Where is the SBOM stored after generation?

• A. In a separate artifact not linked to scan results.
• B. In the repository history.
• C. As plain text files committed to the repository.
• D. Stored with the scan results.

Answer: (D)

The SBOM is stored with the scan results because it’s intended to accompany a specific scan run. An SBOM enumerates the exact components and versions that were present in that build, so keeping it tied to the corresponding scan results preserves the precise context needed for traceability, auditing, and vulnerability correlation. Attaching the SBOM as part of the scan’s artifacts lets you download and review both the findings and the component list together, ensuring you can verify which components were present when the results were generated. Storing it separately or committing it to the repository can easily desynchronize the SBOM from the particular scan it describes, making it harder to align components with findings.