Security+ acronyms grouped by exam domain

Learn them by domain, not alphabetically

Security+ questions reuse about a hundred acronyms, and the exam rarely spells them out. The practical way to learn them is to attach each one to the domain where it is used, because the domain tells you the context the question is set in. This guide groups the acronyms that appear in the SY0-801 objectives by the five domains. The decision rule: when two acronyms look alike, work out which stage of the work each belongs to (finding, scoring, fixing, reporting) before reading the options.

Two notes on sources. CompTIA’s objectives name the acronyms but do not define them, so the expansions below are the standard industry meanings, explained in this guide’s own words. And the V8 objectives (SY0-801) are the reference here. V8 launches on November 17, 2026, and until then the live exam is SY0-701, which overlaps heavily but is not identical. Check the SY0-801 vs SY0-701 comparison if you are booked before the switch.

Domain 1: general security concepts (16%)

CRL and OCSP are the classic pair: both answer “is this certificate still valid?”, but a CRL is a published list the client downloads, while OCSP asks about one certificate. Cryptography basics covers the surrounding material.

Domain 2: threats, vulnerabilities and attacks (24%)

The trio CVE, CWE and CVSS is worth saying aloud: the CVE is the flaw, the CWE is the kind of mistake behind it, and the CVSS is how bad it is. Vulnerability management and CVSS goes further, and common attack types covers the attacks themselves.

Domain 3: security architecture (19%)

RTO is a duration of downtime; RPO is a point in time that sets the amount of data loss. Questions give you a backup schedule and ask which one it determines: the schedule fixes RPO, not RTO.

Domain 4: security operations (27%)

Detection versus prevention is the usual trap: the IDS variants alert, the IPS variants sit inline and block. SIEM vs SOAR vs XDR separates the tooling acronyms, and the incident response lifecycle places them in the process.

Domain 5: program management and oversight (14%)

Worked example: ALE

A file server is worth 200,000 and a failure would destroy 25% of that value, so SLE = 200,000 x 0.25 = 50,000. If such a failure is expected every two years, ARO = 0.5, and ALE = 50,000 x 0.5 = 25,000 per year. A control that costs less than that yearly figure and removes the risk is economically justified. The method is covered in qualitative vs quantitative risk.

Which exams test this

How questions use acronyms

Questions rarely ask “what does X stand for”. They place the acronym in a scenario and offer its look-alikes as distractors. The constraint words are the stage and the scope: “inline” or “blocks” points to prevention, “alerts” to detection; “maximum tolerable data loss” points to RPO, “time to restore service” to RTO; “score” points to CVSS, “identifier” to CVE. When you meet an unknown acronym, expand it letter by letter and ask what job the words describe.

Go deeper

• CompTIA Security+ V8 page, with the exam objectives download
• FIRST: Common Vulnerability Scoring System
• MITRE CVE program
• Related on this site: SY0-801 general security concepts, how to study for certification exams, security frameworks