I85PREP
⌘ K
Tenable SC study materials
Tenable SC study resources

Tenable SC practice questions

One question at a time. Build your Tenable SC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment, Architecture, and Initial Configuration

Which component in a Tenable SC deployment performs active vulnerability scanning of network hosts?

  1. It analyzes mirrored traffic to identify hosts and services
  2. It provides the web interface and stores scan results
  3. It stores log events and correlates them with vulnerability data
  4. It sends packets to targets and evaluates responses against plugins Correct answer.

Explanation

Nessus scanners are the active scanning engines: they generate probe traffic toward targets and match the responses against the installed plugin set. SecurityCenter coordinates scans and stores results but does not perform the probing itself.

Question 2Deployment, Architecture, and Initial Configuration

Which statement describes the role of the Passive Vulnerability Scanner (PVS) in a Tenable SC architecture?

  1. It collects and normalizes log events from devices
  2. It provides centralized reporting and scheduling
  3. It sends probe packets to enumerate open ports
  4. It identifies hosts and services from a copy of traffic Correct answer.

Explanation

The PVS observes a copy of network traffic, such as a SPAN or mirror port feed, and derives hosts, services, and vulnerabilities without transmitting packets to the monitored segment. This makes it suitable for sensitive segments where active scanning is undesirable.

Question 3Deployment, Architecture, and Initial Configuration

What does a scan zone define in Tenable SC?

  1. the credentials used for a scan
  2. the retention period for stored results
  3. the scanners usable for a target range Correct answer.
  4. the plugin families enabled in a policy

Explanation

A scan zone groups one or more scanners and is selected when a scan is configured, so the scan is dispatched to scanners that can reach the targets. Targets should be placed in a zone whose scanners have network access to them.

Question 4Deployment, Architecture, and Initial Configuration

Which object stores the vulnerability results produced by scans in Tenable SC?

  1. scan zone
  2. repository Correct answer.
  3. scan policy
  4. asset list

Explanation

Scan results are written to a repository, which holds the accumulated vulnerability data for an organization and supports reporting and trend analysis. Each scan must be associated with a repository when it is configured.

Question 5Deployment, Architecture, and Initial Configuration

What is the primary purpose of an organization in Tenable SC?

  1. to isolate users, assets, and scan data Correct answer.
  2. to schedule plugin feed updates
  3. to license additional scanners
  4. to group scanners by network location

Explanation

Organizations provide logical separation so that different business units or customers can have their own users, assets, policies, and repositories without seeing each other's data. Scan zones handle scanner grouping and are configured within an organization.

Question 6Deployment, Architecture, and Initial Configuration

Which value must be obtained from SecurityCenter and supplied when installing a Nessus Agent so that the agent associates with the correct instance?

  1. plugin set
  2. scan zone
  3. agent linking key Correct answer.
  4. scan policy

Explanation

The agent linking key is generated in SecurityCenter and passed to the agent installer, which allows the agent to register with that server and appear as a managed agent. Without a valid key the agent cannot complete registration.

Question 7Deployment, Architecture, and Initial Configuration

Tenable SC licensing is primarily measured by which quantity?

  1. the number of user accounts
  2. the number of deployed scanners
  3. the number of repositories
  4. the number of managed IP addresses Correct answer.

Explanation

Licensing is based on the count of unique IP addresses or assets under management, which determines how much address space may be scanned and tracked. Scanner count, users, and repositories do not drive the license entitlement.

Question 8Deployment, Architecture, and Initial Configuration

Which account is created by default during the initial installation of SecurityCenter and is used for the first login?

  1. root
  2. admin Correct answer.
  3. scanner
  4. nessus

Explanation

The initial installation creates an administrative account named admin, which is used to log in and complete first-time configuration such as licensing, organizations, and users. Best practice is to change its password and create named accounts for daily use.

Question 9Deployment, Architecture, and Initial Configuration

An administrator wants newly created scan policies to include the latest plugin families. What should be confirmed first?

  1. Confirm the plugin feed is current Correct answer.
  2. Disable automatic plugin updates
  3. Add a passive scanner to the scan zone
  4. Create a second repository for new plugins

Explanation

Policies can only reference plugin families and checks that exist in the plugin feed installed on the deployment, so the feed must be updated before policy content is selected. Updating the feed first ensures the newest checks are available for use.

Question 10Deployment, Architecture, and Initial Configuration

A remote site has no route to the SecurityCenter server's network. Which deployment choice allows that site to be scanned by SecurityCenter?

  1. Add the site's IP addresses to an offline repository and import results
  2. Place a scanner at the site and add it to a scan zone Correct answer.
  3. Point the scan at the Log Correlation Engine instead
  4. Enable agentless scanning on the SecurityCenter server

Explanation

In a distributed deployment, scanners are placed close to the targets and must be reachable from SecurityCenter. A scanner resident at the remote site can reach local targets and report results back to the management server.

Question 11Deployment, Architecture, and Initial Configuration

What is an offline repository used for?

  1. scanning targets that have no network connection to the server
  2. importing results produced outside the managed scanner fleet Correct answer.
  3. caching plugins for scanners with limited connectivity
  4. storing results while the SecurityCenter server is stopped

Explanation

A repository of type offline is designed to receive imported scan result files rather than results generated by scans launched from SecurityCenter. It is useful for incorporating data from scanners that are not centrally managed.

Question 12Deployment, Architecture, and Initial Configuration

Which credential category should be configured to perform a credentialed patch audit of Windows servers?

  1. SNMP
  2. VMware
  3. Windows Correct answer.
  4. SSH

Explanation

Windows hosts are audited locally over SMB using Windows credentials that have sufficient privileges to query the registry and file system. SSH credentials apply to Unix-like systems, while SNMP and VMware credentials serve other purposes.

Question 13Deployment, Architecture, and Initial Configuration

How does a Nessus Agent differ from a remotely launched scan of the same host?

  1. It mirrors host traffic and forwards it to a passive scanner
  2. It performs checks locally and reports to SecurityCenter Correct answer.
  3. It stores scan results in a repository on the host
  4. It replaces SecurityCenter in large deployments

Explanation

An agent runs on the host, executes local checks, and sends results to SecurityCenter, so no inbound scanning traffic is required. This suits endpoints that are intermittently connected or protected by firewalls.

Question 14Deployment, Architecture, and Initial Configuration

How should time be configured across a Tenable SC deployment?

  1. Each scanner should follow its own local time zone
  2. Time settings do not matter because timestamps come from the repository
  3. Clocks should be set manually and left unchanged
  4. All components should sync to a common reliable time source Correct answer.

Explanation

Consistent time across SecurityCenter and its scanners is needed for accurate result correlation, scheduling, and reporting, so all components should use a reliable time source such as NTP. Drifting clocks can cause misordered events and confusing reports.

Question 15Deployment, Architecture, and Initial Configuration

Which statement best describes an active/passive cluster of SecurityCenter servers?

  1. A primary server with a standby that takes over on failure Correct answer.
  2. A SecurityCenter paired with a PVS for traffic analysis
  3. Two SecurityCenter servers that scan the same targets
  4. A scanner pool split between two data centers

Explanation

In an active/passive cluster, the primary node serves users and the standby node is kept ready to assume operations if the primary fails. This provides availability of the management layer rather than additional scanning capacity.

Question 16Deployment, Architecture, and Initial Configuration

Where are plugin family selection and scan behavior settings defined?

  1. asset list
  2. scan zone
  3. scan policy Correct answer.
  4. repository

Explanation

A scan policy holds the scan settings, including which plugin families are enabled and how the scan behaves, and it is reused across many scans. Targets and scanners are supplied by other objects such as asset lists and scan zones.

Question 17Deployment, Architecture, and Initial Configuration

An administrator must scan a defined set of servers that changes as new hosts are provisioned from exported inventory data. Which object best fits this need?

  1. a repository with a longer retention period
  2. an asset list refreshed from the exported file Correct answer.
  3. a scan zone that contains every scanner
  4. a user role with administrator rights

Explanation

Asset lists group target addresses so they can be reused by scans and reports, and they can be refreshed when the underlying inventory changes. Repositories, scan zones, and roles do not define which hosts are scanned.

Question 18Deployment, Architecture, and Initial Configuration

In a standalone Tenable SC deployment, which component runs on the same system as SecurityCenter?

  1. A PVS
  2. An LCE
  3. A Nessus Scanner Correct answer.
  4. Nessus Agents

Explanation

A standalone deployment combines the management server and a Nessus scanner on one system, which is typical for smaller environments. Larger environments separate these roles so scanning load does not compete with management functions.

Question 19Deployment, Architecture, and Initial Configuration

Which settings must be configured so that SecurityCenter can send email notifications about completed scans?

  1. SMTP server settings Correct answer.
  2. A repository of type offline
  3. A passive scan policy
  4. An agent linking key

Explanation

Email delivery depends on valid SMTP configuration so the server can relay messages to recipients. Repository type, agent keys, and scan policies do not affect outbound email.

Question 20Deployment, Architecture, and Initial Configuration

Which capability is required for SecurityCenter to authenticate users against an existing directory service?

  1. A configured directory integration Correct answer.
  2. An agent linking key
  3. A passive scan policy
  4. A repository of type offline

Explanation

Directory integration allows users to authenticate with their existing directory credentials while SecurityCenter maps them to the appropriate roles. It is configured once and then referenced when users are created.

Question 21Deployment, Architecture, and Initial Configuration

An administrator plans to install SecurityCenter on a host that already runs a busy database. What is the appropriate guidance?

  1. Co-hosting is fine if each application uses a different port
  2. Use a dedicated system; co-hosting is unsupported and affects performance Correct answer.
  3. Co-hosting is recommended because it reduces hardware costs
  4. Co-hosting is supported when the host has two network interfaces

Explanation

SecurityCenter is designed to run on a dedicated system, and sharing the host with other workloads is not supported. Resource contention from other applications can degrade scan scheduling, data processing, and reporting.

Question 22Deployment, Architecture, and Initial Configuration

A business unit must see only its own assets, scans, and results. What is the correct configuration?

  1. Give the users the Auditor role at the system level
  2. Create a separate repository for each individual user
  3. Assign the users to that organization with org roles Correct answer.
  4. Share the administrator account with the users

Explanation

Data separation is achieved by placing the assets, scans, and repositories inside an organization and giving the users roles scoped to that organization. Users outside the organization cannot see its data.

Question 23Deployment, Architecture, and Initial Configuration

An environment has no internet access. How are plugin updates applied to a distributed Tenable SC deployment?

  1. Plugin updates are not possible in an offline environment
  2. Only Nessus Agents can receive plugin updates
  3. Update the server offline, then distribute plugins to scanners Correct answer.
  4. Each scanner must download plugins directly from the vendor

Explanation

An offline update package can be applied to the SecurityCenter server, which then distributes the updated plugins to the scanners it manages. Individual scanners do not need direct internet access for this process.

Question 24Deployment, Architecture, and Initial Configuration

Which factors most directly influence the sizing of a SecurityCenter server?

  1. Managed IPs, concurrency, and retention all affect sizing Correct answer.
  2. Repository retention has no effect on sizing
  3. Only the number of user accounts matters
  4. Scanner count has no effect on sizing

Explanation

Server capacity must account for the number of managed addresses, how many scans run concurrently, and how long results are retained, since these drive processing and storage demand. Ignoring any of them risks degraded performance as the deployment grows.

Question 25Deployment, Architecture, and Initial Configuration

Which practice best supports recovery of a Tenable SC deployment after a server failure?

  1. Back up only the scanner appliances
  2. Reinstall from media if a failure occurs
  3. Rely on raw scan result files left on scanners
  4. Back up the server regularly and store copies off-box Correct answer.

Explanation

Configuration, organizational data, and accumulated results reside on the SecurityCenter server, so regular backups stored away from the appliance are needed to restore service. Scanners hold little persistent state and can be re-registered after recovery.

Question 26Deployment, Architecture, and Initial Configuration

By default, users and API clients reach the Tenable SC web interface over which protocol and port?

  1. HTTPS on TCP 443 Correct answer.
  2. HTTPS on TCP 8443
  3. HTTP on TCP 80
  4. HTTP on TCP 8080

Explanation

SecurityCenter serves its administrative interface over HTTPS on the standard secure web port, TCP 443. Plain HTTP is not used for the management interface, and shifting the service to an alternate port requires an explicit administrative change rather than being the default.

Question 27Deployment, Architecture, and Initial Configuration

After installing the SecurityCenter software, which item must be supplied to activate the product?

  1. A license file issued by Tenable Correct answer.
  2. A scanner registration token
  3. A plugin activation key generated in the web interface
  4. A certificate signed by a public certificate authority

Explanation

A new installation remains unlicensed until the Tenable-issued license file is uploaded and applied, which enables the product and defines its entitlements. Plugin activation and scanner registration are separate operations, and a public certificate affects browser trust rather than licensing.

Question 28Deployment, Architecture, and Initial Configuration

Which task is performed by the SecurityCenter server itself rather than by a managed scanner?

  1. Running plugin-based vulnerability checks against target hosts
  2. Enforcing agent-side compliance checks on managed endpoints
  3. Capturing passive traffic on a monitored network interface
  4. Storing results and distributing policy and plugin data Correct answer.

Explanation

SecurityCenter is the management and data tier: it holds configuration, stores scan results, and supplies scanners with the policy and plugin content they need. The actual vulnerability testing, traffic monitoring, and agent-side evaluation occur on other components.

Question 29Deployment, Architecture, and Initial Configuration

Which predefined role grants full control of SecurityCenter, including system configuration and user management?

  1. Security Manager
  2. Administrator Correct answer.
  3. Scan Operator
  4. Auditor

Explanation

The Administrator role is the highest predefined role and covers system-level configuration, user and role assignment, and all scanning and reporting functions. Other roles narrow the user to specific operational or read-only duties.

Question 30Deployment, Architecture, and Initial Configuration

Within Tenable SC, what is the primary purpose of a scan zone?

  1. To define the credential set used when scanning a subnet
  2. To schedule recurring scans against a repository
  3. To group assets into a single reporting view for a tenant
  4. To group scanners so that scans can be dispatched through a selected set of them Correct answer.

Explanation

A scan zone is a logical grouping of scanners; a scan is assigned to a zone and runs through the scanners in it. This lets administrators control which network path and which scanner resources a scan uses.

Question 31Deployment, Architecture, and Initial Configuration

How do Nessus scanners obtain updated plugins in a SecurityCenter deployment?

  1. Plugins are pushed from the results repository to scanners at the start of each scan
  2. Plugins are baked into the scanner installer and remain fixed for the life of the deployment
  3. Each scanner downloads plugins directly from Tenable over the internet
  4. SecurityCenter distributes the plugins it receives to its managed scanners Correct answer.

Explanation

SecurityCenter obtains the plugin feed and is the distribution point for the scanners it manages, so scanners do not each need their own internet access. This centralizes update control and allows a single feed source to serve the whole deployment.

Question 32Deployment, Architecture, and Initial Configuration

An automation script must call the SecurityCenter API without embedding any user's password. What should be created?

  1. An SSH key pair installed on the SecurityCenter server
  2. A shared service account with a password that never expires
  3. API keys generated for the user account Correct answer.
  4. A client certificate signed by the SecurityCenter server

Explanation

SecurityCenter supports per-user API keys, consisting of an access key and a secret key, which scripts present instead of credentials. This keeps the account password out of scripts and allows the keys to be revoked independently.

Question 33Deployment, Architecture, and Initial Configuration

Where is the idle session timeout for the SecurityCenter web interface configured?

  1. In each scan policy
  2. In the scanner configuration
  3. In the SecurityCenter system security settings Correct answer.
  4. In each user's browser settings

Explanation

Session behavior, including how long an idle session remains valid, is a system-level security setting applied by SecurityCenter to all web sessions. It is not a per-policy, per-scanner, or client-side setting.

Question 34Deployment, Architecture, and Initial Configuration

Which predefined role is intended for a user who needs to view dashboards and reports but must not perform scanning or administrative work?

  1. Credential Manager
  2. Scan Operator
  3. Executive Correct answer.
  4. Security Manager

Explanation

The Executive role provides read-only access to reporting and dashboard content, which fits users who consume results rather than produce them. Operational roles such as Scan Operator and Security Manager carry privileges to launch or manage scans.

Question 35Deployment, Architecture, and Initial Configuration

Which configuration determines when SecurityCenter automatically retrieves new plugins from Tenable?

  1. The update interval configured in each scanner's own interface
  2. The data expiration settings of the repository
  3. The plugin family selection in the scan policy
  4. The feed update schedule configured in SecurityCenter Correct answer.

Explanation

SecurityCenter retrieves the plugin feed on a schedule defined at the system level, which controls how current the deployment's content is. Scan policies merely select which of the available plugins are used during a scan.

Question 36Deployment, Architecture, and Initial Configuration

Which component should be deployed to observe network traffic on a segment and report vulnerabilities without generating scan traffic?

  1. An additional Nessus scanner added to a new scan zone
  2. A Passive Vulnerability Scanner Correct answer.
  3. An offline plugin repository refreshed from removable media
  4. A Nessus agent installed on every host in the segment

Explanation

A Passive Vulnerability Scanner analyzes observed traffic rather than sending probes, so it identifies exposed services and vulnerabilities without touching the hosts. Active scanners and agents work by initiating checks or running locally on the endpoint.

Question 37Deployment, Architecture, and Initial Configuration

The SecurityCenter software package is supported for installation on which operating system?

  1. Ubuntu Server LTS
  2. SUSE Linux Enterprise Server
  3. Red Hat Enterprise Linux Correct answer.
  4. Microsoft Windows Server

Explanation

The software distribution of SecurityCenter is built for and supported on Red Hat Enterprise Linux, with Tenable also offering a prebuilt appliance. Other Linux distributions and Windows are not supported hosts for the software installation.

Question 38Deployment, Architecture, and Initial Configuration

Two scanners are assigned to the same scan zone. How does SecurityCenter use them?

  1. It uses the first scanner and holds the second as a cold standby
  2. It requires every scan in the zone to name the specific scanner to use
  3. It splits each individual target host between the two scanners
  4. It balances the scan workload across the scanners in the zone Correct answer.

Explanation

Scanners assigned to the same zone form a pool that SecurityCenter distributes work across, spreading load and providing redundancy if one scanner is unavailable. Individual hosts are not divided between scanners, and scans select the zone rather than a specific scanner.

Question 39Deployment, Architecture, and Initial Configuration

Why should the default web server certificate be replaced after the initial installation?

  1. Because the license file is bound to the certificate's common name
  2. So browsers and API clients can validate the server's identity without bypassing trust warnings Correct answer.
  3. Because session timeout enforcement depends on a valid certificate
  4. Because plugin updates cannot be downloaded until a public certificate is installed

Explanation

The installation ships with a self-signed certificate, which clients cannot validate against a trusted authority, leading to warnings and awkward workarounds. Installing a certificate issued by a trusted authority lets browsers and integrations verify the server and encrypt traffic normally.

Question 40Deployment, Architecture, and Initial Configuration

Besides a software installation on a supported Linux host, in what form does Tenable deliver SecurityCenter for deployment?

  1. A serverless function hosted by a cloud provider
  2. A container image deployed with Kubernetes
  3. A Windows service package
  4. A prebuilt virtual appliance distributed by Tenable Correct answer.

Explanation

Tenable provides SecurityCenter as a prebuilt virtual appliance that packages the operating system and application, simplifying deployment compared with a manual software install. Container orchestration, Windows packaging, and serverless hosting are not delivery models for this product.

Question 41Scan Policies, Scan Zones, and Credentialed Scanning

Where in a Tenable.sc scan policy are the credentials used for authenticated checks configured?

  1. On the Credentials tab Correct answer.
  2. On the Discovery tab
  3. On the Plugins tab
  4. On the Report tab

Explanation

A scan policy stores authentication material in its Credentials section, where SSH, Windows, SNMP, and database credentials are added. These credentials are supplied to the scanner during the scan so local checks can run. Plugin selection and discovery settings are configured elsewhere in the policy.

Question 42Scan Policies, Scan Zones, and Credentialed Scanning

Which statement best describes a scan zone in Tenable.sc?

  1. A schedule that controls when scans run
  2. A list of plugins excluded from a scan
  3. A logical grouping of scanners for a network Correct answer.
  4. A set of hosts exempt from all checks

Explanation

Scan zones group scanners so that scans can be directed through scanners with the right network placement. A scan selects one or more zones, and the scanners in those zones perform the work. Zones help distribute load and cross network boundaries such as firewalls.

Question 43Scan Policies, Scan Zones, and Credentialed Scanning

Which credential type does Tenable.sc use to authenticate to Windows hosts over SMB?

  1. SSH
  2. SNMP
  3. Database
  4. Windows Correct answer.

Explanation

Windows credentials use SMB to log on to Windows hosts and collect local information such as patch level, registry settings, and file attributes. SSH is used for Unix-like systems, while SNMP targets network devices. Database credentials are used for database-specific checks.

Question 44Scan Policies, Scan Zones, and Credentialed Scanning

In Tenable.sc scan results, what does a Credentialed status for a host indicate?

  1. The host was scanned from more than one scan zone
  2. The host passed every vulnerability check
  3. The scanner authenticated and ran local checks Correct answer.
  4. The scan policy had Safe Checks enabled

Explanation

Credentialed status means the scanner successfully logged on to the host and could run local checks that require an account. It does not mean the host is vulnerability-free. Uncredentialed hosts are still assessed with remote checks.

Question 45Scan Policies, Scan Zones, and Credentialed Scanning

Which scan policy section is used to enable or disable plugin families?

  1. Plugins Correct answer.
  2. Credentials
  3. Advanced
  4. Discovery

Explanation

The Plugins section of a scan policy lists plugin families that can be enabled or disabled for the scan. This determines which checks the scanner is allowed to run. Credentials, discovery methods, and performance options are configured in separate sections.

Question 46Scan Policies, Scan Zones, and Credentialed Scanning

What is the effect of enabling Safe Checks in a scan policy?

  1. Plugins that could disrupt a target are not run Correct answer.
  2. Traffic between the scanner and targets is encrypted
  3. Only credentialed checks are performed
  4. All checks run with elevated privileges

Explanation

Safe Checks prevents plugins that are known to be potentially disruptive from running against targets. It is commonly used for fragile or production systems. It does not encrypt traffic or change authentication behavior.

Question 47Scan Policies, Scan Zones, and Credentialed Scanning

By default, SSH credentials used for credentialed scanning connect to which TCP port?

  1. 22 Correct answer.
  2. 161
  3. 445
  4. 443

Explanation

SSH listens on TCP port 22 by default, and Tenable.sc uses that port unless a different port is specified in the credential. Port 161 is used by SNMP and port 445 by SMB. Port 443 is used by HTTPS.

Question 48Scan Policies, Scan Zones, and Credentialed Scanning

A scan must reach hosts on a remote subnet separated by a firewall. Which condition is required?

  1. The targets must be listed in the Credentials tab
  2. A scanner with network access to that subnet Correct answer.
  3. The scan must use SNMP credentials
  4. The scan policy must have Safe Checks disabled

Explanation

A scanner can only assess hosts it can route to through the network. Placing a scanner in the appropriate scan zone ensures the scan traffic originates on a network with access to the targets. Policy settings and credentials do not overcome network reachability.

Question 49Scan Policies, Scan Zones, and Credentialed Scanning

A policy includes valid Windows and SSH credentials and targets a mixed subnet. How are these credentials applied?

  1. Each type is tried and used where it authenticates Correct answer.
  2. The scan fails unless every host accepts both types
  3. Only the first credential in the list is ever used
  4. Credentials apply only to hosts in the default scan zone

Explanation

The scanner attempts the configured credential types against each host and uses whichever authentication succeeds. Windows credentials work on Windows hosts, and SSH credentials work on Unix-like hosts. A host that rejects one type can still be assessed with another applicable type.

Question 50Scan Policies, Scan Zones, and Credentialed Scanning

A Linux target is scanned with an SSH credential for a non-root account and no privilege escalation. What is the likely result?

  1. The host is scanned with Windows credentials instead
  2. Authentication succeeds but local checks are limited Correct answer.
  3. All local checks run because SSH implies root
  4. The scanner cannot connect and skips the host

Explanation

Many local checks need root-level access to read protected files and configuration. A non-root SSH account can authenticate, but checks that require elevated privileges will not return complete data. Enabling sudo or su escalation in the credential resolves this.