A security team must routinely measure hundreds of servers against a published hardening benchmark and produce standardized, machine-readable compliance results. Which approach BEST fits this requirement?

The Security Content Automation Protocol (SCAP) is a suite of specifications that standardizes how security configuration checks and results are expressed. Benchmarks such as hardening guides can be published as SCAP content, and SCAP-compatible scanners evaluate each system against those rules and output consistent, machine-readable results. That supports repeatable compliance measurement across hundreds of servers and lets results feed dashboards or reports without manual interpretation. NetFlow records summarize network conversations: who talked to whom, on which ports, and how much data moved. A traffic baseline can reveal anomalies, but it cannot tell whether a password policy or audit setting matches a benchmark. A packet analyzer captures and decodes traffic; inferring configuration from packets is unreliable and cannot assess most host settings at all. SNMP traps are event notifications from managed devices, typically about status changes or faults, and they do not evaluate a server's configuration against a hardening standard. Exam caveat: benchmarks define the expected state; SCAP is the automation that measures against it, and the two are tested together. Operational check: run the SCAP scan on a small pilot group, review any failed rules for false positives, then schedule the scan across all servers and track the compliance percentage over time.