Which tools can be used to categorize and rank vulnerabilities and determine scan compliance?

• A. CAPEC
• B. CVSS Version 2.0 Base Score
• C. NVD
• D. CVSS and NVD

Answer: (D)

Using a standardized vulnerability scoring approach together with a trusted data source lets you classify, rank, and verify scan results consistently. CVSS provides a numeric Base Score and related metrics that quantify how severe a vulnerability is based on factors like exploitability, impact, and scope, giving you a common scale to compare different findings. The National Vulnerability Database serves as the official repository for vulnerability details and includes CVSS scores and vectors, along with remediation and affected-product information, which lets your scanning tools map each finding to a concrete severity and track compliance against your policies. When used together, you can assign a severity to every vulnerability, rank overall risk across systems, and determine whether scan results meet defined compliance thresholds. CAPEC covers attack patterns and isn’t used to score or rank vulnerabilities or verify scan compliance, and using only CVSS without the data context from NVD or relying on NVD alone wouldn’t give you the full ability to categorize, rank, and verify compliance.