IT and cybersecurity acronyms, explained one by one

A to Z

AAAAuthentication, Authorization, and Accounting

The framework for controlling access: prove who you are (authentication), decide what you may do (authorization), and record what you did (accounting). RADIUS and TACACS+ are classic AAA servers.Security+ · A+

ACLAccess Control List

An ordered list of rules that permit or deny traffic or access by criteria such as address, port or user. Firewalls and routers check rules top-down, first match wins, with an implicit deny at the end; NTFS permissions are also ACLs.Network+ · A+

AESAdvanced Encryption Standard

The symmetric block cipher that encrypts most data today, with 128-, 192- or 256-bit keys. It secures Wi-Fi under WPA2 and WPA3 (replacing the broken RC4 of WEP and TKIP), BitLocker, FileVault and TLS.A+

ALEAnnualized Loss Expectancy

The expected yearly loss from one risk: ALE = SLE × ARO. Use it to compare the cost of a control against the loss it prevents.Security+

APAccess Point

The device that lets wireless clients join a wired network, bridging Wi-Fi to Ethernet. Enterprise APs are often powered over PoE and managed by a controller; a rogue AP is one plugged in without authorization.Network+ · A+

APIApplication Programming Interface

The interface programs use to talk to each other. For an analyst, APIs are both an attack surface (broken authorization, excessive data exposure) and how tools such as SIEM, SOAR and threat intelligence platforms are wired together.CySA+ · Network+

APIPAAutomatic Private Internet Protocol Addressing

The fallback that gives a Windows host a self-assigned link-local address in 169.254.0.0/16 when no DHCP server answers. Seeing a 169.254.x.x address means the client could not reach DHCP; it can talk only on the local subnet.Network+ · A+

APTAdvanced Persistent Threat

A well-resourced, patient attacker, often state-sponsored, that gains access and stays hidden for a long time to steal data or prepare disruption.Security+ · CySA+

AROAnnualized Rate of Occurrence

How many times a year a given loss event is expected to happen. A flood every 10 years has an ARO of 0.1.Security+

ARPAddress Resolution Protocol

The protocol that finds the MAC address belonging to a known IPv4 address on the local network, caching the answer in the ARP table (arp -a). ARP has no authentication, so attackers can spoof replies to intercept traffic; dynamic ARP inspection on switches counters this.Network+

AUPAcceptable Use Policy

The policy users accept that states what they may and may not do with company systems, networks and data.Security+ · Network+ · A+

BECBusiness Email Compromise

A fraud where an attacker impersonates or takes over a business email account, typically an executive or supplier, to redirect payments or obtain sensitive data.Security+ · CySA+ · A+

BGPBorder Gateway Protocol

The path-vector routing protocol that connects autonomous systems and carries the internet's routing between ISPs. It runs over TCP port 179 and chooses routes by policy and AS path rather than simple metrics; inside one organization, OSPF or EIGRP is the usual choice.Network+

BIOSBasic Input/Output System

Legacy firmware that initializes hardware and starts the operating system. Modern systems use UEFI, which adds Secure Boot.Security+ · A+

BYODBring Your Own Device

A model where employees use personal devices for work. It raises questions of data separation, MDM enrolment and what the company may wipe.Security+ · Network+ · A+

CASBCloud Access Security Broker

A cloud access security broker sits between users and cloud services to see which apps are used and to enforce policy, such as data loss prevention and access control, on that traffic.CySA+

CDNContent Delivery Network

A geographically distributed set of servers that caches web content close to users to cut latency and offload the origin server. Many CDNs also absorb DDoS traffic and terminate TLS at the provider's edge.Network+

CIAConfidentiality, Integrity, and Availability

The three core security goals: confidentiality (only authorized people see data), integrity (data is not altered undetected) and availability (systems work when needed).Security+ · Network+

CIDRClassless Inter-domain Routing

The notation that writes a network's prefix length after a slash, such as 192.168.1.0/24, instead of a dotted subnet mask. It allows subnets of any size and lets routers aggregate many networks into one route (supernetting).Network+

CNAMECanonical Name

A DNS record that makes one name an alias for another, for example www.example.com pointing to example.com. The alias inherits the target's A/AAAA records; a domain's root (apex) cannot be a CNAME, and a name with a CNAME should carry no other records.Network+ · A+

CRLCertificate Revocation List

A list, published by a certificate authority, of certificates revoked before their expiry date. Clients download it to check a certificate is still trusted.Security+

CSPMCloud Security Posture Management

Tools that continuously check cloud accounts for misconfigurations, such as public storage buckets or overly broad permissions, against a security baseline.Security+

CSRCertificate Signing Request

The request sent to a certificate authority to obtain a certificate. It contains the public key and identity details and is signed with the matching private key, which never leaves the requester.Security+

CVECommon Vulnerabilities and Exposures

A public catalogue that gives each known vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.Security+

CVSSCommon Vulnerability Scoring System

A 0-10 scoring system for vulnerability severity based on factors such as attack vector, complexity, privileges needed and impact. Severity is not the same as your organization's risk.Security+ · CySA+

CWECommon Weakness Enumeration

A catalogue of software weakness types, such as SQL injection (CWE-89). A CVE is one specific flaw; a CWE is the category of mistake behind it.Security+

DASTDynamic Application Security Testing

Dynamic application security testing: scanning a running application from the outside, by sending crafted requests, to find flaws such as injection and misconfiguration. It needs no source code.CySA+

DDoSDistributed Denial of Service

A denial-of-service attack launched from many sources at once, often a botnet, so blocking a single address does not stop it.Security+ · Network+ · A+

DHCPDynamic Host Configuration Protocol

The protocol that automatically assigns IP addresses and network settings to devices. A rogue DHCP server can redirect traffic; DHCP snooping on switches blocks it.Security+ · Network+ · A+

DKIMDomainKeys Identified Mail

An email authentication method in which the sending domain signs messages with a private key and publishes the public key in DNS, so receivers can verify the message was not altered.Security+ · CySA+ · A+

DLPData Loss Prevention

Controls that detect and block sensitive data leaving where it should stay, for example via email, uploads or USB drives.Security+ · CySA+ · Network+ · A+

DMARCDomain-based Message Authentication, Reporting, and Conformance

An email policy published in DNS that tells receivers what to do (none, quarantine or reject) with messages that fail DMARC, meaning neither SPF nor DKIM passes in alignment with the visible From domain, and where to send reports.Security+ · CySA+ · A+

DNSDomain Name System

The system that translates names such as example.com into IP addresses. Attacks include cache poisoning and tunnelling; DNSSEC adds signed records.Security+ · CySA+ · Network+ · A+

DNSSECDomain Name System Security Extensions

Extensions that let DNS responses be digitally signed so resolvers can verify records were not forged or altered, defeating cache poisoning. It provides authenticity and integrity only; it does not encrypt queries, which is what DoT and DoH do.Network+

DoHDNS over Hypertext Transfer Protocol Secure

DNS queries carried inside HTTPS on TCP 443, so they are encrypted and blend in with web traffic. It protects user privacy but can bypass an organization's DNS filtering and logging, which is why many enterprises block or control it.Network+

DoSDenial of Service

An attack that makes a service unavailable by exhausting its bandwidth, connections or resources, or by crashing it.Security+ · A+

EDREndpoint Detection and Response

Endpoint software that records activity on hosts, detects suspicious behaviour and lets responders investigate and isolate a machine remotely.Security+ · CySA+ · A+

EOLEnd-of-life

The vendor's announcement that a product is no longer sold or developed. Devices past EOL may still work, but the next stage, end of support, means no more patches, and running them becomes a security and compliance risk.Network+ · A+

EPSSExploit Prediction Scoring System

The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days. Combined with CVSS severity, it helps decide what to patch first. CompTIA's list prints it as "Exploitability Predication Scoring System".CySA+

GDPRGeneral Data Protection Regulation

The European Union's data protection law, which governs how organizations anywhere handle EU residents' personal data: lawful basis, consent, breach notification within 72 hours, data subject rights and heavy fines. Network+ treats it as a key compliance driver for data handling and locality.Network+

GPTGUID Partition Table

The modern partition table that replaced MBR, supporting disks over 2 TB and up to 128 partitions in Windows, with a backup copy of the table for recovery. Booting from a GPT disk requires UEFI; legacy BIOS boot needs MBR.A+

HIDSHost-based Intrusion Detection System

Software on a single host that detects intrusions by watching its logs, files and processes, and alerts without blocking.Security+

HSMHardware Security Module

A tamper-resistant hardware device that generates, stores and uses cryptographic keys so they never leave it in plain form. Enterprises use HSMs for certificate authorities, code signing and payment systems; a TPM is the smaller, built-in equivalent for a single PC.A+

IaaSInfrastructure as a Service

The cloud model where the provider supplies virtual machines, storage and networking and you install, run and patch the operating systems and software yourself, as with Amazon EC2 or Azure VMs. It gives the most control of the three models but also the most responsibility.Network+ · A+

IaCInfrastructure as Code

Managing infrastructure through versioned configuration files instead of manual setup, so environments are repeatable and changes can be reviewed and scanned before deployment.Security+ · CySA+ · Network+

IAMIdentity and Access Management

Identity and access management: the processes and tools that create identities, authenticate them and control what they can access. Identity logs are a key source of indicators of compromise.CySA+ · Network+ · A+

ICMPInternet Control Message Protocol

The protocol that carries network diagnostics and error messages: ping uses echo request and reply, traceroute relies on time-exceeded replies, and routers send destination unreachable. Firewalls often block it, so a failed ping does not prove a host is down.Network+

ICSIndustrial Control System

Industrial control systems that run physical processes in plants and utilities. Availability and safety come first, so active scanning is often restricted.CySA+ · Network+

IDSIntrusion Detection System

A system that monitors traffic or activity and alerts on suspected attacks without blocking them. It is passive, usually fed by a copy of the traffic.Security+ · CySA+ · Network+

IKEInternet Key Exchange

The protocol that negotiates IPsec security associations and exchanges keys, in two phases, before ESP or AH traffic flows. It runs on UDP 500, with UDP 4500 for NAT traversal; IKEv2 is the current, simpler version.Network+

IoCIndicator of Compromise

An indicator of compromise: evidence that a system has been breached, such as a malicious hash, domain, IP address or unusual process.CySA+

IoTInternet of Things

Everyday devices with network connections: cameras, thermostats, smart speakers, light bulbs, locks. They often ship with default passwords and get few updates, so change credentials, keep firmware current and place them on a separate VLAN or guest network.Network+ · A+

IPInternet Protocol

The protocol that addresses and routes packets between networks. In logs and investigations, source and destination IP addresses are key evidence.Security+ · CySA+ · Network+ · A+

IPSIntrusion Prevention System

A system placed inline that inspects traffic and blocks attacks in real time. It is active, so a false positive can block legitimate traffic.Security+ · CySA+ · Network+

IPSecInternet Protocol Security

A suite that secures IP traffic at the network layer. AH provides integrity and authentication, ESP adds encryption; tunnel mode is used for site-to-site VPNs.Security+ · Network+

LANLocal Area Network

A network covering a limited area such as an office or a home, usually segmented further with VLANs.Security+ · Network+ · A+

LDAPLightweight Directory Access Protocol

A protocol for querying and changing directory services such as Active Directory. LDAPS protects it with TLS.Security+ · Network+ · A+

LLDPLink Layer Discovery Protocol

The vendor-neutral IEEE 802.1AB protocol by which devices advertise their identity, port and capabilities to directly connected neighbors; LLDP-MED adds VoIP details such as the voice VLAN. It replaces Cisco's CDP in mixed networks and helps map what is plugged in where.Network+

MBRMaster Boot Record

The legacy partition scheme and boot sector at the start of a disk. It is limited to 2 TB disks and four primary partitions (or three plus an extended one), and it is what legacy BIOS boots from; GPT with UEFI replaces it.A+

MDMMobile Device Management

Tools that enrol, configure and secure mobile devices centrally, for example by enforcing a screen lock, encryption and remote wipe.Security+ · CySA+ · A+

MFAMultifactor Authentication

Authentication with two or more different factor types, such as something you know, have or are. Two passwords are still one factor.Security+ · CySA+ · Network+ · A+

MOUMemorandum of Understanding

A memorandum of understanding: a usually non-binding statement of intent and common goals between two parties.Security+ · CySA+

MTBFMean Time Between Failures

The average operating time between failures of a repairable component. A higher MTBF means more reliable hardware.Security+ · Network+

MTTRMean Time to Repair

The average time needed to repair a failed component and restore service. A lower MTTR means faster recovery.Security+ · Network+

MTUMaximum Transmission Unit

The largest packet size a link can carry; Ethernet's default is 1500 bytes. Larger packets must be fragmented or dropped, so a tunnel that adds headers can cause slow or failed transfers until the MTU is lowered or jumbo frames (up to 9000 bytes) are enabled end to end.Network+

MXMail Exchange

The DNS record that names the mail server or servers responsible for a domain, each with a priority value where lower is preferred. Sending servers look up the MX record to deliver mail; a missing or wrong MX means inbound email bounces.Network+ · A+

NACNetwork Access Control

A system that checks who and what is connecting before granting network access, typically through 802.1X with a RADIUS server, and can inspect device posture (patches, antivirus). Non-compliant or unknown devices are denied or placed in a quarantine VLAN.Network+

NASNetwork-attached Storage

A dedicated storage appliance on the network that shares files over SMB or NFS, so many users and devices can reach the same folders. It works at the file level, unlike a SAN or iSCSI target that presents block storage; most include RAID and snapshots.Network+

NATNetwork Address Translation

Rewrites IP addresses in packet headers as traffic crosses a router, so many hosts with private (RFC 1918) addresses share one public address. It conserves IPv4 space and hides internal addressing, but it is not a security control on its own.Network+

NDANon-disclosure Agreement

A legal agreement that obliges the signer to keep specified information confidential.Security+ · A+

NFCNear-field Communication

Very short-range wireless communication used for contactless payments and badges. Its short range limits, but does not remove, skimming and relay attacks.Security+ · A+

NICNetwork Interface Card

The hardware that connects a device to a network. Each NIC has a MAC address.Security+ · Network+ · A+

NIDSNetwork-based Intrusion Detection System

A network-based intrusion detection system that analyses traffic on the segments where its sensors sit, usually from a SPAN port or tap, and alerts on suspected attacks without blocking them.Security+

NTFSNew Technology File System

The default Windows file system. It supports file and folder permissions, EFS encryption, compression, journaling and files larger than 4 GB, none of which FAT32 offers. Converting FAT32 to NTFS keeps the data; going back requires a reformat.A+

NTPNetwork Time Protocol

Synchronizes device clocks with a reference time source over UDP port 123, using stratum levels (stratum 0 is the atomic or GPS clock itself). Skewed clocks break Kerberos authentication, certificate validation and log correlation.Network+ · A+

NVMeNon-volatile Memory Express

A storage interface designed for flash: the SSD attaches over PCIe lanes, usually in the M.2 form factor, with far more command queues and lower latency than SATA. An M.2 slot can be SATA or NVMe, so check which the motherboard supports before buying.A+

OAuthOpen Authorization

An authorization framework that lets an app access resources on a user's behalf with a token, without receiving the user's password. On its own it is not an authentication protocol; OpenID Connect adds that.Security+

OCSPOnline Certificate Status Protocol

A protocol for checking one certificate's revocation status in real time, instead of downloading a whole CRL. OCSP stapling lets the server provide the answer.Security+

OSOperating System

The operating system: the core software that manages hardware and runs applications. Hardening, patching and secure configuration baselines apply to it.Security+ · Network+ · A+

OSIOpen Systems Interconnection

A seven-layer reference model for how network communication is divided: Physical, Data Link, Network, Transport, Session, Presentation, Application. Exams map devices and protocols to layers: switches at 2, routers at 3, TCP and UDP at 4, HTTP at 7.Network+

OSINTOpen-Source Intelligence

Open-source intelligence: information gathered from public sources, such as websites, social media, DNS and code repositories, about threats or about your own exposure.CySA+

OSPFOpen Shortest Path First

A link-state interior routing protocol: every router builds a complete map of its area and runs Dijkstra's algorithm to find the lowest-cost path, with cost based on bandwidth. It converges faster than RIP and scales through areas, with area 0 as the backbone.Network+

OTOperational Technology

Operational technology: systems that monitor and control physical processes, such as ICS and SCADA. Availability and safety usually come first, and patching is often limited.Security+ · CySA+ · Network+

OTPOne-time Password

A one-time password valid for a single login or a short time window, generated by an app or token (TOTP/HOTP) or sent by message.Security+ · A+

OWASPOpen Worldwide Application Security Project

The Open Worldwide Application Security Project (CompTIA's list uses the older name, Open Web Application Security Project). It publishes the OWASP Top 10 and SAMM, and was the original home of ZAP.CySA+

PaaSPlatform as a Service

A cloud model where the provider runs the servers, operating system and runtime, and you deploy only your application code and data. It sits between IaaS (you manage the OS) and SaaS (you manage only your data and users).Network+ · A+

PAMPrivileged Access Management

Privileged access management: controls for admin accounts, such as vaulting credentials, just-in-time access, session recording and approval workflows.CySA+ · A+

PATPort Address Translation

The form of NAT most home routers use: many internal hosts share one public IP, and the router tells return traffic apart by the source port it rewrote on the way out. Also called NAT overload or many-to-one NAT.Network+

PIIPersonally Identifiable Information

Personally identifiable information: data that identifies a person, such as name, address or ID numbers. A breach involving it can trigger legal notification duties.CySA+ · A+

PKIPublic Key Infrastructure

The system of certificate authorities, certificates, keys and policies that binds public keys to identities so they can be trusted.Security+ · CySA+ · Network+

PoEPower over Ethernet

Delivers DC power over the same twisted-pair cable as Ethernet data, so access points, IP phones and cameras need no separate outlet. Standards: 802.3af (15.4 W), 802.3at PoE+ (30 W), 802.3bt (60 or 100 W). Power comes from a PoE switch or an injector.Network+ · A+

PSKPre-shared Key

A secret shared in advance by both ends of a connection, such as the Wi-Fi passphrase in WPA2-Personal or the key for an IPsec tunnel. One key for everyone is easy to deploy but hard to revoke; enterprise networks use 802.1X instead.Network+

QoSQuality of Service

Techniques for prioritizing some traffic over the rest when a link is congested, so voice and video get low latency and jitter while bulk downloads wait. Marking uses DSCP in the IP header or CoS in the 802.1Q tag.Network+

RADIUSRemote Authentication Dial-in User Service

An AAA protocol that lets network devices such as wireless controllers, VPNs and switches check user credentials against a central server. UDP ports 1812 (authentication) and 1813 (accounting); it is the back end for WPA-Enterprise and 802.1X.Network+ · A+

RAIDRedundant Array of Independent Disks

Combining several drives into one logical volume for speed, redundancy or both. RAID 0 stripes with no redundancy, 1 mirrors, 5 stripes with parity (three drives minimum, survives one failure), 10 mirrors then stripes. RAID is not a backup.A+

RDPRemote Desktop Protocol

Microsoft's protocol for a remote graphical session on a Windows machine, on TCP port 3389. Never expose it directly to the internet: use a VPN or gateway, enable Network Level Authentication and restrict which accounts can connect.Network+ · A+

RFIDRadio Frequency Identification

Tags that reply with a stored identifier when energized by a reader's radio field, used in access badges, asset tracking and inventory. Passive tags need no battery. Badge cloning is a risk, so sensitive doors should use encrypted cards plus a PIN.Network+

RPORecovery Point Objective

The maximum acceptable data loss, measured in time. An RPO of 4 hours means backups must run at least every 4 hours.Security+ · Network+

RTORecovery Time Objective

The maximum acceptable time to restore a system after a disruption. It drives the choice of recovery site and method.Security+ · Network+

SaaSSoftware as a Service

Software as a service: complete applications delivered over the internet. The provider runs the stack; the customer still manages data, identities and access.Security+ · Network+ · A+

SAMLSecurity Assertion Markup Language

An XML-based standard for exchanging authentication assertions between an identity provider and a service provider. It is common for enterprise web SSO.Security+ · Network+ · A+

SANStorage Area Network

A dedicated high-speed network that gives servers block-level access to shared storage, so the storage appears as a local disk. It uses Fibre Channel or iSCSI; a NAS, by contrast, shares files over the regular network with SMB or NFS.Network+ · A+

SASESecure Access Service Edge

Secure access service edge: networking (SD-WAN) and security services (SWG, CASB, ZTNA, firewall) delivered together from the cloud, close to users.CySA+ · Network+

SASTStatic Application Security Testing

Static application security testing: analysing source code or binaries without running them to find flaws such as injection or hard-coded secrets. It runs early in development.CySA+

SBOMSoftware Bill of Materials

A software bill of materials: an inventory of the components and versions inside a piece of software, so you can tell quickly whether a newly disclosed vulnerability affects you.CySA+

SCADASupervisory Control and Data Acquisition

Supervisory control and data acquisition: systems that monitor and control industrial processes across sites, such as pipelines and power grids. They are a subset of ICS.CySA+ · Network+ · A+

SCAPSecurity Content Automation Protocol

A NIST suite of specifications for automating vulnerability and configuration checks in a standard, machine-readable way.Security+

SD-WANSoftware-defined Wide Area Network

Centrally managed software that connects branch sites over whatever links are available, such as broadband, LTE and MPLS, steering each application over the best path by policy. It cuts the cost of dedicated circuits and gives one console for all sites.Network+

SDNSoftware-Defined Networking

Software-defined networking separates the control plane from the data plane, so the network is configured centrally through software. That makes segmentation easier to automate.CySA+ · Network+

SIEMSecurity Information and Event Management

A system that collects and correlates logs and events from many sources to detect threats, alert and support investigations.Security+ · CySA+ · Network+

SLAService-level Agreement

A service-level agreement: a commitment with measurable targets, such as fixing critical vulnerabilities within 15 days. Vulnerability reports track compliance against it.CySA+ · Network+ · A+

SLAACStateless Address Autoconfiguration

How an IPv6 host addresses itself without a DHCP server: it takes the network prefix from a router advertisement, builds the interface ID itself and checks for duplicates. Router advertisements can also carry DNS servers (RDNSS); otherwise DHCPv6 supplies them.Network+

SLESingle Loss Expectancy

The monetary loss from a single occurrence of a risk event: SLE = asset value × exposure factor.Security+

SNMPSimple Network Management Protocol

A protocol for monitoring and managing network devices. Use SNMPv3, which adds authentication and encryption; v1 and v2c use plaintext community strings.Security+ · Network+

SOARSecurity Orchestration, Automation, and Response

Security orchestration, automation and response: a platform that runs playbooks to automate response steps across security tools.Security+ · CySA+

SOCSecurity Operations Center

Security operations center: the team, and often the facility, that monitors, detects and responds to security events. (SOC 2 is a separate audit report.)Security+

SOPStandard Operating Procedure

Standard operating procedure: step-by-step instructions for performing a routine task consistently and safely.Security+ · A+

SPFSender Policy Framework

An email authentication record in DNS listing which servers may send mail for a domain.Security+ · CySA+ · A+

SQLStructured Query Language

Structured Query Language, used to query databases. SQL injection inserts attacker input into queries; parameterized queries prevent it.Security+ · Network+ · A+

SSESecurity Service Edge

Security service edge: cloud-delivered security services such as SWG, CASB and ZTNA. Combined with SD-WAN networking, it forms SASE.Security+ · Network+

SSHSecure Shell

Encrypted remote command-line access and file transfer on TCP port 22, replacing Telnet, which sends everything in plain text. Key-based authentication is stronger than passwords; disable root login and limit who may connect.Network+ · A+

SSIDService Set Identifier

The name a wireless network broadcasts so clients can find and join it. Hiding the SSID is not a security measure, since it is easy to recover from client traffic; several SSIDs on one access point can map to separate VLANs for guests and staff.Network+ · A+

SSLSecure Sockets Layer

Secure Sockets Layer, the deprecated predecessor of TLS. Finding SSL or early TLS versions enabled is a common vulnerability scan result.CySA+ · Network+

SSOSingle Sign-on

Single sign-on: one authentication grants access to many applications. It is convenient, but it makes the identity provider a high-value target.Security+ · CySA+ · Network+ · A+

TCPTransmission Control Protocol

Transmission Control Protocol: connection-oriented transport using the SYN, SYN-ACK, ACK handshake. Flags and ports in TCP traffic are key evidence in network analysis.CySA+ · Network+ · A+

TLSTransport Layer Security

Transport Layer Security, the protocol that encrypts and authenticates data in transit, for example in HTTPS. It replaced SSL.Security+

TOTPTime-based One-time Password

A one-time code generated from a shared secret and the current time, usually changing every 30 seconds, by apps such as Google Authenticator or Microsoft Authenticator. Stronger than SMS codes, but device clocks must be in sync for codes to validate.A+

TPMTrusted Platform Module

A security chip, or firmware equivalent, that stores encryption keys and measures the boot process. BitLocker uses it to unlock the drive only when the boot chain is unchanged; Windows 11 requires TPM 2.0. Clearing the TPM destroys the keys it holds.A+

TTLTime to Live

A hop counter in the IP header that each router decrements; at zero the packet is discarded, which prevents endless loops. In DNS, TTL is instead how many seconds a resolver may cache a record before asking again.Network+

UACUser Account Control

The Windows feature that runs even administrators with standard rights and prompts for consent or credentials before a program can make system-wide changes. Leave it on; the secure desktop prompt stops malware from silently elevating.A+

UDPUser Datagram Protocol

A connectionless transport protocol that sends datagrams without handshakes, acknowledgments or retransmission, so it is fast but unreliable. Used where speed matters more than every packet: DNS, DHCP, VoIP, streaming and TFTP.Network+ · A+

UEBAUser and Entity Behavior Analytics

User and entity behavior analytics: baselining the normal behaviour of users and devices and alerting on deviations, such as unusual logon times or data volumes. CompTIA's list prints it as "User and Entity Behavior Analysis".CySA+

UEFIUnified Extensible Firmware Interface

The modern firmware that replaced BIOS, with a graphical setup, support for drives larger than 2 TB through GPT partitioning, and Secure Boot, which refuses to load unsigned boot code. UEFI boots from GPT disks; legacy BIOS mode boots from MBR.A+

UPSUninterruptible Power Supply

An uninterruptible power supply: a battery unit that keeps equipment running through short outages and allows a clean shutdown or a generator start.Security+ · Network+ · A+

USBUniversal Serial Bus

The standard port for peripherals and storage. Removable media can spread malware and carry data out, so it is often restricted by policy or DLP.Security+ · Network+ · A+

UTMUnified Threat Management

Unified threat management: a single appliance combining firewall, IPS, antivirus, web filtering and VPN. It is simple to run but is a single point of failure.Security+ · CySA+ · Network+ · A+

VDIVirtual Desktop Infrastructure

Hosting users' desktops as virtual machines in a data center or cloud and streaming the screen to thin clients or any device. It simplifies patching and keeps data off endpoints, but depends entirely on network connectivity and server capacity.A+

VLANVirtual Local Area Network

Splits one physical switch into separate logical networks, each its own broadcast domain, so traffic is isolated by department or device type without extra hardware. Traffic between VLANs needs a router or Layer 3 switch; 802.1Q tags carry several VLANs over a trunk.Network+ · A+

VNCVirtual Network Computing

A remote desktop protocol. When it is exposed or weakly configured, it is a remote access threat vector.Security+ · A+

VoIPVoice over Internet Protocol

Carrying phone calls as IP packets instead of over circuit-switched lines. Calls are set up with SIP and the voice travels in RTP; they are sensitive to latency and jitter, so QoS and often a separate voice VLAN are standard.Network+ · A+

VPNVirtual Private Network

An encrypted tunnel over an untrusted network that connects remote users or sites to a private network. It is commonly built with IPSec or TLS.Security+ · Network+ · A+

VXLANVirtual Extensible LAN

Encapsulates Layer 2 frames inside UDP (port 4789) so a virtual segment can stretch across routed data center networks. Its 24-bit identifier allows about 16 million segments, against 4,094 usable 802.1Q VLANs. Common in cloud and virtualized environments.Network+

WAFWeb Application Firewall

A web application firewall: it inspects HTTP traffic to block web attacks such as SQL injection and XSS in front of an application.Security+

WANWide Area Network

A network that spans large distances and links separate sites, usually over carrier circuits or the internet. The exam contrasts it with a LAN (one site) and a MAN (one city); the router's WAN port faces the ISP.Network+ · A+

WPAWi-Fi Protected Access

The family of Wi-Fi security standards. Original WPA with TKIP was a stopgap after WEP and is now weak; WPA2 brought AES-CCMP; WPA3 adds SAE to resist offline password cracking. Personal uses a shared passphrase, Enterprise authenticates each user via RADIUS.Network+ · A+

WPSWi-Fi Protected Setup

A convenience feature that joins a device to Wi-Fi with a button press or an eight-digit PIN instead of the passphrase. The PIN method can be brute-forced in hours because it is validated in two halves, so WPS should be disabled.Network+

XDRExtended Detection and Response

Extended detection and response: it correlates telemetry from endpoints, network, cloud and email to detect and respond across all of them, beyond endpoint-only EDR.Security+ · CySA+ · A+

XSSCross-site Scripting

A web attack where malicious script is injected into a page that other users view, letting the attacker steal session cookies or act as the victim inside the browser. The fix is for the site to validate input and encode output; users should keep browsers patched.A+

ZTNAZero Trust Network Access

Zero trust network access: grants access to individual applications after verifying user and device, instead of placing the user on the whole network as a VPN does.CySA+