Security+ SY0-701 Acronyms, Grouped by What They Actually Do
CompTIA publishes 322 acronyms in Appendix A of the SY0-701 objectives. Almost every list online reproduces them alphabetically, expansion only, which is close to useless: you are never asked what SAML stands for. You are asked which technology federates identity between two organisations, and the answer happens to be spelled SAML.
So this list is grouped by job, with a line on what each one actually does and, where it matters, what it gets confused with. If you know the function, the expansion comes free. The reverse almost never works.
How to use this. Do not read it start to finish. Find the group covering whatever you are studying this week, and check you can say what each entry does without reading the third column. The ones you cannot are your revision list. For the complete 322, CompTIA's own objectives PDF is the authoritative source and it is free.
Your free Security+ exam code
Knowing the acronym is not the same as answering the question
The exam gives you scenarios, not definitions. A full-length SY0-701 practice exam shows you whether the recognition actually converts under pressure - with an explanation on every item and a coach that names your weak domains. The code applies itself when you create the account.
SECPLUS-EXAM-FULL
Redeem the code
Free, no credit card. Already have an account? Log in to start
The confusable pairs - learn these first
If you only drill one section, make it this one. These are the distinctions the exam builds whole questions around.
| Pair | The distinction |
|---|---|
| SIEM vs SOAR | SIEM collects and correlates logs so a human can see. SOAR acts on the alerts automatically via playbooks. SIEM tells you; SOAR does something. |
| IDS vs IPS | Detection alerts and sits out of band. Prevention sits inline and can drop. If the question says "block", it is IPS. |
| DAC vs MAC | Discretionary: the owner decides who gets access. Mandatory: the system decides from labels and clearances, and the owner cannot override. |
| RTO vs RPO | RTO is time - how fast must it be back. RPO is data - how much loss is acceptable. RPO drives backup frequency. |
| MTBF vs MTTR | Between failures (reliability) vs to repair (recoverability). MTBF is a prediction; MTTR is a response commitment. |
| TOTP vs HOTP | Time-based codes expire on a clock. HMAC-based codes advance on a counter and stay valid until used. |
| OAuth vs OIDC | OAuth is authorisation - delegated access to a resource. OIDC adds authentication on top of OAuth 2.0. Treating OAuth as a login protocol is the classic error. |
| SAML vs OIDC | Both federate identity. SAML is XML and enterprise-typical; OIDC is JSON/REST and dominates modern consumer and mobile flows. |
| CSR vs certificate vs CRL | Request → issued credential → revocation list. Three stages of one lifecycle, routinely mixed up. |
| Hashing vs encryption | Hashing is one-way and proves integrity. Encryption is reversible and provides confidentiality. A hash is not "encrypted". |
Cryptography and PKI
| Acronym | Expansion | What it does |
|---|---|---|
| AES | Advanced Encryption Standard | The symmetric block cipher you should assume by default. 128/192/256-bit keys. |
| DES / 3DES | (Triple) Data Encryption Standard | Legacy symmetric ciphers. Both deprecated - if they appear as an option, that is usually the wrong answer. |
| RSA | Rivest-Shamir-Adleman | Asymmetric algorithm for key exchange and digital signatures. Slow, so used to protect symmetric keys rather than bulk data. |
| ECC / ECDSA / ECDHE | Elliptic Curve Cryptography / …DSA / Ephemeral Diffie-Hellman | Same security as RSA at much smaller key sizes - hence mobile and IoT. ECDHE additionally gives perfect forward secrecy. |
| DH / DHE | Diffie-Hellman (Ephemeral) | Key agreement, not encryption. The ephemeral variant is what delivers PFS. |
| PFS | Perfect Forward Secrecy | Compromising the long-term key does not decrypt past sessions, because session keys were ephemeral. |
| SHA | Secure Hash Algorithm | Integrity. SHA-256 and above are current; SHA-1 is broken for collision resistance. |
| MD5 | Message Digest 5 | Broken hash. Still appears for non-security checksums; never a valid answer for integrity assurance. |
| HMAC | Hash-based Message Authentication Code | A hash plus a shared secret - proves integrity and authenticity, which a bare hash cannot. |
| PKI | Public Key Infrastructure | The whole trust system: CAs, certificates, revocation, policy. |
| CA / RA | Certificate / Registration Authority | The CA issues and signs. The RA verifies identity before the CA issues. |
| CSR | Certificate Signing Request | What you send a CA - contains the public key and identity, never the private key. |
| CRL / OCSP | Certificate Revocation List / Online Certificate Status Protocol | Two ways to check revocation. CRL is a downloaded list; OCSP queries live. OCSP stapling has the server present the proof. |
| SAN | Subject Alternative Name | Additional names a certificate is valid for. (Also Storage Area Network - context decides.) |
| PEM / DER / PFX / P12 | Certificate encodings | Container formats. PEM is Base64 text; DER is binary; PFX/P12 can bundle the private key. |
| KEK / DEK | Key Encryption Key / Data Encryption Key | The DEK encrypts data; the KEK encrypts the DEK. Rotating the KEK avoids re-encrypting everything. |
| HSM | Hardware Security Module | Tamper-resistant hardware that generates and stores keys so they never exist in software. |
| TPM | Trusted Platform Module | On-board chip storing keys for that machine - underpins full-disk encryption and secure boot. |
| FDE / SED | Full Disk Encryption / Self-Encrypting Drive | Encryption at rest in software vs built into the drive controller. |
Identity, authentication and access control
| Acronym | Expansion | What it does |
|---|---|---|
| AAA | Authentication, Authorization, Accounting | Who are you, what may you do, what did you do. The frame the whole domain hangs on. |
| MFA / 2FA | Multi-/Two-Factor Authentication | Two or more different factor types. Two passwords is not MFA. |
| SSO | Single Sign-On | Authenticate once, access many services. Convenience with a concentrated risk. |
| SAML | Security Assertion Markup Language | XML-based federation - the enterprise SSO standard for web apps. |
| OIDC | OpenID Connect | Authentication layer on top of OAuth 2.0. The modern "sign in with…" flow. |
| LDAP / LDAPS | Lightweight Directory Access Protocol (Secure) | Directory queries. 389 plaintext, 636 over TLS. |
| RADIUS | Remote Authentication Dial-In User Service | AAA over UDP; encrypts only the password. Cross-vendor, common for wireless and VPN. |
| TACACS+ | Terminal Access Controller Access-Control System Plus | Cisco's AAA over TCP; encrypts the whole payload and separates authorisation from authentication. |
| Kerberos | (not an acronym) | Ticket-based authentication using a KDC. Time-sensitive - clock skew breaks it, a favourite exam detail. |
| KDC / TGT | Key Distribution Center / Ticket Granting Ticket | The Kerberos authority, and the ticket that gets you further tickets. |
| RBAC | Role-Based Access Control | Permissions attach to roles, users get roles. Scales where per-user permissions do not. |
| ABAC | Attribute-Based Access Control | Decisions from attributes - department, device, location, time. The most granular model. |
| DAC / MAC | Discretionary / Mandatory Access Control | Owner decides vs system decides from labels. MAC is the government/military model. |
| PAM | Privileged Access Management | Controls and records the use of admin accounts - checkout, session recording, rotation. |
| IdP / SP | Identity Provider / Service Provider | Who vouches for you, and who relies on that vouching. The two halves of federation. |
| TOTP / HOTP | Time- / HMAC-based One-Time Password | Clock-driven vs counter-driven codes. |
| CHAP / PAP / EAP | Challenge-Handshake / Password / Extensible Authentication Protocol | PAP sends plaintext (never the answer). CHAP challenges. EAP is a framework with many methods. |
| PEAP / EAP-TLS | Protected EAP / EAP-Transport Layer Security | PEAP wraps EAP in TLS with a server certificate. EAP-TLS needs certificates on both sides - the strongest and the most work. |
| JIT | Just-in-Time (access) | Privileges granted only for the window they are needed, then removed. |
Network security and infrastructure
| Acronym | Expansion | What it does |
|---|---|---|
| NGFW | Next-Generation Firewall | Application-aware filtering, not just ports - plus identity and inspection. |
| WAF | Web Application Firewall | Filters HTTP specifically - the control for SQL injection and XSS. |
| UTM | Unified Threat Management | Firewall, IPS, AV, filtering in one box. Convenient, and a single point of failure. |
| IDS / IPS / NIDS / HIDS | Intrusion Detection / Prevention (Network / Host) | Detect vs block; on the wire vs on the endpoint. |
| NAC | Network Access Control | Checks posture before admitting a device. Pairs with 802.1X. |
| 802.1X | Port-based Network Access Control | Authenticate before the port forwards traffic. Supplicant, authenticator, authentication server. |
| VLAN | Virtual LAN | Logical segmentation. Limits broadcast domains and lateral movement. |
| DMZ | Demilitarized Zone (screened subnet) | Where public-facing services live so a compromise does not land inside. |
| VPN / IPSec | Virtual Private Network / IP Security | Encrypted tunnel. IPsec has AH (integrity only) and ESP (encryption) - ESP is what you want. |
| IKE | Internet Key Exchange | Negotiates the IPsec security association. UDP 500. |
| SASE / ZTNA | Secure Access Service Edge / Zero Trust Network Access | Cloud-delivered security at the edge; per-application access with no implicit trust from being "inside". |
| DLP | Data Loss Prevention | Detects and blocks sensitive data leaving - email, USB, upload. |
| CASB | Cloud Access Security Broker | Policy enforcement point between users and cloud services. Finds shadow IT. |
| SDN | Software-Defined Networking | Control plane separated from data plane and centrally programmed. |
| DNSSEC | DNS Security Extensions | Signs DNS records - authenticity, not confidentiality. Does not encrypt the query. |
| DoH / DoT | DNS over HTTPS / over TLS | These do the confidentiality part DNSSEC does not. |
| SPF / DKIM / DMARC | Sender Policy Framework / DomainKeys Identified Mail / Domain-based Message Authentication | The email anti-spoofing trio: who may send, signed proof, and what to do on failure. Expect a question on all three. |
Attacks and threats
| Acronym | Expansion | What it does |
|---|---|---|
| DoS / DDoS | (Distributed) Denial of Service | Exhausts a resource. Distributed means many sources, usually a botnet. |
| MITM / on-path | Man-in-the-Middle | Attacker relays and can alter traffic. CompTIA now prefers "on-path". |
| XSS | Cross-Site Scripting | Injects script into a page other users load. Stored, reflected, DOM-based. |
| CSRF / XSRF | Cross-Site Request Forgery | Rides an authenticated session to make the browser act. Anti-CSRF tokens are the control. |
| SQLi | SQL Injection | Database syntax in user input. Parameterised queries are the fix - not input validation alone. |
| RCE | Remote Code Execution | Attacker runs code on the target. Usually the most severe outcome available. |
| APT | Advanced Persistent Threat | Well-resourced actor prioritising long-term stealthy access, typically nation-state. |
| C2 / C&C | Command and Control | The channel compromised hosts call home on. Beaconing regularity is the detection. |
| IoC | Indicator of Compromise | Evidence of a breach - a hash, a domain, a registry key. |
| TTP | Tactics, Techniques and Procedures | How an actor operates. Harder to change than an IoC, so better for attribution. |
| PUP | Potentially Unwanted Program | Not quite malware - adware, bundled toolbars. |
| RAT | Remote Access Trojan | Malware giving interactive remote control. |
| ARP poisoning | Address Resolution Protocol | Forged ARP replies redirect traffic. Enables on-path attacks on a LAN. DAI is the control. |
| OSINT | Open-Source Intelligence | Reconnaissance from public sources - the first phase of most engagements. |
Operations, monitoring and response
| Acronym | Expansion | What it does |
|---|---|---|
| SIEM | Security Information and Event Management | Aggregates and correlates logs; alerts humans. |
| SOAR | Security Orchestration, Automation and Response | Runs automated playbooks on those alerts. |
| SOC | Security Operations Center | The team and function doing the monitoring. |
| EDR / XDR / MDR | Endpoint / Extended / Managed Detection and Response | Endpoint telemetry with response; extended across more sources; managed by a third party. |
| UEBA | User and Entity Behavior Analytics | Baselines normal behaviour and flags deviation - catches valid-credential misuse. |
| IR | Incident Response | Preparation → identification → containment → eradication → recovery → lessons learned. Know the order. |
| CVE / CVSS | Common Vulnerabilities and Exposures / Scoring System | The identifier, and the 0-10 severity score attached to it. |
| SCAP | Security Content Automation Protocol | Standard formats so scanners and configuration tools interoperate. |
| MTTD / MTTR | Mean Time to Detect / Respond (or Repair) | The two headline SOC metrics. |
| SLA / MOU / MSA / BPA / NDA | Service Level Agreement / Memorandum of Understanding / Master Service Agreement / Business Partners Agreement / Non-Disclosure Agreement | The third-party agreement family. Only the SLA carries enforceable performance commitments; an MOU generally does not. |
| RA / SOW | Risk Assessment / Statement of Work | What could go wrong, and precisely what a vendor will deliver. |
Governance, risk and continuity
| Acronym | Expansion | What it does |
|---|---|---|
| GRC | Governance, Risk and Compliance | The umbrella for policy, risk management and regulation. |
| BIA | Business Impact Analysis | Identifies critical processes and what an outage costs. Produces RTO and RPO - it comes first. |
| RTO / RPO | Recovery Time / Point Objective | How fast back vs how much data loss is tolerable. |
| MTBF / MTTF | Mean Time Between / To Failure | Repairable systems vs things replaced on failure. |
| BCP / DRP | Business Continuity / Disaster Recovery Plan | Keep the business running vs restore the technology. BCP is broader and contains DRP. |
| SLE / ALE / ARO | Single Loss Expectancy / Annualized Loss Expectancy / Annualized Rate of Occurrence | Quantitative risk: SLE = AV × EF, ALE = SLE × ARO. Worked examples here. |
| AV / EF | Asset Value / Exposure Factor | What it is worth, and the proportion lost in one event. |
| PII / PHI / SPI | Personally Identifiable / Protected Health / Sensitive Personal Information | Data categories driving regulatory obligations. |
| GDPR / HIPAA / PCI DSS / SOX | Regulations and standards | EU privacy, US healthcare, payment cards, financial reporting. Know which applies to which data. |
| NIST / ISO / CIS | Standards bodies and benchmarks | NIST CSF and 800-series, ISO 27001, CIS Controls and Benchmarks. |
| RPO vs MTD | Maximum Tolerable Downtime | MTD is the absolute ceiling; RTO must be shorter than it. |
Cloud, virtualization and applications
| Acronym | Expansion | What it does |
|---|---|---|
| IaaS / PaaS / SaaS | Infrastructure / Platform / Software as a Service | The service models - and the shared responsibility boundary moves with each. |
| IaC | Infrastructure as Code | Provisioning from version-controlled definitions. Repeatable, reviewable, and a new place for secrets to leak. |
| CI/CD | Continuous Integration / Continuous Deployment | Automated build and release pipeline - and a high-value supply-chain target. |
| SDLC | Software Development Life Cycle | Requirements → design → build → test → deploy → maintain, with security at each stage. |
| SAST / DAST | Static / Dynamic Application Security Testing | Analyse source without running it vs test the running application. Static finds it earlier; dynamic finds runtime issues. |
| SBOM | Software Bill of Materials | Inventory of components in a build - how you answer "are we affected?" after a library CVE. |
| API | Application Programming Interface | Machine interface. Needs authentication, rate limiting and input validation like any other entry point. |
| VDI | Virtual Desktop Infrastructure | Desktops hosted centrally; data never lands on the endpoint. |
| VM escape | Virtual Machine | Breaking out of a guest to the hypervisor - the worst-case virtualization failure. |
| MDM / COPE / BYOD / CYOD | Mobile Device Management / Corporate-Owned Personally Enabled / Bring or Choose Your Own Device | How mobile devices are owned and controlled. BYOD is cheapest and hardest to secure. |
| SCADA / ICS / OT | Supervisory Control and Data Acquisition / Industrial Control Systems / Operational Technology | Industrial systems, where availability and safety outrank confidentiality - which inverts the usual advice. |
Your free Security+ exam code
Test the recognition, not the recall
The exam gives you a scenario and four plausible acronyms. A full-length SY0-701 practice exam tells you which groups above you actually know and which you only recognise - one-time purchase, lifetime access, and the first exam is free.
SECPLUS-EXAM-FULL
Redeem the code
Free, no credit card. Already have an account? Log in to start
Frequently asked questions
How many acronyms are on the Security+ SY0-701 exam?
CompTIA lists 322 in Appendix A of the official objectives. You will not be asked to expand all of them - the exam tests what the technology does, with the acronym simply being how it is named. Around eighty carry most of the weight, and they are the ones grouped above.
Do I need to memorise every acronym?
No, and it is a poor use of study time. Nobody is asked what SAML stands for; they are asked which technology federates identity between organisations. Learn the function and the expansion follows.
What is the difference between SIEM and SOAR?
SIEM collects and correlates logs so a human can see what happened. SOAR takes those alerts and runs an automated playbook - isolate the host, disable the account, open the ticket. SIEM tells you; SOAR acts.
What is the difference between SAML, OAuth and OIDC?
SAML is XML-based federation, typical for enterprise SSO. OAuth is authorisation - delegated access to a resource, not a login mechanism. OIDC sits on OAuth 2.0 and adds authentication. Treating OAuth as a login protocol is the standard trap.
Where can I get the official full list?
CompTIA publishes all 322 in Appendix A of the SY0-701 exam objectives, free from their website. Use it as the checklist and this page as the explanation - a bare list of expansions will not, on its own, answer a scenario question.