Which are components of the SCAP standard?

• A. STIGs and Benchmarks
• B. CVE List
• C. NIST SP 800-53
• D. XCCDF and OVAL

Answer: (D)

SCAP is a set of open standards for automating vulnerability management and policy compliance. The two core specifications that make up the practical content of SCAP are XCCDF and OVAL. XCCDF (Extensible Checklist / Club Description Format) provides machine-readable security checklists, benchmarks, and policies that describe what to check and how to assess configurations. OVAL (Open Vulnerability and Assessment Language) defines how to express the actual tests and criteria in a structured, machine-readable way so tools can automatically determine whether a system meets those checks. Together, they enable automated, cross-platform assessment and compliance.

The other items aren’t the SCAP components themselves. STIGs and Benchmarks are types of guidance and predefined settings used with SCAP content but aren’t the SCAP specifications. The CVE List is a catalog of vulnerabilities, not a SCAP component. NIST SP 800-53 is a security controls standard, not part of the SCAP specification set.