Security+ Acronyms That Matter (and How to Learn Them Fast)
A high-yield way to study SY0-701 acronyms by theme—identity, crypto, network, ops, and GRC—instead of grinding 300+ terms alphabetically.
The SY0-701 objectives include well over 300 acronyms. Attempting to memorize them alphabetically from AAAA to ZTNA is a reliable way to burn out before exam day. The exam does not ask you to define acronyms in isolation—it embeds them in scenarios where two similar terms compete as answer choices. Your job is to discriminate, not recite.
This post groups high-yield acronyms by the job they perform, then uses mini-scenarios that force you to pick the right term for the situation. If you can pass these discrimination drills, you can handle most acronym-heavy questions on the exam.
How to Use This Post
For each cluster:
- Read the scenario before looking at the answer
- Predict the correct term
- Check the explanation for why the distractors fail
- Add any term you missed to your personal drill list
Spend 20 minutes per day on one cluster. Rotate clusters and end each session with five mixed questions from previous days.
Cluster 1: Identity and Access — Who Gets In and What They Can Do
These terms orbit the same problem: proving identity, granting permissions, and recording activity.
| Acronym | Stands for | One-line job |
|---|---|---|
| AAA | Authentication, Authorization, Accounting | Prove identity, grant access, record activity |
| IAM | Identity and Access Management | Manages digital identity lifecycle |
| MFA | Multi-Factor Authentication | Requires two or more factor types |
| SSO | Single Sign-On | One login for multiple apps |
| PAM | Privileged Access Management | Controls admin account usage |
| DAC/MAC/RBAC/ABAC | Discretionary / Mandatory / Role / Attribute access control | Owner decides / labels enforce / role-based / attribute-based |
Mini-Scenario: Authentication vs. Authorization vs. Accounting
Stem: A user logs in with a username, password, and hardware token. The system grants read-only access to the finance folder but denies write access. The login event is recorded in a syslog server.
| Question | Answer | Why |
|---|---|---|
| What proves the user's identity? | Authentication (password + token) | Proving "who you are" |
| What determines read-only vs. write? | Authorization | Proving "what you can do" |
| What records the login event? | Accounting (or auditing) | Tracking "what you did" |
Exam trap: "The system verified the user's fingerprint" is authentication even if the question's goal is about access levels. Read the specific ask.
Mini-Scenario: DAC vs. MAC vs. RBAC
Stem: A defense contractor uses a system where documents are labeled TOP SECRET, SECRET, and CONFIDENTIAL. Users cannot share a TOP SECRET file with someone cleared only for SECRET, even if they "own" the file.
Answer: MAC (Mandatory Access Control). Labels are system-enforced; the owner cannot override them.
Why not DAC? In DAC, the file owner decides sharing. Why not RBAC? RBAC assigns permissions by role ("analyst," "manager"), not by data classification labels.
Cluster 2: Crypto and PKI — Protecting Data and Proving Identity
| Acronym | Stands for | One-line job |
|---|---|---|
| AES | Advanced Encryption Standard | Symmetric encryption (bulk data) |
| RSA | Rivest-Shamir-Adleman | Asymmetric encryption (key exchange, signatures) |
| ECC | Elliptic Curve Cryptography | Asymmetric crypto with smaller keys |
| HMAC | Hash-based Message Authentication Code | Proves message integrity + authenticity |
| SHA | Secure Hash Algorithm | One-way hashing (integrity, not confidentiality) |
| PKI | Public Key Infrastructure | Framework for digital certificates |
| CA | Certificate Authority | Issues and signs certificates |
| CSR | Certificate Signing Request | Request sent to CA for a new certificate |
| CRL | Certificate Revocation List | Published list of revoked certificates |
| OCSP | Online Certificate Status Protocol | Real-time certificate validity check |
| TPM | Trusted Platform Module | Hardware chip for key storage on endpoint |
| HSM | Hardware Security Module | Dedicated hardware appliance for key management |
Mini-Scenario: CRL vs. OCSP
Stem: A web server needs to verify whether a client certificate was revoked five minutes ago. Checking a periodically updated downloadable list would miss revocations between updates. What protocol provides real-time status?
Answer: OCSP. It queries the CA for current status on demand.
Why not CRL? A CRL is a snapshot published at intervals (hourly, daily). A cert revoked after the last CRL publication still appears valid until the next update.
Exam trap: Both CRL and OCSP address revocation. The discriminator is timeliness vs. offline capability. CRL works offline once downloaded; OCSP requires live connectivity but gives current status.
Mini-Scenario: Hashing vs. Encryption
Password storage requiring one-way protection → Hashing (SHA-256 with salt). AES is reversible; HMAC proves integrity in transit, not password storage.
Mini-Scenario: TPM vs. HSM
Stem: A laptop needs to store BitLocker encryption keys in hardware that prevents key extraction even if the OS is compromised. A data center needs a dedicated appliance to manage thousands of CA signing keys with FIPS 140-2 validation.
| Need | Answer |
|---|---|
| Laptop key storage | TPM (chip on the motherboard) |
| Data center key management | HSM (standalone appliance) |
Exam trap: Both are hardware. TPM is endpoint-embedded; HSM is enterprise-grade, standalone.
Cluster 3: Network Defense — Detecting and Blocking Threats
| Acronym | Stands for | One-line job |
|---|---|---|
| IDS | Intrusion Detection System | Detects suspicious activity, alerts only |
| IPS | Intrusion Prevention System | Detects and blocks suspicious activity inline |
| ACL | Access Control List | Permits or denies traffic by rule |
| NAC | Network Access Control | Evaluates device health before network admission |
| VPN | Virtual Private Network | Encrypted tunnel over untrusted network |
| WAF | Web Application Firewall | Filters HTTP/HTTPS at application layer |
| DLP | Data Loss Prevention | Monitors and blocks sensitive data exfiltration |
| VLAN | Virtual LAN | Logical network segmentation on switches |
Mini-Scenario: IDS vs. IPS
Stem: A security engineer deploys a device on a span port that mirrors traffic from the core switch. When suspicious patterns appear, the device sends alerts to the SOC but cannot stop the traffic. What was deployed?
Answer: IDS. It operates out-of-band (passive monitoring) and detects without blocking.
Stem (variant): The device sits inline between the firewall and the internal network. When it detects an exploit attempt, it drops the packet before it reaches the target server.
Answer: IPS. Inline placement allows prevention; the tradeoff is latency and false-positive disruption.
Exam trap: The stem tells you whether the device can block. Detection-only = IDS. Detection + block = IPS.
Mini-Scenario: ACL vs. WAF vs. NAC
SQL injection in HTTP POST → WAF (Layer 7). Laptop with outdated AV blocked from Wi-Fi until updated → NAC (endpoint compliance check before network admission).
Cluster 4: Security Operations — Detecting, Responding, Measuring
| Acronym | Stands for | One-line job |
|---|---|---|
| SIEM | Security Information and Event Management | Aggregates and correlates logs |
| SOAR | Security Orchestration, Automation, and Response | Automates IR workflows across tools |
| EDR | Endpoint Detection and Response | Monitors endpoint behavior and enables response |
| IoC | Indicator of Compromise | Artifact suggesting breach (hash, IP, domain) |
| CVE/CVSS | Common Vulnerabilities and Exposures / Scoring | Vulnerability ID and severity score |
Mini-Scenario: SIEM vs. SOAR vs. EDR
Stem: After a phishing alert, the system automatically quarantines the endpoint, creates a ticket, notifies the analyst, and blocks the sender domain at the email gateway—without manual steps.
Answer: SOAR. It orchestrates automated response across multiple tools.
Why not SIEM? SIEM correlates and alerts; it does not automatically quarantine. Why not EDR? EDR handles endpoint telemetry and response on the endpoint itself, not cross-tool orchestration.
Cluster 5: GRC and Risk — Measuring and Managing
| Acronym | Stands for | One-line job |
|---|---|---|
| SLE | Single Loss Expectancy | Dollar cost of one incident |
| ARO | Annualized Rate of Occurrence | Incidents per year (frequency) |
| ALE | Annualized Loss Expectancy | Expected annual loss (SLE × ARO) |
| BIA | Business Impact Analysis | Identifies critical functions and downtime cost |
| RTO | Recovery Time Objective | Max acceptable downtime |
| RPO | Recovery Point Objective | Max acceptable data loss |
| AUP | Acceptable Use Policy | User behavior rules |
| MOU | Memorandum of Understanding | Non-binding cooperation statement |
| MSA | Master Service Agreement | Binding service contract |
| SLA | Service Level Agreement | Performance commitments with metrics |
Mini-Scenario: SLE vs. ALE vs. ARO
Stem: A warehouse stores $500,000 in inventory. A flood would destroy 60% of it. Floods occur once every 5 years on average. What is the annualized loss expectancy?
| Step | Calculation |
|---|---|
| SLE | $500,000 × 0.60 = $300,000 |
| ARO | 1 ÷ 5 = 0.2 |
| ALE | $300,000 × 0.2 = $60,000/year |
Exam trap: SLE is a single event cost. ALE is annualized. Questions may give ALE and ARO and ask for SLE: SLE = ALE ÷ ARO.
Mini-Scenario: RTO vs. RPO
Stem: A payment processor declares that after any outage, systems must be restored within 2 hours and no more than 5 minutes of transaction data can be lost.
| Term | Value |
|---|---|
| RTO | 2 hours (downtime limit) |
| RPO | 5 minutes (data loss limit) |
Exam trap: RTO is about time to restore service. RPO is about data freshness at recovery. They are independent—a low RPO requires frequent backups; a low RTO requires hot standby or fast failover.
Cluster 6: Email and Cloud — Quick Discrimination
SPF lists authorized senders in DNS. DKIM cryptographically signs message content. DMARC sets policy for SPF/DKIM failures and enables reporting—it builds on both, not replaces them.
Mini-scenario: An attacker forges the From header to @yourcompany.com. SPF catches unauthorized sending IPs. If the message body was tampered with, DKIM validation fails. Leadership wants failed messages rejected with aggregate reports → DMARC.
For cloud models: IaaS = you manage OS and apps; PaaS = cloud manages runtime, you manage apps; SaaS = cloud manages everything (e.g., Salesforce). CASB monitors cloud app usage; MDM enforces policy on mobile devices.
The 20-Minute Daily Drill Method
- Pick one cluster from this post (10–15 terms)
- For each term, write: expansion + seven-word purpose + one "not this" counter-example
- Create three original mini-scenarios that force discrimination within the cluster
- End with five mixed questions from clusters studied earlier in the week
- Log misses in a single "confusion pairs" list (CRL/OCSP, IDS/IPS, SLE/ALE, RTO/RPO)
Keep the official CompTIA objectives PDF as your source of truth for which acronyms are in scope. Use Anki or a similar tool for spaced repetition, but organize decks by cluster, not alphabetically.
Exam-Day Acronym Hygiene
When two answer choices differ only by acronym:
- Expand both in plain English before choosing
- Re-read the stem for the specific ask (detect vs. block, single event vs. annual, owner decides vs. system enforces)
- Eliminate the term that solves a different problem than the one described
Panic expansions cause candidates to pick IPS when the stem describes passive monitoring, or ALE when the question asks for the cost of a single incident (SLE). Slow down, discriminate, and move on.
Acronyms are not trivia—they are shorthand for roles in a system. Learn the role, and the letters follow.