Which U.S. government repository of vulnerability management data uses the Security Content Automation Protocol (SCAP)?

• A. National Vulnerability Database (NVD)
• B. Common Weakness Enumeration (CWE)
• C. Common Vulnerability Scoring System (CVSS)
• D. Base Metric

Answer: (A)

Security Content Automation Protocol (SCAP) provides a standardized way to exchange vulnerability management data so tools can automate assessment and remediation. The National Vulnerability Database (NVD) is the U.S. government repository that uses SCAP to structure and publish vulnerability content, including CVE identifiers, CVSS scores, and CPE product names, along with related checks and definitions. This alignment with SCAP feeds and formats is why NVD is the correct choice. The other items are not repositories: CWE is a weaknesses taxonomy, CVSS is a scoring system, and the Base Metric is a component used within CVSS.