Which of the following is NOT a SCAP component?

• A. Common Config Enumeration (CCE)
• B. Common Platform Enumeration (CPE)
• C. Common Vulnerability and Exposure (CVE)
• D. Common Attack Pattern Enumeration (CAPEC)

Answer: (D)

SCAP is a framework for automating security content by standardizing inventories used in vulnerability management and policy compliance. The catalogs within it include standardized names for platforms (Common Platform Enumeration), standardized descriptions of configurations to be checked (Common Configuration Enumeration), and standardized vulnerability identifiers (Common Vulnerabilities and Exposures). CAPEC, while useful for describing attack patterns and threat modeling, is not part of the SCAP component set. It describes attacker techniques rather than the standardized inventories SCAP tools rely on. So CAPEC is not a SCAP component.