Security+ acronyms and glossary (SY0-801)

Glossary

AAAAuthentication, Authorization, and Accounting

The framework for controlling access: prove who you are (authentication), decide what you may do (authorization), and record what you did (accounting). RADIUS and TACACS+ are classic AAA servers.SY0-801 1.1 (General Security Concepts)

AIArtificial Intelligence

Systems that perform tasks normally needing human judgment, such as classifying, predicting or generating content. On SY0-801 it is both a tool for defenders and a new attack surface (objective 2.6).SY0-801 2.6 (Threats, Vulnerabilities, and Attacks); 4.6 (Security Operations)

ALEAnnualized Loss Expectancy

The expected yearly loss from one risk: ALE = SLE × ARO. Use it to compare the cost of a control against the loss it prevents.SY0-801 5.2 (Security Program Management and Oversight)

AML/CTFAnti-money Laundering/Counter-terrorism Financing

Anti-money laundering and counter-terrorism financing rules that require organizations, especially financial ones, to verify customers, monitor transactions and report suspicious activity.SY0-801 5.4 (Security Program Management and Oversight)

APTAdvanced Persistent Threat

A well-resourced, patient attacker, often state-sponsored, that gains access and stays hidden for a long time to steal data or prepare disruption.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

AROAnnualized Rate of Occurrence

How many times a year a given loss event is expected to happen. A flood every 10 years has an ARO of 0.1.SY0-801 5.2 (Security Program Management and Oversight)

AUPAcceptable Use Policy

The policy users accept that states what they may and may not do with company systems, networks and data.SY0-801 5.1 (Security Program Management and Oversight)

BECBusiness Email Compromise

A fraud where an attacker impersonates or takes over a business email account, typically an executive or supplier, to redirect payments or obtain sensitive data.SY0-801 5.6 (Security Program Management and Oversight)

BIMIBrand Indicators for Message Identification

An email standard that shows a brand's verified logo next to authenticated messages. It only works for domains that already enforce DMARC.SY0-801 4.1 (Security Operations)

BIOSBasic Input/Output System

Legacy firmware that initializes hardware and starts the operating system. Modern systems use UEFI, which adds Secure Boot.

BYODBring Your Own Device

A model where employees use personal devices for work. It raises questions of data separation, MDM enrolment and what the company may wipe.SY0-801 5.1, 5.6 (Security Program Management and Oversight)

CABChange Advisory Board

The group that reviews, approves or rejects proposed changes, weighing business impact, risk, testing and the backout plan before a change goes live.SY0-801 1.2 (General Security Concepts)

CAPTCHACompletely Automated Public Turing test to tell Computers and Humans Apart

A challenge meant to tell humans from bots, used to slow credential stuffing, scraping and automated sign-ups.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

CI/CDContinuous Integration and Continuous Deployment

The automated pipeline that builds, tests and ships code on every change. Security checks such as code scanning and signing are added as pipeline stages.SY0-801 4.6 (Security Operations)

CIAConfidentiality, Integrity, and Availability

The three core security goals: confidentiality (only authorized people see data), integrity (data is not altered undetected) and availability (systems work when needed).SY0-801 1.1 (General Security Concepts)

CRLCertificate Revocation List

A list, published by a certificate authority, of certificates revoked before their expiry date. Clients download it to check a certificate is still trusted.SY0-801 1.3 (General Security Concepts)

CSPMCloud Security Posture Management

Tools that continuously check cloud accounts for misconfigurations, such as public storage buckets or overly broad permissions, against a security baseline.SY0-801 4.3 (Security Operations)

CSRCertificate Signing Request

The request sent to a certificate authority to obtain a certificate. It contains the public key and identity details and is signed with the matching private key, which never leaves the requester.SY0-801 1.3 (General Security Concepts)

CVECommon Vulnerabilities and Exposures

A public catalogue that gives each known vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.SY0-801 2.1 (Threats, Vulnerabilities, and Attacks)

CVSSCommon Vulnerability Scoring System

A 0-10 scoring system for vulnerability severity based on factors such as attack vector, complexity, privileges needed and impact. Severity is not the same as your organization's risk.SY0-801 2.1 (Threats, Vulnerabilities, and Attacks)

CWECommon Weakness Enumeration

A catalogue of software weakness types, such as SQL injection (CWE-89). A CVE is one specific flaw; a CWE is the category of mistake behind it.

DDoSDistributed Denial of Service

A denial-of-service attack launched from many sources at once, often a botnet, so blocking a single address does not stop it.SY0-801 2.5 (Threats, Vulnerabilities, and Attacks)

DHCPDynamic Host Configuration Protocol

The protocol that automatically assigns IP addresses and network settings to devices. A rogue DHCP server can redirect traffic; DHCP snooping on switches blocks it.

DKIMDomainKeys Identified Mail

An email authentication method in which the sending domain signs messages with a private key and publishes the public key in DNS, so receivers can verify the message was not altered.SY0-801 4.1 (Security Operations)

DLPData Loss Prevention

Controls that detect and block sensitive data leaving where it should stay, for example via email, uploads or USB drives.SY0-801 4.1, 4.4 (Security Operations)

DMARCDomain-based Message Authentication, Reporting, and Conformance

An email policy published in DNS that tells receivers what to do (none, quarantine or reject) with messages that fail DMARC, meaning neither SPF nor DKIM passes in alignment with the visible From domain, and where to send reports.SY0-801 4.1 (Security Operations)

DNSDomain Name System

The system that translates names such as example.com into IP addresses. Attacks include cache poisoning and tunnelling; DNSSEC adds signed records.SY0-801 2.5 (Threats, Vulnerabilities, and Attacks)

DoSDenial of Service

An attack that makes a service unavailable by exhausting its bandwidth, connections or resources, or by crashing it.SY0-801 2.5 (Threats, Vulnerabilities, and Attacks)

EDREndpoint Detection and Response

Endpoint software that records activity on hosts, detects suspicious behaviour and lets responders investigate and isolate a machine remotely.SY0-801 4.1 (Security Operations)

EOIExpression of Interest

A first, informal step in procurement where vendors state their interest and basic capability before a formal RFP.SY0-801 5.3 (Security Program Management and Oversight)

GBICGigabit Interface Converter

A hot-swappable module that connects a network device port to fibre or copper cabling. The smaller SFP format has largely replaced it.

gMSAGroup Managed Service Account

A Windows Active Directory account for services whose long, complex password is generated and rotated automatically, so no human needs to know or manage it.SY0-801 3.2 (Security Architecture)

HIDSHost-based Intrusion Detection System

Software on a single host that detects intrusions by watching its logs, files and processes, and alerts without blocking.SY0-801 4.1 (Security Operations)

HIPSHost-based Intrusion Prevention System

Software on a single host that detects and actively blocks malicious activity on that host.SY0-801 4.1 (Security Operations)

HRHuman Resources

The department that handles hiring, background checks, onboarding and offboarding. Prompt offboarding is a key control against lingering access.SY0-801 4.8 (Security Operations)

IaCInfrastructure as Code

Managing infrastructure through versioned configuration files instead of manual setup, so environments are repeatable and changes can be reviewed and scanned before deployment.SY0-801 3.1 (Security Architecture)

IDSIntrusion Detection System

A system that monitors traffic or activity and alerts on suspected attacks without blocking them. It is passive, usually fed by a copy of the traffic.SY0-801 4.1 (Security Operations)

IPInternet Protocol

The protocol that addresses and routes packets between networks. In logs and investigations, source and destination IP addresses are key evidence.SY0-801 2.5 (Threats, Vulnerabilities, and Attacks)

IPFIXInternet Protocol Flow Information Export

An IETF standard, based on NetFlow, for exporting flow records (who talked to whom, when, and how much) without capturing packet contents.SY0-801 4.8 (Security Operations)

IPSIntrusion Prevention System

A system placed inline that inspects traffic and blocks attacks in real time. It is active, so a false positive can block legitimate traffic.SY0-801 4.1 (Security Operations)

IPSecInternet Protocol Security

A suite that secures IP traffic at the network layer. AH provides integrity and authentication, ESP adds encryption; tunnel mode is used for site-to-site VPNs.

LANLocal Area Network

A network covering a limited area such as an office or a home, usually segmented further with VLANs.

LDAPLightweight Directory Access Protocol

A protocol for querying and changing directory services such as Active Directory. LDAPS protects it with TLS.SY0-801 4.5 (Security Operations)

LLMLarge Language Model

A large language model: an AI system trained on large amounts of text to generate and understand language. Risks include prompt injection, data leakage and false outputs.SY0-801 2.4 (Threats, Vulnerabilities, and Attacks)

LMSLearning Management System

A learning management system: the platform that delivers, tracks and reports on security awareness training.SY0-801 5.6 (Security Program Management and Oversight)

MDMMobile Device Management

Tools that enrol, configure and secure mobile devices centrally, for example by enforcing a screen lock, encryption and remote wipe.SY0-801 4.1 (Security Operations)

MFAMultifactor Authentication

Authentication with two or more different factor types, such as something you know, have or are. Two passwords are still one factor.SY0-801 2.5 (Threats, Vulnerabilities, and Attacks); 4.5 (Security Operations)

MOAMemorandum of Agreement

A memorandum of agreement: a document setting out the responsibilities two parties agree to in a joint effort. It is more specific than an MOU.SY0-801 5.3 (Security Program Management and Oversight)

MOUMemorandum of Understanding

A memorandum of understanding: a usually non-binding statement of intent and common goals between two parties.SY0-801 5.3 (Security Program Management and Oversight)

MSAMaster Service Agreement

A master service agreement: the overarching contract that sets general terms for future work, with details added later in an SOW for each project.SY0-801 5.3 (Security Program Management and Oversight)

MTBFMean Time Between Failures

The average operating time between failures of a repairable component. A higher MTBF means more reliable hardware.SY0-801 3.4 (Security Architecture)

MTTRMean Time to Repair

The average time needed to repair a failed component and restore service. A lower MTTR means faster recovery.SY0-801 3.4 (Security Architecture)

NDANon-disclosure Agreement

A legal agreement that obliges the signer to keep specified information confidential.SY0-801 5.3 (Security Program Management and Oversight)

NFCNear-field Communication

Very short-range wireless communication used for contactless payments and badges. Its short range limits, but does not remove, skimming and relay attacks.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

NICNetwork Interface Card

The hardware that connects a device to a network. Each NIC has a MAC address.

NIDSNetwork-based Intrusion Detection System

A network-based intrusion detection system that analyses traffic on the segments where its sensors sit, usually from a SPAN port or tap, and alerts on suspected attacks without blocking them.SY0-801 4.1 (Security Operations)

NIPSNetwork-based Intrusion Prevention System

A network intrusion prevention system placed inline that inspects traffic and blocks attacks as they pass.SY0-801 4.1 (Security Operations)

NVDNational Vulnerability Database

The US government's National Vulnerability Database, run by NIST, which adds CVSS scores, affected products and references to CVE entries.

OAuthOpen Authorization

An authorization framework that lets an app access resources on a user's behalf with a token, without receiving the user's password. On its own it is not an authentication protocol; OpenID Connect adds that.SY0-801 4.5 (Security Operations)

OCSPOnline Certificate Status Protocol

A protocol for checking one certificate's revocation status in real time, instead of downloading a whole CRL. OCSP stapling lets the server provide the answer.SY0-801 1.3 (General Security Concepts)

OSOperating System

The operating system: the core software that manages hardware and runs applications. Hardening, patching and secure configuration baselines apply to it.SY0-801 2.4 (Threats, Vulnerabilities, and Attacks); 4.1 (Security Operations)

OTOperational Technology

Operational technology: systems that monitor and control physical processes, such as ICS and SCADA. Availability and safety usually come first, and patching is often limited.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks); 3.1 (Security Architecture)

OTPOne-time Password

A one-time password valid for a single login or a short time window, generated by an app or token (TOTP/HOTP) or sent by message.SY0-801 4.5 (Security Operations)

PDFPortable Document Formats

A common document format. Malicious PDFs that carry scripts or exploits are a classic file-based threat vector.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

PIRPost-incident Reporting

Post-incident reporting: part of the final, post-incident phase, alongside lessons learned and root cause analysis. It documents what happened, the timeline, the root cause and the improvements to make. In SY0-801, notification and external reporting is a separate step that comes before it.SY0-801 4.7 (Security Operations)

PKIPublic Key Infrastructure

The system of certificate authorities, certificates, keys and policies that binds public keys to identities so they can be trusted.SY0-801 1.3 (General Security Concepts)

QRQuick Response

A scannable 2D barcode. Malicious QR codes that lead to phishing sites are known as quishing.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

RCSRich Communication Services

Rich communication services: the messaging standard that succeeds SMS, adding media, read receipts and group chat. Like SMS, it can carry phishing (smishing).SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

RFRadio Frequency

Radio frequency. Wireless attacks such as jamming, eavesdropping and rogue access points all target RF.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

RFCRequest for Comments

Request for Comments: a published technical standard or best-practice document, such as the IETF RFCs that define TLS or DNS. On SY0-801 it sits under standards, as a source organizations adopt. Don't confuse it with a request for change.SY0-801 5.1 (Security Program Management and Oversight)

RFIRequest for Information

A request for information: a procurement document asking vendors for general information about their products before a formal bid.SY0-801 5.3 (Security Program Management and Oversight)

RFPRequest for Proposal

A request for proposal: a formal document inviting vendors to propose a solution and a price for defined requirements.SY0-801 5.3 (Security Program Management and Oversight)

RFQRequest for Quote

A request for quote: a document asking vendors to price a clearly specified product or service.SY0-801 5.3 (Security Program Management and Oversight)

ROIReturn on Investment

Return on investment: the benefit of an investment relative to its cost. Used to justify spending on security controls.SY0-801 5.3 (Security Program Management and Oversight)

RPORecovery Point Objective

The maximum acceptable data loss, measured in time. An RPO of 4 hours means backups must run at least every 4 hours.SY0-801 3.4 (Security Architecture)

RPSRedundant Power Supply

A redundant power supply: a second power supply unit inside a device that keeps it running if the first one fails. It is a basic resilience measure for servers and network gear.SY0-801 3.4 (Security Architecture)

RTFRich Text Format

Rich Text Format, a document format that has been abused to deliver exploits in malicious attachments.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

RTORecovery Time Objective

The maximum acceptable time to restore a system after a disruption. It drives the choice of recovery site and method.SY0-801 3.4 (Security Architecture)

SaaSSoftware as a Service

Software as a service: complete applications delivered over the internet. The provider runs the stack; the customer still manages data, identities and access.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

SAMLSecurity Assertions Markup Language

An XML-based standard for exchanging authentication assertions between an identity provider and a service provider. It is common for enterprise web SSO.SY0-801 4.5 (Security Operations)

SCAPSecurity Content Automation Protocol

A NIST suite of specifications for automating vulnerability and configuration checks in a standard, machine-readable way.SY0-801 4.4 (Security Operations)

SELinuxSecurity-enhanced Linux

A Linux kernel security feature (a Linux Security Module) that enforces mandatory access control, confining processes to what policy explicitly allows.SY0-801 4.1 (Security Operations)

SFPSmall Form-factor Pluggable

Small form-factor pluggable: a compact, hot-swappable transceiver for fibre or copper network ports. It is the successor to GBIC.

SIEMSecurity Information and Event Management

A system that collects and correlates logs and events from many sources to detect threats, alert and support investigations.SY0-801 4.4 (Security Operations)

SLESingle Loss Expectancy

The monetary loss from a single occurrence of a risk event: SLE = asset value × exposure factor.SY0-801 5.2 (Security Program Management and Oversight)

SMSShort Message Service

Text messaging. It is a channel for smishing, and SMS one-time codes are weaker than app or hardware factors because of SIM swapping.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

SNMPSimple Network Management Protocol

A protocol for monitoring and managing network devices. Use SNMPv3, which adds authentication and encryption; v1 and v2c use plaintext community strings.SY0-801 4.4 (Security Operations)

SOARSecurity Orchestration, Automation, and Response

Security orchestration, automation and response: a platform that runs playbooks to automate response steps across security tools.

SOCSecurity Operations Center

Security operations center: the team, and often the facility, that monitors, detects and responds to security events. (SOC 2 is a separate audit report.)

SOPStandard Operating Procedure

Standard operating procedure: step-by-step instructions for performing a routine task consistently and safely.SY0-801 1.2 (General Security Concepts); 5.1 (Security Program Management and Oversight)

SOWStatement of Work

Statement of work: the document that defines a specific project's tasks, deliverables, schedule and acceptance criteria, often under an MSA.SY0-801 5.3 (Security Program Management and Oversight)

SPFSender Policy Framework

An email authentication record in DNS listing which servers may send mail for a domain.SY0-801 4.1 (Security Operations)

SQLStructured Query Language

Structured Query Language, used to query databases. SQL injection inserts attacker input into queries; parameterized queries prevent it.

SSESecurity Service Edge

Security service edge: cloud-delivered security services such as SWG, CASB and ZTNA. Combined with SD-WAN networking, it forms SASE.SY0-801 3.2 (Security Architecture)

SSOSingle Sign-on

Single sign-on: one authentication grants access to many applications. It is convenient, but it makes the identity provider a high-value target.SY0-801 4.5 (Security Operations)

TLSTransport Layer Security

Transport Layer Security, the protocol that encrypts and authenticates data in transit, for example in HTTPS. It replaced SSL.

TOCTime-of-check

Time-of-check: the moment a condition is verified. In a TOC/TOU race condition, the state changes between the check and its use.SY0-801 2.4 (Threats, Vulnerabilities, and Attacks)

TOUTime-of-use

Time-of-use: the moment a previously checked resource is actually used. The gap after time-of-check is what a race condition exploits.SY0-801 2.4 (Threats, Vulnerabilities, and Attacks)

UPSUninterruptible Power Supply

An uninterruptible power supply: a battery unit that keeps equipment running through short outages and allows a clean shutdown or a generator start.SY0-801 3.4 (Security Architecture)

USBUniversal Serial Bus

The standard port for peripherals and storage. Removable media can spread malware and carry data out, so it is often restricted by policy or DLP.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

UTMUnified Threat Management

Unified threat management: a single appliance combining firewall, IPS, antivirus, web filtering and VPN. It is simple to run but is a single point of failure.SY0-801 4.1 (Security Operations)

VNCVirtual Network Computing

A remote desktop protocol. When it is exposed or weakly configured, it is a remote access threat vector.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks)

VPNVirtual Private Network

An encrypted tunnel over an untrusted network that connects remote users or sites to a private network. It is commonly built with IPSec or TLS.SY0-801 2.3 (Threats, Vulnerabilities, and Attacks); 3.2 (Security Architecture)

WAFWeb Application Firewall

A web application firewall: it inspects HTTP traffic to block web attacks such as SQL injection and XSS in front of an application.SY0-801 4.1 (Security Operations)

WIPSWireless Intrusion Prevention System

A wireless intrusion prevention system that monitors the radio spectrum and blocks rogue access points and wireless attacks.SY0-801 4.1 (Security Operations)

XDRExtended Detection and Response

Extended detection and response: it correlates telemetry from endpoints, network, cloud and email to detect and respond across all of them, beyond endpoint-only EDR.SY0-801 4.1 (Security Operations)

Acronyms and expansions from the CompTIA Security+ V8 objectives (acronym list), checked 2 November 2026. Definitions are CertSprint's own.