struts presence & how to detect its vulnerabilities

Is it right to say that:

a) Apache Struts do not run as a process (ie not listening on ports) & the very fact
    that strutsXXX.jar or struts related files are present will simply mean we are
    vulnerable (last checked we have ver 1.x struts files/jar)??

    Or should we use linux  'rpm -qa |grep strut' & Solaris 'pkginfo -l |grep -i struts'
    to determine their packages are installed??

b) By contrast, Apache httpd (ie web server) & Tomcat  must be running (ie listening
     on ports) to be considered vulnerable  ie if httpd & Tomcat packages are installed
     but they're disabled (ie we disable them at startup & their processes not running),
     they're not vulnerable??   If this is the correct assumption, guess if we don't use
     them, then we should just deinstall them (tho there are sysadmin/apps admins
     who assured that they'll never start them up ie remain disabled permanently &
     thus do not require patching)

c) Without Nessus Tenable vulnerability scanner detects the presence of vulnerable
    Struts without credentials-authenticated scan or it requires admin credential
    (as a way to login to the OS) to determine if we have vulnerable versions of
    Struts??