Acronyms are easier to remember when they are attached to a system, decision, or scenario. Use this reference when unfamiliar initials interrupt a guide, practice question, log, or conversation. Then return to the surrounding material and apply the term in context.
This list covers 245 common Security+ acronyms and terms drawn from the current SY0-701 objectives and the CertHappens study guides. The page uses a stable Security+ address so later exam versions can add terminology without creating a separate reference for every revision.
Context decides the meaning. Some initials have more than one valid expansion. MAC, PAM, RA, RBAC, SAN, and SOC are common examples. Read the full scenario before choosing a definition.
Search the reference
Search by acronym, expansion, plain-English meaning, related term, or exam domain.
Showing all 245 entries.
0-9
- 2FA
- Two-factor authentication Authentication that requires two different factor types, such as a password and a hardware token.
- 3DES
- Triple Data Encryption Standard A legacy symmetric cipher that applies DES three times. Modern systems should prefer stronger algorithms such as AES.
A
- AAA
- Authentication, authorization, and accounting A framework that verifies identity, decides permitted actions, and records activity.
- ACL
- Access control list A set of rules that permits or denies access to a resource, network path, or object.
- AES
- Advanced Encryption Standard A widely used symmetric encryption standard for protecting data at rest and in transit.
- AES-256
- Advanced Encryption Standard with a 256-bit key AES using a 256-bit key. The key size is one part of security; mode, key handling, and implementation also matter.
- AH
- Authentication Header An IPsec component that provides integrity and origin authentication without encrypting the payload.
- AI
- Artificial intelligence Systems that perform tasks associated with human reasoning, recognition, prediction, or generation.
- ALE
- Annualized loss expectancy The estimated yearly financial loss from a risk, calculated as SLE multiplied by ARO.
- API
- Application programming interface A defined way for software components or services to exchange requests and data.
- APT
- Advanced persistent threat A capable, well-resourced threat actor that maintains long-term access while pursuing a strategic objective.
- ARO
- Annualized rate of occurrence The expected number of times a loss event occurs in one year.
- ARP
- Address Resolution Protocol A protocol that maps an IPv4 address to a local network hardware address.
- ASLR
- Address space layout randomization A memory protection that changes where processes and libraries are loaded, making exploitation less predictable.
- ATT&CK
- Adversarial Tactics, Techniques, and Common Knowledge MITRE's knowledge base for describing adversary behavior through tactics and techniques.
- AUP
- Acceptable use policy A policy that defines permitted and prohibited use of organizational systems and data.
- AV
- Antivirus Software that detects, blocks, and removes known or suspicious malicious software.
B
- BCP
- Business continuity planning Planning that keeps essential business functions operating during and after a disruption.
- BGP
- Border Gateway Protocol The routing protocol used to exchange reachability information between autonomous systems on the internet.
- BIA
- Business impact analysis A process that identifies critical functions and evaluates the consequences of disruption.
- BIOS
- Basic input/output system Legacy firmware that initializes hardware and starts the boot process.
- BPA
- Business partners agreement An agreement that defines responsibilities and expectations between organizations working together.
- BYOD
- Bring your own device A model that permits personally owned devices to access organizational resources.
C
- CA
- Certificate authority A trusted organization or system that issues and signs digital certificates.
- CAPTCHA
- Completely Automated Public Turing test to tell Computers and Humans Apart A challenge intended to distinguish human users from automated activity.
- CASB
- Cloud access security broker A control point that applies security policy between users and cloud services.
- CCTV
- Closed-circuit television Video surveillance used to monitor and record activity within a controlled environment.
- CERT
- Computer emergency response team A team that coordinates preparation for and response to cybersecurity incidents.
- CHAP
- Challenge Handshake Authentication Protocol An authentication protocol that uses challenge-response exchanges instead of sending the password directly.
- CIA
- Confidentiality, integrity, and availability Three foundational security goals: prevent unauthorized disclosure, preserve trustworthy data, and keep services usable.
- CIRT
- Computer incident response team A group responsible for preparing for, investigating, containing, and recovering from incidents.
- COBO
- Corporate-owned, business-only A device ownership model in which the organization owns the device and restricts it to business use.
- COOP
- Continuity of operations planning Planning that sustains essential organizational functions during disruption.
- COPE
- Corporate-owned, personally enabled A device model in which the organization owns the device but permits limited personal use.
- CRL
- Certificate revocation list A published list of certificates that should no longer be trusted before their expiration dates.
- CSP
- Cloud service provider A company that delivers cloud computing services such as IaaS, PaaS, or SaaS.
- CSR
- Certificate signing request A request containing a public key and identity information that is submitted for certificate issuance.
- CSRF
- Cross-site request forgery An attack that causes a signed-in browser to send an unintended request to a trusted application.
- CVE
- Common Vulnerabilities and Exposures A standardized identifier assigned to a publicly known vulnerability.
- CVSS
- Common Vulnerability Scoring System A scoring framework used to describe vulnerability severity and environmental impact.
- CYOD
- Choose your own device A model in which users select an approved device from an organizational list.
D
- DAC
- Discretionary access control An access model in which an object's owner can decide who receives access.
- DDoS
- Distributed denial-of-service A denial-of-service attack launched from many systems at once to exhaust a target's resources.
- DEP
- Data execution prevention A memory protection that blocks code execution in regions intended only for data.
- DES
- Data Encryption Standard A legacy symmetric cipher with a key size too small for modern security needs.
- DHCP
- Dynamic Host Configuration Protocol A protocol that automatically assigns IP configuration to network clients.
- DHE
- Diffie-Hellman Ephemeral A temporary Diffie-Hellman key exchange that supports forward secrecy when used correctly.
- DKIM
- DomainKeys Identified Mail An email authentication method that uses a domain's digital signature to help verify message integrity and origin.
- DLP
- Data loss prevention Controls that identify sensitive information and restrict unauthorized transfer or exposure.
- DMARC
- Domain-based Message Authentication, Reporting, and Conformance An email policy and reporting framework that builds on SPF and DKIM.
- DNS
- Domain Name System The distributed service that maps names to records such as IP addresses and mail servers.
- DNSSEC
- Domain Name System Security Extensions Extensions that add signed DNS data so resolvers can validate integrity and origin.
- DoS
- Denial-of-service An attack or condition that prevents legitimate users from accessing a service.
- DPO
- Data protection officer A role that oversees privacy obligations and data-protection practices.
- DRP
- Disaster recovery plan A documented approach for restoring technology and data after a major disruption.
- DSA
- Digital Signature Algorithm A public-key algorithm designed for digital signatures.
E
- EAP
- Extensible Authentication Protocol A framework that supports multiple authentication methods, often in enterprise wireless and network access.
- ECC
- Elliptic curve cryptography Public-key cryptography based on elliptic curves, offering strong security with comparatively small keys.
- ECDHE
- Elliptic Curve Diffie-Hellman Ephemeral An ephemeral elliptic-curve key exchange that can provide forward secrecy.
- ECDSA
- Elliptic Curve Digital Signature Algorithm An elliptic-curve algorithm used to create and verify digital signatures.
- EDR
- Endpoint detection and response Endpoint security that collects activity, detects suspicious behavior, and supports investigation and response.
- ESP
- Encapsulating Security Payload An IPsec component that can provide encryption, integrity, and authentication for network traffic.
- EULA
- End-user license agreement A contract that defines how software may be installed, used, and distributed.
F
- FAR
- False acceptance rate The rate at which a biometric system incorrectly accepts an unauthorized person.
- FDE
- Full-disk encryption Encryption that protects an entire storage device, usually when the device is powered off or locked.
- FIM
- File integrity monitoring A control that detects unexpected changes to important files or configurations.
- FRR
- False rejection rate The rate at which a biometric system incorrectly rejects an authorized user.
- FTP
- File Transfer Protocol A legacy file-transfer protocol that does not encrypt credentials or content by default.
- FTPS
- FTP Secure FTP protected with TLS. It is different from SFTP, which runs through SSH.
G
- GCM
- Galois/Counter Mode An authenticated encryption mode commonly used with AES to provide confidentiality and integrity.
- GDPR
- General Data Protection Regulation A European Union privacy regulation governing personal-data processing and individual rights.
- GPG
- GNU Privacy Guard An open implementation of the OpenPGP standard for encryption and digital signatures.
- GPO
- Group Policy Object A collection of Windows configuration settings applied through Active Directory Group Policy.
H
- HA
- High availability Design practices that reduce downtime through redundancy, failover, and removal of single points of failure.
- HIDS
- Host-based intrusion detection system A host control that monitors local events, files, or activity and raises alerts.
- HIPS
- Host-based intrusion prevention system A host control that can detect and actively block suspicious local activity.
- HMAC
- Hash-based message authentication code A keyed hash that provides integrity and source authentication between parties that share a secret.
- HOTP
- HMAC-based one-time password A counter-based one-time password generated from a shared secret and HMAC.
- HSM
- Hardware security module A dedicated device that generates, protects, and uses cryptographic keys within a controlled boundary.
- HTTP
- Hypertext Transfer Protocol The application protocol used for web requests and responses without built-in transport encryption.
- HTTPS
- Hypertext Transfer Protocol Secure HTTP protected by TLS to provide encrypted and authenticated transport.
- HVAC
- Heating, ventilation, and air conditioning Environmental systems that maintain safe temperature, humidity, and airflow for facilities and equipment.
I
- IaaS
- Infrastructure as a service A cloud model in which the provider supplies infrastructure while the customer manages operating systems, applications, and much of the configuration.
- IaC
- Infrastructure as code The management of infrastructure through versioned, repeatable configuration files or templates.
- IAM
- Identity and access management Processes and technologies for creating identities, authenticating users, and controlling access.
- ICMP
- Internet Control Message Protocol A network protocol used for diagnostics and control messages, including many ping and error responses.
- ICS
- Industrial control system Technology used to monitor and control industrial processes and physical equipment.
- IdP
- Identity provider A service that authenticates a user and issues identity assertions or tokens to relying applications.
- IDS
- Intrusion detection system A control that identifies suspicious activity and generates alerts without necessarily blocking traffic.
- IKE
- Internet Key Exchange A protocol used to negotiate security associations and keys for IPsec.
- IMAP
- Internet Message Access Protocol A protocol that lets email clients access and synchronize messages stored on a mail server.
- IoC
- Indicator of compromise Evidence that may suggest malicious activity, such as a known hash, domain, process, or registry change.
- IoT
- Internet of Things Network-connected devices that sense, process, or control physical environments, often with limited resources and long lifecycles.
- IP
- Internet Protocol The network-layer protocol used to address and route packets between systems.
- IPS
- Intrusion prevention system A control placed inline to detect and block suspicious traffic.
- IPsec
- Internet Protocol Security A suite of protocols that protects IP traffic through authentication, integrity, and optional encryption.
- IR
- Incident response The organized process for preparing for, detecting, containing, eradicating, and recovering from incidents.
- IRP
- Incident response plan A documented plan that assigns roles, procedures, communications, and escalation paths for incidents.
- ISO
- International Organization for Standardization An international standards body that publishes management and technical standards.
- ISP
- Internet service provider An organization that supplies connectivity and related network services.
- IV
- Initialization vector A value used with a cipher mode to ensure repeated plaintext does not produce identical ciphertext under the same key.
K
- KDC
- Key distribution center A trusted Kerberos service that issues tickets and session keys.
- KEK
- Key-encryption key A cryptographic key used to encrypt or wrap another key.
- KMS
- Key management system A service or platform that creates, stores, rotates, distributes, and controls the use of cryptographic keys.
- KRI
- Key risk indicator A measurable signal used to show rising exposure or changing risk conditions.
L
- LAN
- Local area network A network covering a limited area such as an office, home, or campus segment.
- LDAP
- Lightweight Directory Access Protocol A protocol used to query and manage directory services.
M
- MAC
- Mandatory access control An access model in which centrally assigned labels and rules determine access rather than individual owners.
- MAC
- Media access control The data-link layer function and hardware addressing used on local networks.
- MAC
- Message authentication code A short cryptographic value created with a secret key to verify integrity and authenticity.
- MDM
- Mobile device management Administration that applies configuration, compliance, inventory, and remote actions to mobile devices.
- MFA
- Multifactor authentication Authentication that requires evidence from at least two different factor categories.
- MOA
- Memorandum of agreement A document that records agreed responsibilities and commitments between parties.
- MOU
- Memorandum of understanding A document that describes a shared understanding or intent between parties, often with less contractual detail than a formal agreement.
- MSA
- Master service agreement A contract that establishes general terms for an ongoing vendor relationship.
- MSP
- Managed service provider A third party that operates technology services for a customer.
- MSSP
- Managed security service provider A third party that delivers managed security monitoring, protection, or response services.
- MTBF
- Mean time between failures The average operating time between repairable failures, often used as a reliability measure.
- MTTF
- Mean time to failure The average expected operating time before a nonrepairable component fails.
- MTTR
- Mean time to recover The average time required to restore a service after failure. Some organizations use the same initials for mean time to repair, so read the surrounding definition.
N
- NAC
- Network access control Technology that evaluates users or devices before and during network access, then permits, restricts, or isolates them.
- NAT
- Network address translation A network function that rewrites IP address information between address spaces.
- NDA
- Non-disclosure agreement A contract that restricts unauthorized disclosure of confidential information.
- NFC
- Near-field communication A very short-range wireless technology commonly used for payments, badges, and device pairing.
- NGFW
- Next-generation firewall A firewall that combines traditional traffic filtering with deeper inspection and application-aware controls.
- NIDS
- Network-based intrusion detection system A network sensor that analyzes traffic and alerts on suspicious activity.
- NIPS
- Network-based intrusion prevention system An inline network control that analyzes and can block suspicious traffic.
- NIST
- National Institute of Standards and Technology A United States agency that publishes widely used cybersecurity standards, frameworks, and guidance.
- NTP
- Network Time Protocol A protocol used to synchronize system clocks, which is important for logs, authentication, and investigations.
O
- OAuth
- Open Authorization A framework that lets a user grant an application limited access to a resource without sharing the user's password.
- OCSP
- Online Certificate Status Protocol A protocol used to check whether a certificate has been revoked.
- OIDC
- OpenID Connect An identity layer built on OAuth 2.0 that lets an application verify a user's identity and receive basic profile claims.
- OS
- Operating system The software layer that manages hardware, processes, memory, files, and system services.
- OSINT
- Open-source intelligence Information collected from publicly available sources for analysis or investigation.
- OT
- Operational technology Hardware and software that monitors or controls physical processes, equipment, and industrial operations.
- OWASP
- Open Worldwide Application Security Project A nonprofit project that publishes practical application-security guidance and testing resources.
P
- PaaS
- Platform as a service A cloud model in which the provider manages the underlying platform while the customer deploys applications and data.
- PAM
- Pluggable authentication modules A Unix and Linux framework that lets applications use configurable authentication methods.
- PAM
- Privileged access management Controls for issuing, monitoring, limiting, and reviewing highly privileged access.
- PAP
- Password Authentication Protocol A legacy authentication protocol that sends credentials without challenge-response protection.
- PAT
- Port address translation A form of NAT that maps many internal connections to one public address by tracking transport-layer ports.
- PBKDF2
- Password-Based Key Derivation Function 2 A password-based key derivation function that applies a salt and many iterations to increase guessing cost.
- PCAP
- Packet capture A file or process that records network packets for troubleshooting, monitoring, or investigation.
- PCI DSS
- Payment Card Industry Data Security Standard An industry security standard for organizations that store, process, or transmit payment-card data.
- PEP
- Policy enforcement point The zero-trust component that allows, blocks, or ends a connection according to a policy decision.
- PFS
- Perfect forward secrecy A property that keeps past sessions protected even if a long-term private key is later compromised.
- PGP
- Pretty Good Privacy A system and standard family used for encryption and digital signatures, especially for files and email.
- PHI
- Protected health information Health information linked to an individual and protected under applicable healthcare privacy rules.
- PII
- Personally identifiable information Information that can identify, contact, or distinguish a person, alone or when combined with other data.
- PIV
- Personal Identity Verification A United States federal identity standard and smart-card credential for personnel and contractors.
- PKCS
- Public-Key Cryptography Standards A family of standards covering key formats, signatures, certificates, and cryptographic messages.
- PKI
- Public-key infrastructure The people, policies, services, keys, and certificates used to establish and manage public-key trust.
- POP
- Post Office Protocol An email retrieval protocol commonly used to download messages from a server.
- PSK
- Pre-shared key A secret configured on participating systems before secure communication begins.
- PUP
- Potentially unwanted program Software that may be undesirable or risky even when it is not classified as outright malware.
R
- RA
- Recovery agent An authorized identity or process that can recover encrypted data when the normal user key is unavailable.
- RA
- Registration authority A PKI role that verifies identity and approves certificate requests for a certificate authority.
- RADIUS
- Remote Authentication Dial-In User Service A protocol that centralizes authentication, authorization, and accounting for network access.
- RAID
- Redundant array of independent disks A method of combining disks for performance, capacity, or fault tolerance. RAID does not replace backups.
- RAT
- Remote access Trojan Malware that gives an attacker remote control of a compromised system.
- RBAC
- Role-based access control An access model that assigns permissions to job roles and then assigns users to those roles.
- RBAC
- Rule-based access control An access approach that evaluates rules or conditions such as time, network, or device state.
- RDP
- Remote Desktop Protocol A Microsoft protocol for interactive remote desktop sessions.
- RFID
- Radio-frequency identification A technology that uses radio signals to identify tags, cards, assets, or devices.
- ROI
- Return on investment A financial measure comparing the value gained from an investment with its cost.
- RPO
- Recovery point objective The maximum acceptable amount of data loss measured backward in time from a disruption.
- RSA
- Rivest-Shamir-Adleman A public-key algorithm used for encryption, key transport, and digital signatures when configured securely.
- RTO
- Recovery time objective The maximum acceptable time for restoring a service after disruption. The phrase return to operations can be a useful memory cue, but the Security+ term is Recovery Time Objective.
- RTOS
- Real-time operating system An operating system designed to respond within predictable timing constraints, often in embedded or industrial systems.
S
- S/MIME
- Secure/Multipurpose Internet Mail Extensions A standard that uses certificates to encrypt and digitally sign email.
- SaaS
- Software as a service A cloud model in which the provider operates the application while the customer manages users, data, and selected configuration.
- SAE
- Simultaneous Authentication of Equals The password-authenticated key exchange used by WPA3-Personal.
- SAML
- Security Assertion Markup Language An XML-based standard used to exchange authentication and authorization assertions, commonly for federation and single sign-on.
- SAN
- Storage area network A dedicated network that provides block-level access to shared storage.
- SAN
- Subject alternative name A certificate field that lists additional hostnames, IP addresses, or identities covered by the certificate.
- SASE
- Secure access service edge A cloud-delivered architecture that combines network connectivity and security services near users and resources.
- SCADA
- Supervisory control and data acquisition Systems that monitor and control industrial processes across distributed locations.
- SCAP
- Security Content Automation Protocol A collection of standards for exchanging vulnerability, configuration, and security-measurement information.
- SD-WAN
- Software-defined wide area network A centrally managed WAN architecture that selects paths and applies policy across multiple links.
- SDLC
- Software development life cycle A structured process for planning, building, testing, deploying, and maintaining software.
- SDN
- Software-defined networking A network architecture that separates centralized control logic from packet forwarding.
- SED
- Self-encrypting drive A storage device with built-in hardware encryption controlled by the drive.
- SFTP
- SSH File Transfer Protocol A secure file-transfer protocol that runs over SSH. It is different from FTPS.
- SHA
- Secure Hash Algorithm A family of cryptographic hash functions used for integrity and other security constructions.
- SIEM
- Security information and event management A platform that collects, correlates, searches, and alerts on logs and security events.
- SLA
- Service-level agreement A contract or commitment that defines measurable service expectations such as uptime and response times.
- SLE
- Single loss expectancy The estimated financial loss from one occurrence of a risk event.
- SMB
- Server Message Block A protocol used for shared files, printers, and related services, especially in Windows environments.
- SMS
- Short Message Service The text-messaging service used by mobile networks. SMS can deliver authentication codes but is vulnerable to interception and account takeover.
- SMTP
- Simple Mail Transfer Protocol The standard protocol for sending and relaying email.
- SNMP
- Simple Network Management Protocol A protocol used to monitor and manage network devices and report operational information.
- SOAR
- Security orchestration, automation, and response Technology that connects security tools and automates repeatable investigation and response workflows.
- SOC
- Security operations center A team or function that monitors, investigates, and responds to security events.
- SoC
- System on a chip An integrated circuit that combines multiple computing components on one chip.
- SOP
- Standard operating procedure A documented sequence of steps for performing a routine task consistently.
- SOW
- Statement of work A document that defines the specific work, deliverables, schedule, and responsibilities for an engagement.
- SPF
- Sender Policy Framework An email authentication mechanism that publishes which servers may send mail for a domain.
- SQL
- Structured Query Language A language used to create, query, and manage relational databases.
- SQLi
- SQL injection An injection attack that alters a database query through untrusted input.
- SSH
- Secure Shell A protocol for encrypted remote administration, command execution, tunneling, and file transfer.
- SSL
- Secure Sockets Layer A retired predecessor to TLS. Modern secure services should use supported TLS versions.
- SSO
- Single sign-on An identity arrangement that lets a user authenticate once and access multiple connected services.
- STIX
- Structured Threat Information eXpression A structured format for describing and exchanging cyber threat intelligence.
- SWG
- Secure web gateway A control that filters and inspects web traffic according to security policy.
T
- TACACS+
- Terminal Access Controller Access-Control System Plus A protocol commonly used for centralized administration access to network devices, with separate authentication, authorization, and accounting functions.
- TAXII
- Trusted Automated eXchange of Intelligence Information A protocol for exchanging structured threat intelligence such as STIX content.
- TCP/IP
- Transmission Control Protocol/Internet Protocol The core protocol suite used for communication across modern IP networks.
- TGT
- Ticket-granting ticket A Kerberos ticket used to request service tickets after initial authentication.
- TKIP
- Temporal Key Integrity Protocol A legacy Wi-Fi security protocol introduced as an interim improvement over WEP and now considered obsolete.
- TLS
- Transport Layer Security A protocol that protects network communication with encryption, integrity, and certificate-based authentication.
- TOC
- Time of check The moment a program verifies a condition before using a resource. A change between TOC and TOU can create a race condition.
- TOTP
- Time-based one-time password A short-lived code generated from a shared secret and the current time.
- TOU
- Time of use The moment a program uses a resource after checking it. A change since TOC may create a vulnerability.
- TPM
- Trusted Platform Module A hardware security component that protects keys and supports measured boot, attestation, and device-bound cryptography.
- TTP
- Tactics, techniques, and procedures A description of how a threat actor operates, from broad goals to specific methods and repeatable actions.
U
- UAT
- User acceptance testing Testing performed by users or business representatives to confirm that a system meets operational requirements.
- UBA
- User behavior analytics Analysis that identifies unusual user activity by comparing behavior with established patterns.
- UDP
- User Datagram Protocol A connectionless transport protocol with low overhead and no built-in delivery guarantee.
- UEBA
- User and entity behavior analytics Analytics that identify unusual behavior by users, accounts, devices, or other entities.
- UEFI
- Unified Extensible Firmware Interface Modern firmware that initializes hardware and supports features such as Secure Boot.
- UEM
- Unified endpoint management Centralized administration for mobile devices, desktops, and other endpoints.
- UPS
- Uninterruptible power supply A battery-backed device that supplies short-term power and conditions electricity during an outage or fluctuation.
- URI
- Uniform Resource Identifier A general identifier for a resource, including locators and other naming schemes.
- URL
- Uniform Resource Locator A URI that identifies a resource by location and access method.
- USB
- Universal Serial Bus A standard for connecting peripherals, storage, power, and data interfaces.
- UTM
- Unified threat management A security appliance that combines several controls such as firewalling, intrusion prevention, filtering, and malware protection.
V
- VDI
- Virtual desktop infrastructure A platform that hosts desktop environments centrally and delivers them to users remotely.
- VLAN
- Virtual local area network A logical Layer 2 network segment created on switching infrastructure.
- VM
- Virtual machine A software-defined computer that runs an operating system on virtualized hardware.
- VoIP
- Voice over Internet Protocol Voice communication carried over IP networks.
- VPC
- Virtual private cloud A logically isolated cloud network in which customers define subnets, routes, and security controls.
- VPN
- Virtual private network An encrypted tunnel that protects traffic across an untrusted network.
W
- WAF
- Web application firewall A control that inspects and filters HTTP traffic to protect web applications.
- WAN
- Wide area network A network that connects systems across large geographic areas or multiple sites.
- WAP
- Wireless access point A device that connects wireless clients to a network.
- WEP
- Wired Equivalent Privacy An obsolete Wi-Fi security protocol with serious cryptographic weaknesses.
- WIDS
- Wireless intrusion detection system A control that monitors wireless activity and alerts on suspicious access points or behavior.
- WIPS
- Wireless intrusion prevention system A control that detects and can respond to unauthorized or malicious wireless activity.
- WPA
- Wi-Fi Protected Access A family of Wi-Fi security standards that replaced WEP. WPA3 uses SAE for personal authentication.
- WPS
- Wi-Fi Protected Setup A simplified Wi-Fi enrollment feature whose PIN method has well-known security weaknesses.
X
- XDR
- Extended detection and response A platform that correlates detection and response data across endpoints, identities, email, cloud, and networks.
- XML
- Extensible Markup Language A structured text format used to represent and exchange data.
- XOR
- Exclusive OR A logical operation that outputs true when inputs differ and is used in many cryptographic constructions.
- XSRF
- Cross-site request forgery Another abbreviation for CSRF, an attack that causes a browser to submit an unintended authenticated request.
- XSS
- Cross-site scripting An injection attack that causes untrusted script to run in another user's browser.
No matching terms were found. Try the full phrase, a related concept, or a broader word.
Use acronyms as signposts
Expanding the letters is the first step. Exam questions usually require the purpose, limitation, or relationship behind the term. Knowing that RPO means recovery point objective should lead to acceptable data loss. Knowing that RTO means recovery time objective should lead to acceptable downtime.
When two terms look similar, compare the problem each one solves. SIEM collects and correlates security events. SOAR connects tools and automates workflows. EDR focuses on endpoint detection and response. XDR combines signals across several security layers. The expansion helps, while the operational difference earns the answer.
Official reference
The current Security+ objectives include an official SY0-701 acronym appendix. Use the published exam objectives as the final scope checklist for the exam version you are preparing to take.