CySA+ acronyms and glossary (CS0-004)

Glossary

AIArtificial Intelligence

Systems that perform tasks normally needing human judgment, such as classifying, predicting or generating content. CS0-004 objective 1.6 covers using AI in security operations, its limits and its risks, such as false outputs and data exposure.CS0-004 1.6 (Security Operations)

APIApplication Programming Interface

The interface programs use to talk to each other. For an analyst, APIs are both an attack surface (broken authorization, excessive data exposure) and how tools such as SIEM, SOAR and threat intelligence platforms are wired together.CS0-004 1.1, 1.5 (Security Operations)

APTAdvanced Persistent Threat

A well-resourced, patient attacker, often state-sponsored, that gains access and stays hidden for a long time to steal data or prepare disruption.CS0-004 1.4 (Security Operations)

ASNAutonomous System Number

An Autonomous System Number identifies an autonomous system: a network, such as an ISP, cloud or hosting provider, that announces its own IP address ranges to the internet through BGP. Looking up an indicator's ASN shows which provider or organization routes it. CompTIA's list prints this as "Anonymous System Number".

AWSAmazon Web Services

Amazon's public cloud. On CySA+ it appears as an environment whose logs (such as CloudTrail) and misconfigurations an analyst must be able to read and assess.

BASBreach and Attack Simulation

Breach and attack simulation: tools that safely run real attack techniques against your own environment, continuously, to check whether controls detect and block them. CompTIA's list prints it as "Breach Attack Simulation".CS0-004 2.2 (Vulnerability Management)

BCBusiness Continuity

Business continuity: keeping critical business functions running during and after a disruption. It is broader than disaster recovery, which restores IT.

BECBusiness Email Compromise

A fraud where an attacker impersonates or takes over a business email account, typically an executive or supplier, to redirect payments or obtain sensitive data.CS0-004 1.2 (Security Operations)

CASBCloud Access Security Broker

A cloud access security broker sits between users and cloud services to see which apps are used and to enforce policy, such as data loss prevention and access control, on that traffic.

CERTComputer Emergency Response Team

A computer emergency response team: a group that coordinates the response to security incidents, either inside an organization or nationally, and often publishes advisories.

CHDCardholder Data

Cardholder data: at minimum the full primary account number (PAN), plus the cardholder name, expiry date or service code when present with it. PCI DSS governs how it is stored, processed and transmitted; sensitive authentication data such as the CVV or PIN must not be stored after authorization.

CISCenter for Internet Security

The Center for Internet Security, which publishes the CIS Controls and the CIS Benchmarks, the hardening baselines that configuration scans check against.CS0-004 2.1 (Vulnerability Management)

CSIRTCybersecurity Incident Response Team

The team that handles security incidents from detection to recovery, with defined roles, escalation paths and authority to act. CompTIA expands it as Cybersecurity Incident Response Team.

CVSSCommon Vulnerability Scoring System

A 0-10 scoring system for vulnerability severity based on factors such as attack vector, complexity, privileges needed and impact. Severity is not the same as your organization's risk.CS0-004 2.3 (Vulnerability Management)

DASTDynamic Application Security Testing

Dynamic application security testing: scanning a running application from the outside, by sending crafted requests, to find flaws such as injection and misconfiguration. It needs no source code.CS0-004 2.4 (Vulnerability Management)

DKIMDomainKeys Identified Mail

An email authentication method in which the sending domain signs messages with a private key and publishes the public key in DNS, so receivers can verify the message was not altered. CompTIA's list spells it "Domain Keys".

DLPData Loss Prevention

Controls that detect and block sensitive data leaving where it should stay, for example via email, uploads or USB drives.

DMARCDomain-based Message Authentication, Reporting, and Conformance

An email policy published in DNS that tells receivers what to do (none, quarantine or reject) with messages that fail DMARC, meaning neither SPF nor DKIM passes in alignment with the visible From domain, and where to send reports.

DNSDomain Name System

The Domain Name System translates names into IP addresses (CompTIA's list says "Domain Name Service"). DNS logs reveal beaconing, algorithmically generated domains and tunnelling.

DRDisaster Recovery

Disaster recovery: the plans and processes to restore IT systems and data after a major outage, measured against RTO and RPO.

EDREndpoint Detection and Response

Endpoint software that records activity on hosts, detects suspicious behaviour and lets responders investigate and isolate a machine remotely.CS0-004 1.3 (Security Operations)

EPSSExploit Prediction Scoring System

The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days. Combined with CVSS severity, it helps decide what to patch first. CompTIA's list prints it as "Exploitability Predication Scoring System".CS0-004 2.3 (Vulnerability Management)

GCPGoogle Cloud Platform

Google's public cloud. Like AWS, it appears on CySA+ as an environment to monitor and assess.

GDBGNU Debugger

The GNU Debugger, a command-line tool for stepping through a program's execution. Analysts use it in reverse engineering and malware analysis.

GeoIPGeolocation by IP

Mapping an IP address to an approximate location. It helps spot logins from unexpected countries, though VPNs and proxies easily mislead it.CS0-004 1.3 (Security Operations)

IaCInfrastructure as Code

Managing infrastructure through versioned configuration files instead of manual setup, so environments are repeatable and changes can be reviewed and scanned before deployment.CS0-004 1.5 (Security Operations)

IAMIdentity and Access Management

Identity and access management: the processes and tools that create identities, authenticate them and control what they can access. Identity logs are a key source of indicators of compromise.CS0-004 1.1, 1.2 (Security Operations)

ICSIndustrial Control Systems

Industrial control systems that run physical processes in plants and utilities. Availability and safety come first, so active scanning is often restricted.CS0-004 1.1 (Security Operations)

IDSIntrusion Detection System

A system that monitors traffic or activity and alerts on suspected attacks without blocking them. It is passive, usually fed by a copy of the traffic.

IoCIndicator of Compromise

An indicator of compromise: evidence that a system has been breached, such as a malicious hash, domain, IP address or unusual process.CS0-004 1.4 (Security Operations)

IPInternet Protocol

The protocol that addresses and routes packets between networks. In logs and investigations, source and destination IP addresses are key evidence.CS0-004 1.3 (Security Operations)

IPSIntrusion Prevention System

A system placed inline that inspects traffic and blocks attacks in real time. It is active, so a false positive can block legitimate traffic.

ISOInternational Organization for Standardization

The International Organization for Standardization. ISO/IEC 27001 and 27002 are the information security standards most often cited in frameworks and audits.CS0-004 2.1 (Vulnerability Management)

JSONJavaScript Object Notation

JavaScript Object Notation, a lightweight data format. Most cloud logs, API responses and threat intelligence feeds use it, so analysts must read and filter it.CS0-004 1.3 (Security Operations)

KPIKey Performance Indicator

A key performance indicator: a measurable value showing how well a process works, such as mean time to detect, mean time to respond or patching within SLA.CS0-004 4.1, 4.2 (Reporting and Communication)

LFILocal File Inclusion

Local file inclusion: a web flaw where user input makes the application read or run a file already on the server, for example ../../etc/passwd.

MDMMobile Device Management

Tools that enrol, configure and secure mobile devices centrally, for example by enforcing a screen lock, encryption and remote wipe.CS0-004 1.3 (Security Operations)

MFAMultifactor Authentication

Authentication with two or more different factor types, such as something you know, have or are. Two passwords are still one factor.

MISPMalware Information Sharing Platform

An open-source threat intelligence platform for storing, correlating and sharing indicators and events between organizations.CS0-004 1.3 (Security Operations)

MOUMemorandum of Understanding

A memorandum of understanding: a usually non-binding statement of intent and common goals between two parties.

MSFMetasploit Framework

The Metasploit Framework, an open-source penetration testing tool for running exploits and payloads against targets to validate vulnerabilities.CS0-004 2.2 (Vulnerability Management)

OpenCTIOpen Cyber Threat Intelligence

An open-source platform for organizing cyber threat intelligence, linking indicators, actors, campaigns and techniques. It is commonly mapped to MITRE ATT&CK.CS0-004 1.3 (Security Operations)

OpenUBAOpen User Behavior Analytics

An open-source user behavior analytics project that baselines normal user activity and flags anomalies.CS0-004 1.3 (Security Operations)

OpenVASOpen Vulnerability Assessment Scanner

An open-source vulnerability scanner, part of Greenbone, that checks hosts against a feed of known vulnerability tests.CS0-004 2.2 (Vulnerability Management)

OSINTOpen-Source Intelligence

Open-source intelligence: information gathered from public sources, such as websites, social media, DNS and code repositories, about threats or about your own exposure.CS0-004 1.4 (Security Operations)

OSSTMMOpen Source Security Testing Methodology Manual

The Open Source Security Testing Methodology Manual, a peer-reviewed methodology for planning and measuring security tests.

OTOperational Technology

Operational technology: systems that monitor and control physical processes, such as ICS and SCADA. Availability and safety usually come first, and patching is often limited.CS0-004 1.1 (Security Operations)

OTXOpen Threat Exchange

AlienVault Open Threat Exchange, a free community threat intelligence feed of indicators that can be pulled into security tools.CS0-004 1.3 (Security Operations)

OWASPOpen Web Application Security Project

The Open Worldwide Application Security Project (CompTIA's list uses the older name, Open Web Application Security Project). It publishes the OWASP Top 10 and SAMM, and was the original home of ZAP.

PAMPrivileged Access Management

Privileged access management: controls for admin accounts, such as vaulting credentials, just-in-time access, session recording and approval workflows.CS0-004 1.1 (Security Operations)

PCI DSSPayment Card Industry Data Security Standard

The Payment Card Industry Data Security Standard: mandatory security requirements for any organization that stores, processes or transmits cardholder data, including regular vulnerability scans.CS0-004 2.1 (Vulnerability Management)

PIIPersonally Identifiable Information

Personally identifiable information: data that identifies a person, such as name, address or ID numbers. A breach involving it can trigger legal notification duties.

PKIPublic Key Infrastructure

The system of certificate authorities, certificates, keys and policies that binds public keys to identities so they can be trusted.

RFIRemote File Inclusion

Remote file inclusion: a web flaw where the application loads and runs a file from an attacker-controlled URL. On CySA+, RFI means this, not a request for information.

SAMMSoftware Assurance Maturity Model

OWASP's Software Assurance Maturity Model, used to measure and improve how securely an organization builds software.CS0-004 2.4 (Vulnerability Management)

SASESecure Access Service Edge

Secure access service edge: networking (SD-WAN) and security services (SWG, CASB, ZTNA, firewall) delivered together from the cloud, close to users.CS0-004 1.1 (Security Operations)

SASTStatic Application Security Testing

Static application security testing: analysing source code or binaries without running them to find flaws such as injection or hard-coded secrets. It runs early in development.CS0-004 2.4 (Vulnerability Management)

SBOMSoftware Bill of Materials

A software bill of materials: an inventory of the components and versions inside a piece of software, so you can tell quickly whether a newly disclosed vulnerability affects you.CS0-004 2.4 (Vulnerability Management)

SCASoftware Composition Analysis

Software composition analysis: tools that identify the open-source components in your code and flag known vulnerabilities and licence issues in them.CS0-004 2.4 (Vulnerability Management)

SCADASupervisory Control and Data Acquisition

Supervisory control and data acquisition: systems that monitor and control industrial processes across sites, such as pipelines and power grids. They are a subset of ICS.CS0-004 1.1 (Security Operations)

SDLCSoftware Development Life Cycle

The software development life cycle: the phases from requirements to design, coding, testing, deployment and maintenance. Security testing is built into each phase.

SDNSoftware-Defined Networking

Software-defined networking separates the control plane from the data plane, so the network is configured centrally through software. That makes segmentation easier to automate.

SIEMSecurity Information and Event Management

A system that collects and correlates logs and events from many sources to detect threats, alert and support investigations.CS0-004 1.3 (Security Operations)

SLAService-level Agreement

A service-level agreement: a commitment with measurable targets, such as fixing critical vulnerabilities within 15 days. Vulnerability reports track compliance against it.CS0-004 4.1 (Reporting and Communication)

SLOService-level Objective

A service-level objective: a specific measurable target inside an SLA, such as 99.9% availability.CS0-004 2.4 (Vulnerability Management)

SOARSecurity Orchestration, Automation, and Response

Security orchestration, automation and response: a platform that runs playbooks to automate response steps across security tools.CS0-004 1.5 (Security Operations)

SPFSender Policy Framework

An email authentication record in DNS listing which servers may send mail for a domain.

SSLSecure Sockets Layer

Secure Sockets Layer, the deprecated predecessor of TLS. Finding SSL or early TLS versions enabled is a common vulnerability scan result.

SSOSingle Sign-on

Single sign-on: one authentication grants access to many applications. It is convenient, but it makes the identity provider a high-value target.

STRIDESpoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege

A threat-modeling method that names six threat types: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Each maps to a security property it violates.CS0-004 1.4 (Security Operations)

TCPTransmission Control Protocol

Transmission Control Protocol: connection-oriented transport using the SYN, SYN-ACK, ACK handshake. Flags and ports in TCP traffic are key evidence in network analysis.

TTPsTactics, Techniques, and Procedures

Tactics, techniques and procedures: how an adversary operates. They are harder for attackers to change than hashes or IPs, so detections built on them last longer (the top of the Pyramid of Pain).CS0-004 1.4 (Security Operations)

UEBAUser and Entity Behavior Analytics

User and entity behavior analytics: baselining the normal behaviour of users and devices and alerting on deviations, such as unusual logon times or data volumes. CompTIA's list prints it as "User and Entity Behavior Analysis".CS0-004 1.3 (Security Operations)

UTMUnified Threat Management

Unified threat management: a single appliance combining firewall, IPS, antivirus, web filtering and VPN. It is simple to run but is a single point of failure.

VMVirtual Machine

A virtual machine: an emulated computer running on a hypervisor. Analysts use isolated VMs as sandboxes to detonate and observe malware.

XDRExtended Detection and Response

Extended detection and response: it correlates telemetry from endpoints, network, cloud and email to detect and respond across all of them, beyond endpoint-only EDR.CS0-004 1.3 (Security Operations)

XMLExtensible Markup Language

Extensible Markup Language, a structured data format used in logs, configuration and protocols such as SAML. XML external entity (XXE) injection abuses its parsers.CS0-004 1.3 (Security Operations)

YAMLYet Another Markup Language

A human-readable data format used for configuration files, CI/CD pipelines and Sigma detection rules. Officially "YAML Ain't Markup Language"; CompTIA uses its original name.CS0-004 1.3 (Security Operations)

YARAYet Another Recursive Acronym

A rule language for identifying and classifying malware by matching text or byte patterns and conditions in files or memory.CS0-004 1.3 (Security Operations)

ZAPZed Attack Proxy

Zed Attack Proxy (ZAP), a free, open-source web application scanner and intercepting proxy for dynamic testing. It began as an OWASP project and is now maintained as ZAP by Checkmarx.CS0-004 2.2 (Vulnerability Management)

ZTNAZero Trust Network Access

Zero trust network access: grants access to individual applications after verifying user and device, instead of placing the user on the whole network as a VPN does.CS0-004 1.1 (Security Operations)

Acronyms and expansions from the CompTIA CySA+ V4 objectives (acronym list), checked 2 November 2026. Definitions are CertSprint's own.