CGRC Practice Question: Your organization uses Tenable.io for continuous monitoring of vulnerability status
Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?
⚠ Common exam trap
The trap here is assuming that updating the CMDB or applying the patch automatically updates the scanner's view; CGRC tests whether you understand that vulnerability status is evidence-based and requires a post-remediation scan to close.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The vulnerability scan was not performed after the patch was applied.
Tenable.io reports vulnerability status based on the most recent scan data it has received. If a patch was applied but no scan was run afterward, the platform has no evidence of remediation and will continue to show the vulnerability as open. The configuration management database reflects the intended state (patch deployed), while the scanner reflects the observed state (last scan result) — the gap is simply the absence of a post-patch verification scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Nessus scanner plugin needs an update to recognize the patch.
Why it's wrong here
A stale plugin can only misreport a patch it cannot detect, yet Tenable.io already flags the vulnerabilities as open, so detection is working. Plugin updates address genuinely new CVEs or unrecognised patch signatures. The real cause is that the CMDB records deployment, not remediation verification, so patched status never reconciles with scan evidence.
- ✗
The scan policy is set to 'Discovery' instead of 'Audit'.
Why it's wrong here
A Discovery scan enumerates hosts and services without performing credentialed vulnerability checks, so it cannot report patch status at all — yet the stem shows vulnerabilities being detected and tracked as open. Discovery is the right choice for asset inventory when you need to map what exists on the network before enabling authenticated auditing.
- ✗
The scan agent was decommissioned prematurely.
Why it's wrong here
A decommissioned agent stops reporting, so Tenable.io would show stale or missing data rather than a patched-but-open mismatch. The tempting logic is that agent loss explains any discrepancy. Agents are the right mechanism when hosts cannot be reached by credentialed network scans, but here the CMDB patch record and scan result both exist and conflict.
- ✓
The vulnerability scan was not performed after the patch was applied.
Why this is correct
Tenable.io reports status from its own scan data, not the configuration management database. If no scan ran after the patch was deployed, the vulnerability remains 'open' in Tenable despite the CMDB marking it patched, explaining the mismatch between the two records.
About these practice questions
This CGRC question is part of Courseiva's 341-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar CGRC questions
- You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final s…
- A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the follo…
- A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to comp…
- A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reduci…
- A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official (ISC)² exam blueprint
This CGRC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGRC exam.