Virtual Appliance is a pre-packaged appliance and does not provide direct control.
Specifically root control is not provided.
1. Clients can run tools which need to be present on the system and will work properly as the following user,
config
dsa
imps
oracle
You can not run tools which require root.
2. There is another set of tools which need not be installed on Virtual Appliance. Like SSL/HTTP scanners.
You can use these tools on Virtual Appliance just as you would use them on other systems.