Security+ SY0-801 acronym trainer

How the trainer works

Flashcards show the acronym first. Say what it stands for and what it does, then check. “Knew it” takes the card out of the round; “Still learning” sends it to the back, so the round ends only when you've recalled every card once.

Quiz gives four spelled-out answers. The wrong ones come from acronyms that start with the same letter where it can, so you have to know the whole name, not just the first word.

Switch to New in V8 if you studied for SY0-701: those 32 are the ones you haven't seen on the list before. The SY0-701 vs SY0-801 guide covers what else changed.

All 106 SY0-801 acronyms

In the order CompTIA lists them. Each meaning is a one-line summary in our own words.

AAA

Authentication, Authorization, and Accounting

Proves who a user is, decides what they may access, and records what they did. RADIUS and TACACS+ provide it centrally.

AI

Artificial Intelligence

Systems that learn patterns from data. The exam treats AI as a defender's tool and as an attack surface open to poisoning.

ALE

Annualized Loss Expectancy

The expected yearly loss from one risk: ALE = SLE × ARO. A control pays off when it cuts ALE by more than it costs a year.

AML/CTFNew

Anti-money Laundering/Counter-terrorism Financing

Laws requiring covered businesses to know their customers, monitor transactions and report suspicious activity. A compliance training topic.

APT

Advanced Persistent Threat

A skilled, well-funded attacker, often a nation-state, that gets in quietly and stays hidden for months to spy or steal data.

ARO

Annualized Rate of Occurrence

How many times a year a risk is expected to occur, such as 0.5 for once every two years. Multiply SLE by ARO to get ALE.

AUP

Acceptable Use Policy

The rules users agree to for company systems, networks and data. Usually signed at onboarding and enforced with HR.

BECNew

Business Email Compromise

Fraud using a compromised or spoofed executive or vendor mailbox to request wire transfers or new bank details.

BIMINew

Brand Indicators for Message Identification

Displays a brand's verified logo beside its mail in supporting inboxes. It only works for domains enforcing DMARC (quarantine or reject).

BIOS

Basic Input/Output System

Legacy firmware that starts a PC before the OS loads. Firmware rootkits target it; UEFI with Secure Boot replaces it.

BYOD

Bring Your Own Device

A policy letting staff use personal devices for work. MDM or containerization keeps work data separate and wipeable.

CABNew

Change Advisory Board

Reviews change requests and approves or rejects them after weighing risk, impact, timing and the backout plan.

CAPTCHA

Completely Automated Public Turing test to tell Computers and Humans Apart

Stops bots from automated logins and sign-ups. Fake CAPTCHA pages are a lure that tricks users into running malicious commands.

CI/CDNew

Continuous Integration and Continuous Deployment

An automated pipeline that builds, tests and deploys code on every change. Security scans in it catch flaws before release.

CIA

Confidentiality, Integrity, and Availability

The three goals every control serves: keep data secret, keep it accurate and unaltered, and keep it available when needed.

CRL

Certificate Revocation List

A CA's published list of certificates revoked before expiry, such as for a stolen key. OCSP is the real-time alternative.

CSPMNew

Cloud Security Posture Management

Continuously checks cloud accounts against security rules to catch misconfigurations such as public storage buckets.

CSR

Certificate Signing Request

Sent to a CA to request a certificate. It holds the public key and identity details; the private key stays with the requester.

CVE

Common Vulnerabilities and Exposures

A public catalog giving each known vulnerability a unique ID, such as CVE-2021-44228 (Log4Shell).

CVSS

Common Vulnerability Scoring System

Rates a vulnerability's severity from 0.0 to 10.0, with 9.0 and up critical. It measures severity, not your actual risk.

CWENew

Common Weakness Enumeration

A catalog of software weakness types, such as CWE-79 for cross-site scripting. CWE names a flaw type; CVE names one instance.

DDoS

Distributed Denial of Service

A denial-of-service attack from many sources at once, often a botnet, so blocking a single IP address doesn't stop it.

DoS

Denial of Service

An attack that makes a service unavailable by flooding or crashing it. It targets availability in the CIA triad.

DHCP

Dynamic Host Configuration Protocol

Assigns IP settings automatically over UDP 67 and 68. A rogue DHCP server can redirect traffic; DHCP snooping blocks it.

DKIM

DomainKeys Identified Mail

Signs outgoing mail with a key published in DNS so receivers can verify the domain and that the message wasn't altered.

DLP

Data Loss Prevention

Finds sensitive data such as card numbers in email, uploads, endpoints and cloud storage, then blocks or alerts on its movement.

DMARC

Domain-based Message Authentication, Reporting, and Conformance

Sets the policy (none, quarantine or reject) for mail that passes neither aligned SPF nor DKIM, and has receivers report back.

DNS

Domain Name System

Resolves names to IP addresses on port 53, UDP and TCP. Attacked by cache poisoning and hijacking; DNSSEC signs records.

EDR

Endpoint Detection and Response

An agent on each endpoint that records activity, detects malicious behavior and lets responders isolate the host remotely.

EOINew

Expression of Interest

A buyer's early call asking which suppliers want to take part in a planned project and are qualified to. It precedes an RFP.

GBICNew

Gigabit Interface Converter

An older hot-swappable transceiver that connects a switch port to fiber or copper links. The smaller SFP has replaced it.

gMSANew

Group Managed Service Account

An Active Directory service account whose long random password the domain rotates automatically, every 30 days by default.

HIDS

Host-based Intrusion Detection System

Software on a single host that watches its logs, files and processes for attack signs and raises alerts without blocking.

HIPS

Host-based Intrusion Prevention System

Software on a single host that detects attacks and actively blocks them, such as killing a process that injects code.

HRNew

Human Resources

Owns hiring and termination, so it triggers provisioning and offboarding. A key stakeholder in insider-threat investigations.

IaC

Infrastructure as Code

Defines servers, networks and cloud resources in code templates, so builds are repeatable and scannable before deployment.

IDS

Intrusion Detection System

Monitors traffic or activity and alerts on attacks without blocking them, often fed a copy of traffic from a SPAN port or tap.

IP

Internet Protocol

Addresses and routes packets between networks. Source addresses can be spoofed, so an IP alone is weak proof of identity.

IPFIXNew

Internet Protocol Flow Information Export

The IETF standard for exporting flow records (who talked to whom, when and how much) to a collector. It carries no payload content.

IPS

Intrusion Prevention System

Sits inline and blocks malicious traffic as well as alerting. Because it is inline, a false positive blocks legitimate traffic.

IPSec

Internet Protocol Security

Authenticates and encrypts IP packets for site-to-site and remote-access VPNs. AH only authenticates; ESP also encrypts.

LAN

Local Area Network

A network within one site, such as an office. An attacker inside can sniff, spoof ARP and move laterally, so segment it.

LDAP

Lightweight Directory Access Protocol

Queries and updates directories such as Active Directory on TCP 389. Simple binds can expose passwords; LDAPS uses TCP 636.

LLMNew

Large Language Model

An AI model trained on huge amounts of text to generate language. An attack surface for prompt injection and data leakage.

LMSNew

Learning Management System

A platform that assigns and tracks training such as security awareness courses, recording completions and quiz scores.

MDM

Mobile Device Management

Centrally enrolls and manages phones and tablets: enforces passcodes and encryption, pushes apps, and remotely wipes them.

MFA

Multifactor Authentication

Requires two or more different factor types, such as a password plus an authenticator app. Two passwords are still one factor.

MOA

Memorandum of Agreement

Sets out each party's specific responsibilities and the conditions they agree to. More formal and binding than an MOU.

MOU

Memorandum of Understanding

Records the shared intent of two parties and how they plan to cooperate. Usually not binding; an MOA spells out duties.

MSA

Master Service Agreement

The umbrella contract setting general terms such as liability, confidentiality and security duties. SOWs sit under it.

MTBF

Mean Time Between Failures

The average time a repairable component runs between failures. Higher is better; it predicts reliability and spares needs.

MTTR

Mean Time to Repair

The average time to fix a failed component and return it to service. Lower is better; spare parts on site shorten it.

NDA

Non-disclosure Agreement

Obliges the receiving party to keep defined information confidential. Usually the first document signed with a vendor.

NFC

Near-field Communication

Wireless that works within a few centimeters, used for tap-to-pay and badges. Risks include skimming and relay attacks.

NICNew

Network Interface Card

The hardware that connects a device to a network. Its MAC address identifies the device for NAC, but MACs can be spoofed.

NIDS

Network-based Intrusion Detection System

A sensor that watches network traffic, usually from a SPAN port or tap, and alerts on attacks without blocking them.

NIPS

Network-based Intrusion Prevention System

Sits inline at a network chokepoint and drops malicious traffic in real time. Fail-open or fail-closed decides what an outage does.

NVDNew

National Vulnerability Database

NIST's database that enriches each CVE with a CVSS score, affected products and the weakness type (CWE).

OAuth

Open Authorization

Grants an app limited access to a user's data elsewhere through tokens, without sharing the password. OpenID Connect adds sign-in.

OCSP

Online Certificate Status Protocol

Lets a client ask the CA in real time whether one certificate is revoked. With stapling, the server attaches the answer.

OS

Operating System

The software that runs a device and its apps. Unpatched or unsupported operating systems are a top vulnerability.

OT

Operational Technology

Systems that control physical processes, such as ICS and SCADA. Availability and safety come first, so patching is hard.

OTPNew

One-time Password

A code valid for a single login, from an app, hardware token or SMS. It defeats password reuse but can be phished live.

PDFNew

Portable Document Formats

A common attachment that can carry malicious links, JavaScript or reader exploits. Patch readers and sandbox untrusted files.

PIRNew

Post-incident Reporting

The written record of an incident and the response: timeline, root cause, impact and dated actions. It may be read in court.

PKI

Public Key Infrastructure

The CAs, certificates, keys and policies that bind public keys to identities, so users can trust TLS sites and signed code.

QRNew

Quick Response

A 2D barcode a phone turns into a link. Fake codes stuck over real ones or sent in email hide phishing URLs (quishing).

RCSNew

Rich Communication Services

The modern successor to SMS with media and branded senders. Like SMS, it carries smishing links and fake brand messages.

RFNew

Radio Frequency

Radio signals used by wireless devices. Attackers eavesdrop on, jam or replay them, such as cloning fixed-code key fobs.

RFCNew

Request for Comments

In change management, the formal request saying what will change, why, on which systems and when. It starts CAB review.

RFINew

Request for Information

An exploratory request asking vendors to describe products, capabilities and rough pricing. It commits no one to buy.

RFPNew

Request for Proposal

A formal request for detailed vendor proposals against stated requirements, including security controls, scored on criteria.

RFQNew

Request for Quote

Asks vendors for price, delivery and terms when the requirement is already fully specified, such as 400 identical laptops.

ROI

Return on Investment

The financial return on an investment versus its cost. For a security control, the loss it prevents compared with its cost.

RPO

Recovery Point Objective

The most data, measured in time, the business can afford to lose. A 15-minute RPO needs backups at least every 15 minutes.

RPSNew

Redundant Power Supply

Two or more internal power supplies, each able to carry the full load and usually hot-swappable. Feed each from a separate circuit.

RTFNew

Rich Text Format

An older document format that can embed objects. Flaws in RTF parsers have been exploited to run code from attachments.

RTO

Recovery Time Objective

The longest a system can be down before the business is seriously harmed. RTO is about downtime; RPO is about data loss.

SaaS

Software as a Service

A complete application the provider hosts and runs, such as Microsoft 365. The customer still secures data and access.

SAML

Security Assertions Markup Language

An XML standard for federated SSO: the identity provider sends signed assertions that each service provider trusts.

SCAP

Security Content Automation Protocol

NIST standards that let tools check configurations and vulnerabilities automatically, such as scanning against a baseline.

SELinux

Security-enhanced Linux

Kernel-level mandatory access control that labels files and processes and confines each. Fix denials with labels, not by disabling it.

SFPNew

Small Form-factor Pluggable

A small hot-swappable transceiver that connects a switch or router port to fiber or copper. It replaced the larger GBIC.

SIEM

Security Information and Event Management

Collects and normalizes logs from across the network, correlates events and raises alerts. The SOC's central console.

SLE

Single Loss Expectancy

The loss from one occurrence of a risk: asset value × exposure factor. A $100,000 asset at 40% exposure gives $40,000.

SMS

Short Message Service

Text messaging. A channel for smishing and a weak MFA factor, since codes can be intercepted or stolen by SIM swapping.

SNMP

Simple Network Management Protocol

Monitors network devices: polling on UDP 161, traps on UDP 162. Versions 1 and 2c send community strings in cleartext; use v3.

SOAR

Security Orchestration, Automation, and Response

Runs playbooks that automate response across tools, such as enriching an alert and isolating a host without manual steps.

SOC

Security Operations Center

The team that monitors, detects, investigates and responds to security events, often around the clock using a SIEM.

SOPNew

Standard Operating Procedure

Step-by-step instructions for a routine task. It lets standard changes be pre-approved because every technician does them the same way.

SOW

Statement of Work

Describes one engagement under an MSA: scope, deliverables, milestones, timeline and price, such as one penetration test.

SPF

Sender Policy Framework

A DNS TXT record listing servers allowed to send mail for a domain. It checks the envelope sender, not the visible From.

SQL

Structured Query Language

The language for querying relational databases. SQL injection slips commands into input; parameterized queries stop it.

SSENew

Security Service Edge

Cloud-delivered security: secure web gateway, CASB, ZTNA and firewall as a service. Add SD-WAN and it becomes SASE.

SSO

Single Sign-on

One sign-in grants access to many applications through a trusted identity provider, making that account a prime target.

TLS

Transport Layer Security

Encrypts and authenticates connections such as HTTPS. Use TLS 1.2 or 1.3; SSL and TLS 1.0 and 1.1 are deprecated.

TOC

Time-of-check

The moment a program checks a condition, such as a file's permissions. A change before it acts creates a TOCTOU race.

TOU

Time-of-use

The moment a program acts on an earlier check. Changing the resource in between exploits a TOCTOU race condition.

UPS

Uninterruptible Power Supply

Battery backup that keeps systems running through short outages and allows a clean shutdown or time for a generator.

USB

Universal Serial Bus

The common port for drives and peripherals. A vector for malware on removable media; control it with endpoint policy.

UTM

Unified Threat Management

One appliance combining firewall, IPS, antivirus, web filtering and VPN. Simpler to run but a single point of failure.

VNCNew

Virtual Network Computing

Cross-platform remote desktop sharing, by default on TCP 5900. Exposed or weakly protected VNC is a remote-access vector.

VPN

Virtual Private Network

An encrypted tunnel across an untrusted network, built with IPsec or TLS, for site-to-site links or remote workers.

WAF

Web Application Firewall

Inspects HTTP traffic at Layer 7 in front of a web app and blocks attacks such as SQL injection and cross-site scripting.

WIPS

Wireless Intrusion Prevention System

Monitors the airwaves for rogue access points, evil twins and deauthentication attacks, and can actively contain them.

XDR

Extended Detection and Response

Correlates detections across endpoints, network, email, identity and cloud in one platform, extending EDR past the endpoint.

Security+ acronyms: FAQ