TVMS Practice Test

TVMS practice test: what's covered

• Tenable VM
• Nessus
• Agents
• VPR
• Cyber Exposure

Free TVMS sample questions

1. The five phases of the Tenable Cyber Exposure / VM lifecycle are best summarized as:

   • A. Scan, scan, scan, scan, scan
   • B. Discover (assets) → Assess (vulnerabilities) → Analyze/Prioritize → Fix/Remediate → Measure
   • C. Buy, install, ignore, renew, repeat
   • D. Backup, restore, archive, delete, purge
   Show answer

   Correct: B. The lifecycle: Discover (know your assets), Assess (find vulns/misconfig), Analyze (prioritize by risk), Fix (remediate), Measure (track exposure over time). It is a continuous loop, not a one-time scan.

2. "Tenable Vulnerability Management" (the SaaS platform, formerly Tenable.io) differs from on-prem "Tenable Security Center" mainly in that:

   • A. They are identical
   • B. Tenable VM is cloud-hosted/managed by Tenable; Security Center is customer-hosted on-prem — both use Nessus scanners but differ in deployment, data residency, and management overhead
   • C. Security Center cannot scan
   • D. Tenable VM has no scanners
   Show answer

   Correct: B. Same scan engine (Nessus), different control plane. Tenable VM = SaaS (Tenable runs the console). Security Center = on-prem (you run it) — chosen for data-residency / air-gap requirements.

3. Which TWO are core goals of a vulnerability management program? (Choose 2)

   • A. Reduce the organization's attack surface / exposure over time
   • B. Prioritize remediation by actual risk, not just raw CVSS volume
   • C. Eliminate the need for patching
   • D. Replace the firewall
   Show answer

   Correct: A and B. VM is about measurable risk reduction and intelligent prioritization. You can't patch everything; prioritize what attackers will actually exploit on assets that matter. VM complements, not replaces, firewalls/patching.

4. A "Cyber Exposure Score" / exposure metric helps an organization by:

   • A. Counting the number of scanners
   • B. Quantifying risk so trends can be tracked, benchmarked, and reported to leadership — proving whether exposure is going up or down
   • C. Measuring CPU usage
   • D. Setting BGP weights
   Show answer

   Correct: B. Exposure scoring converts a sea of findings into a trackable risk metric. Used to measure program effectiveness, benchmark against peers, and communicate posture to executives.

5. The principle "you cannot secure what you cannot see" maps to which lifecycle phase?

   • A. Measure
   • B. Discover — comprehensive asset discovery is the foundation; unknown assets are unmanaged risk
   • C. Fix
   • D. Analyze
   Show answer

   Correct: B. Discovery first. Shadow IT, forgotten servers, and unmanaged cloud are the assets that get breached. Continuous discovery (active scan + agents + connectors + passive NNM) keeps the inventory honest.

Last updated: 2026-10-19

TVMS practice test FAQ