirement in the scenario. The ACAS Best Practices Guide describes
PVS as the passive monitoring component of ACAS.
Q5: A site wants network-based monitoring that does not generate any scan traffic against its production
servers. The security team proposes deploying a sensor that characterizes hosts and services purely from
protocol analysis of observed traffic. Which deployment matches this intent?
A. Adding Nessus Agents to every server
B. Deploying Nessus Network Monitor (NNM) for passive monitoring
C. Running more frequent credentialed Nessus scans
D. Enabling the Tenable.sc Feed [CORRECT]
Correct Answer: D
Rationale: Nessus Network Monitor (NNM), the current form of PVS, provides passive monitoring based on
protocol analysis of observed traffic without probing hosts. Agents perform local checks on endpoints rather
than network observation, and credentialed Nessus scans are by definition active. The ACAS Best Practices
Guide positions NNM as the passive sensor for continuous network watching.
Q6: During an ACAS training session, an instructor asks which action a Nessus scanner performs when
conducting an active vulnerability scan. Which statement is correct?
A. It silently watches switch mirror ports for indicators of compromise
B. It probes hosts and performs active vulnerability and compliance checks [CORRECT]
C. It only queries the Tenable.sc Feed for new audit content
D. It reconfigures router ACLs to isolate vulnerable hosts
Correct Answer: B
Rationale: Nessus actively probes hosts with plugin-based checks and, with credentials, evaluates compliance
configurations such as STIG requirements. Passive observation is the role of NNM/PVS, and the Tenable.sc
Feed distributes content rather than performing scans. The ACAS Best Practices Guide defines active scanning
as the core Nessus function within ACAS.
DoD ACAS Compliance Education Series 3
