# SecPlus Mastery: full reference

> Mastery-based prep for the CompTIA Security+ (SY0-701) exam. This file inlines the most-cited free content (frequently asked questions and the full Security+ acronym glossary) so it can be quoted directly. For the page index, see /llms.txt. An independent study tool, not affiliated with or endorsed by CompTIA.

## Frequently asked questions

### About SecPlus Mastery and the Security+ exam
**What is SecPlus Mastery?**
SecPlus Mastery is a mastery-based study platform for the CompTIA Security+ SY0-701 exam. You work one objective at a time, prove retention with quizzes and spaced-repetition review, and simulate the full 90-question exam. It is an independent study tool, not affiliated with or endorsed by CompTIA.

**Is SecPlus Mastery free?**
Domain 1 is free, along with practice questions, cheat sheets, a 30-day study plan, and a 300+ acronym glossary. A one-time 90-Day Pass or Lifetime purchase unlocks all five domains, full mock exams, and adaptive review. There is no subscription.

**What is on the CompTIA Security+ SY0-701 exam?**
SY0-701 covers five domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%). The exam has up to 90 questions, including performance-based questions, and the passing score is 750 on a scale of 100 to 900.

**How long does it take to study for Security+?**
With some IT background, a focused 30 days is enough for many people; if you are newer to IT, give yourself six to eight weeks. Consistency matters more than marathon sessions: about one to two hours on study days works well.

**Does CompTIA Security+ expire?**
Yes. The certification is valid for three years from the date you pass, and you renew it through CompTIA's continuing-education program or by earning a higher-level certification.

**Who makes SecPlus Mastery?**
Jude Hilgendorf, a cybersecurity student at Macomb Community College. He built the platform while preparing for SY0-701, studied on it, and passed the exam in August 2026. He writes the lessons, questions, labs, and mock exams himself, and checks them against the published CompTIA objectives. SecPlus Mastery is an independent study tool, not affiliated with or endorsed by CompTIA.

**How is "mastery-based" different from a normal question bank?**
Instead of grinding random questions, you prove 80% mastery on each objective, then spaced repetition brings topics back right before you would forget them. A readiness score and mock exams tell you when you are actually ready to sit the exam.

### Pricing and access
**Is this a subscription?**
No. Both paid plans are a single one-time payment. The 90-Day Pass gives you access for 90 days; nothing auto-renews and there is nothing to cancel.

**What if I don't pass?**
Study the material, reach the mastery gate on every objective, and complete at least one full mock exam. If you still don't pass, send us your official score report and we'll extend your access for free so you can keep preparing. Full conditions are in our Terms.

**Can I upgrade from the Pass to Lifetime later?**
Yes. You can buy Lifetime at any time from this page or Settings, and it takes effect immediately.

**Should I wait for the new version of the exam?**
No. Book SY0-701. CompTIA has Security+ V8 in development and has not published its exam code or a launch date, while SY0-701 stays bookable through June 11, 2027, which is longer than any realistic prep window. The certificate you earn reads "CompTIA Security+" with no version on it and is valid for 3 years either way, so passing the current exam costs you nothing later. Waiting costs you months of not being certified.

**What happens when CompTIA updates the exam?**
Lifetime includes future exam-version updates, so Lifetime members get our Security+ V8 material free when we release it. The 90-Day Pass covers SY0-701 for your access window, and a window bought today closes before the new exam is expected to be bookable, which is why the free update is a Lifetime line and not a Pass line. The CompTIA exam fee is separate from anything we charge.

**How much can I try before paying?**
All of Domain 1 is free: full lessons, quizzes with performance-based questions in them, and spaced review. When you set a test date, the 90-Day Pass is the plan we'd point you to.

**Is 90 days enough time to prepare?**
For most people, comfortably. Typical Security+ prep runs 4 to 8 weeks of steady studying, so 90 days covers a full pass through all five domains plus mock exams and review with room to spare. Set your exam date and the dashboard tracks your readiness against it. And if you put in the work and still do not pass, the pass guarantee extends your access free.

**Is my payment secure?**
Yes. Checkout runs through Stripe, and your card details go straight to Stripe over an encrypted connection. We never see or store your card number, so there is nothing on our end to leak.

**Can I get a refund?**
Yes, and you do not have to argue for it. Email us within 14 days of your purchase and we refund it in full, no reason needed. Paid access ends when the refund goes through, and buying again later is not held against you. Full conditions are in our Terms.

### Free practice questions
**Are these Security+ practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**Which exam version do these questions cover?**
They follow the current CompTIA Security+ SY0-701 objectives and span all five domains, from general security concepts to security program management.

**Are these real CompTIA exam questions?**
No. These are original practice questions written to match the SY0-701 objectives. CompTIA does not release live exam questions, and using leaked questions violates their exam policy.

**How many practice questions does SecPlus Mastery have?**
The full platform includes over 1,000 practice questions plus timed mock exams, lessons, and spaced review across all five domains. This page is a free sample of that bank.

### Free Security+ Study Tools: 250 Practice Questions
Source: https://secplusmastery.com/free

**Is everything on this page really free?**
Yes. Every tool linked from this page works without an account or payment: the practice questions show their answers and explanations openly, the readiness check, drills, and PBQ grade themselves in the browser, and the cheat sheet PDFs download directly.

**Do I need an account to use the free Security+ tools?**
No. Nothing on this page requires signing up. A free account adds the full Domain 1 course on top: written lessons with audio, section quizzes, hands-on labs, adaptive practice, and spaced review.

**How many free Security+ practice questions are there?**
There are 250 free questions: a 30-question practice test weighted like the real exam, 40 questions for each of the five domains, and a 20-question mixed sample. Every question includes the correct answer and a plain-English explanation.

**Why is so much of it free?**
The free tools are how most people find the site, and they are genuinely enough to gauge where you stand. The paid plans exist for the full course: every domain, over 1,000 questions, timed mock exams, PBQ-style labs, and spaced review until exam day.

### Security+ Exam: Format, Cost, and Passing Score
Source: https://secplusmastery.com/security-plus-exam

**How much does the CompTIA Security+ exam cost?**
The Security+ SY0-701 exam voucher is about $439 USD at US list price, which covers one attempt. The price varies by region and is often lower through academic or training-partner discounts.

**What is the passing score for Security+?**
You need 750 on a scale of 100 to 900 to pass Security+. The score is scaled, not a straight percentage, so it does not map cleanly to a fixed number of correct answers.

**How many questions are on the Security+ exam?**
The SY0-701 exam has a maximum of 90 questions and a 90-minute time limit. The mix includes multiple-choice questions and performance-based questions that ask you to complete a task in a simulated environment.

**How long does it take to study for Security+?**
Most people with some IT background need about four to eight weeks of focused study. If you are newer to IT, give yourself two to three months. Consistent daily practice matters more than the total number of weeks.

**How hard is the Security+ exam?**
Security+ is a moderate, entry-level exam. The concepts are broad rather than deep, and the scenario wording and performance-based questions trip people up more than any single topic. Practicing with realistic questions is the best preparation.

**Is Security+ worth it?**
For most people entering security, yes. Security+ is the baseline certification many employers and the US Department of Defense ask for, it is vendor-neutral, and it opens the door to roles like SOC analyst and security administrator. It is widely treated as the strongest first security certification.

**How long is Security+ valid?**
Security+ is valid for three years from the date you pass. You renew it by earning 50 continuing-education units, by passing a higher CompTIA certification, or by retaking the latest version of the exam.

### Security+ Ports and Protocols Cheat Sheet (SY0-701)
Source: https://secplusmastery.com/security-plus-ports

**How many ports do I need to know for the Security+ SY0-701 exam?**
Focus on the well-known ports for the protocols in the objectives, especially the secure and insecure pairs such as HTTP/HTTPS, FTP/SFTP, Telnet/SSH, and LDAP/LDAPS. This page lists every port you are likely to see, grouped by service.

**Why does the exam care about secure versus insecure protocols?**
Objective 4.5 expects you to swap a cleartext protocol for its encrypted equivalent. Knowing that HTTPS replaces HTTP, SSH replaces Telnet, and LDAPS replaces LDAP, along with the port numbers, is a common question pattern.

**Is SFTP the same as FTPS?**
No. SFTP is file transfer tunneled inside SSH and uses port 22. FTPS is ordinary FTP wrapped in TLS and uses ports 989 and 990 for implicit mode. They are different protocols that solve the same problem.

**Do I have to memorize whether a protocol uses TCP or UDP?**
Yes for the common ones. DNS, DHCP, TFTP, SNMP, NTP, and syslog are the UDP services you are most likely to be tested on, while most session-based protocols such as HTTP, SSH, and SMTP use TCP.

### Free 30-Day Security+ Study Plan (SY0-701)
Source: https://secplusmastery.com/security-plus-study-plan

**Is 30 days enough to study for Security+?**
For many people with some IT background, a focused 30 days is enough. If you are newer to IT, give yourself six to eight weeks and spread each topic over more days.

**How many hours a day should I study?**
Plan for about one to two hours on study days, with lighter review days. Consistency matters more than occasional marathon sessions.

**Is this study plan free?**
Yes. The full plan and the printable PDF checklist are free, and every resource it links to is free as well.

**What order should I study the domains in?**
This plan follows the domains in order and by exam weight, spending the most time on Domain 4, Security Operations, which is the largest domain.

### Security+ Common Attacks Cheat Sheet (SY0-701)
Source: https://secplusmastery.com/security-plus-attacks

**What attacks are on the Security+ exam?**
SY0-701 covers malware (virus, worm, trojan, ransomware), social engineering (phishing, pretexting, tailgating), and network and application attacks such as DDoS, on-path, SQL injection, and password attacks.

**What is the difference between a virus and a worm?**
A virus attaches to a file and needs user action to spread, while a worm self-replicates and spreads across networks on its own with no host file or user action.

**What is the most common type of social engineering?**
Phishing, along with its targeted forms spear phishing and whaling and its channel variants vishing (voice) and smishing (SMS), is the most common.

**How do you defend against social engineering?**
Security awareness training, verifying requests through a separate channel, multifactor authentication, email filtering, and least privilege all reduce the risk.

### Security+ Cryptography Cheat Sheet (SY0-701)
Source: https://secplusmastery.com/security-plus-cryptography

**What cryptography is on the Security+ exam?**
SY0-701 expects symmetric and asymmetric algorithms (AES, RSA, ECC), hashing (SHA-2, HMAC), password protection (salting, bcrypt, PBKDF2), and concepts such as digital signatures, PKI, and key exchange.

**Is AES symmetric or asymmetric?**
AES is symmetric: the same key encrypts and decrypts. RSA and ECC are the common asymmetric algorithms, used for key exchange and digital signatures.

**What is the difference between hashing and encryption?**
Encryption is reversible with a key and protects confidentiality. Hashing is one-way and proves integrity. Passwords are hashed with a salt, never encrypted.

**Why are MD5 and SHA-1 not recommended?**
Both are broken; practical collisions have been demonstrated, so they should not be used for security. Use SHA-2 or SHA-3 instead.

### How We Verify Our Security+ Practice Questions
Source: https://secplusmastery.com/security-plus-question-quality

**Are the Security+ practice questions on SecPlus Mastery accurate?**
Yes. Every question is written to the current CompTIA Security+ SY0-701 objectives and reviewed for technical accuracy, and an automated quality gate checks all of them on every change. Any question that is malformed, has no correct answer, or has an answer key that does not match its options is blocked before it can go live.

**Are these real CompTIA exam questions?**
No. These are original questions written to the SY0-701 objectives. CompTIA does not release live exam questions, and using leaked questions violates their exam policy. The goal is to test the same concepts the real exam tests, not to copy it.

**How do you know the marked answer is the correct one?**
Every answer choice, right and wrong, carries its own written explanation, so the reasoning is on the page for you to check. Automated checks require exactly one correct answer on single-answer questions and at least two on select-all questions, and reject any question that has no correct answer at all.

**How are the performance-based (drag-and-drop) questions graded?**
Each interactive task is checked against its own answer map before it ships, so every prompt, target, and step it references actually exists and the task can be completed and scored correctly. They are graded against that stored map the same way every time.

**How many practice questions are there?**
Over 1,000 unique questions across all five domains, with enough in every domain to assemble multiple full-length, weighted mock exams that mirror the real blueprint. No question repeats across the bank.

**What happens if I find a mistake in a question?**
Send it through the contact page. Reported questions are reviewed against the objectives, and a correction updates the question for everyone at once, because each question lives in a single place that every quiz and mock exam draws from.

**Are the questions kept up to date with the current exam?**
Yes. Questions are mapped to the current SY0-701 objectives and reviewed as the objectives and the underlying technology change, so practice stays aligned with the exam you will actually sit.

### Free Security+ Practice Test: 30 Questions (SY0-701)
Source: https://secplusmastery.com/security-plus-practice-test

**Is this Security+ practice test free?**
Yes. All 30 questions, with answers and explanations, are free. No account, payment, or download is required.

**How many questions are on the real Security+ exam?**
The SY0-701 exam has a maximum of 90 questions in 90 minutes, including performance-based questions, and the passing score is 750 on a scale of 100 to 900.

**Are these real CompTIA exam questions?**
No. These are original questions written to the SY0-701 objectives. CompTIA does not release live exam questions, and using leaked questions violates their exam policy.

**How is this practice test weighted?**
The 30 questions are spread across all five domains roughly in proportion to their exam weight, so the mix mirrors the real SY0-701 blueprint.

### Free Security+ Video Lessons: Domain 1 (SY0-701)
Source: https://secplusmastery.com/security-plus-videos

**Are the Security+ video lessons free?**
Yes. All four Domain 1 video lessons are free to watch, here on the site or on YouTube, with no account or payment required. They cover every objective in Domain 1 of the SY0-701 exam.

**What do the Domain 1 videos cover?**
Four lessons: 1.1 Security Controls (categories and types), 1.2 Fundamental Security Concepts (the CIA triad, AAA, Zero Trust, physical security, and deception tech), 1.3 Change Management, and 1.4 Cryptographic Solutions (PKI, encryption, hashing, digital signatures, and key exchange). Each ends with the exact trap CompTIA uses to test it.

**Are there video lessons for Domains 2 to 5?**
Yes. Every objective in Domains 2 through 5 has its own video lesson, included with any SecPlus Mastery plan, alongside the written lessons, labs, and practice questions. Domain 1 stays free for everyone.

**Do I have to pay to watch Domain 1?**
No. Domain 1 is free on video and in writing. A paid plan unlocks Domains 2 to 5, over 1,000 practice questions, timed mock exams, and spaced review across the whole exam, plus a video lesson for every objective.

### CompTIA Security+ Salary: What It Pays by Role
Source: https://secplusmastery.com/security-plus-salary

**How much does CompTIA Security+ pay?**
Security+ is a baseline certification, not a salary. The cert does not set your pay; it qualifies you for entry-level roles. Realistically, someone whose top cert is Security+ starts around $45,000 to $75,000 in help desk, Tier 1 SOC, or junior analyst work. The often-quoted six-figure numbers, like the BLS median of about $129,200 (May 2025) for information security analysts, describe the experienced occupation you grow into over several years, not what the cert pays on day one.

**What is a realistic starting salary with Security+ and no experience?**
Plan on roughly $45,000 to $70,000 to start, most often as a help desk or IT support technician or a Tier 1 / junior SOC analyst. Pay climbs quickly with one to two years of hands-on work and a follow-on certification. Cleared defense-contractor roles tend to start higher.

**Does Security+ actually increase your salary?**
On its own the bump is modest. The real value is access: Security+ gets your resume past filters and meets a hard requirement for many government and contractor jobs, so the lift comes from the roles it unlocks rather than the paper itself. Stacking it with experience and a higher cert such as CySA+ or CISSP is what moves you into the higher pay bands.

**How much does a security clearance change the pay?**
A clearance is the single biggest pay lever for a Security+ holder. Cleared professionals averaged about $126,000 in total compensation in the 2026 ClearanceJobs report, well above uncleared entry pay. The premium belongs to the clearance, not the cert, but Security+ is often the requirement that lets you be hired into a cleared role in the first place.

**Do I earn more with Security+ or a college degree?**
They do different jobs. Security+ is the fastest and cheapest way to land a first security role, while a degree raises your ceiling, clears HR filters, and speeds promotion in corporate settings. The strongest outcome stacks both, or pairs Security+ with real hands-on experience and a follow-on certification to reach mid-career pay.

**Why do salary sites show such different Security+ numbers?**
Each site defines a Security+ job differently and blends experience levels. The US Bureau of Labor Statistics is the most rigorous source and separates occupations cleanly, such as support specialist near a $62,000 median versus information security analyst near $129,200. Aggregators like Glassdoor, ZipRecruiter, and Payscale often mix juniors with seniors and sometimes rest on small samples, which is why their averages swing by tens of thousands of dollars. Treat all of them as ranges.

### Security+ Jobs: Roles You Can Get and Career Paths
Source: https://secplusmastery.com/security-plus-jobs

**What jobs can you get with CompTIA Security+?**
Security+ maps to early-career roles such as SOC analyst (Tier 1 or 2), junior security analyst, systems administrator, network administrator, security administrator or specialist, help desk and IT support with security duties, information assurance technician, and GRC or compliance analyst. CompTIA itself lists systems administrator, network administrator, security administrator, security specialist, security consultant, security engineer, and the junior IT auditor / penetration tester role. It is best understood as a door into the field rather than a guarantee of a specific title.

**Is Security+ an entry-level certification?**
Yes. In practice it is the standard early-career security cert and usually the first security credential IT professionals earn. CompTIA recommends Network+ and about two years of IT or security experience beforehand, though neither is required. It opens doors but is not a senior or expert credential on its own.

**Does Security+ meet DoD 8570 and 8140 requirements?**
Yes. Security+ is DoD-approved and is the most common baseline certification for IAT Level II under the legacy 8570 framework, which also covers IAT Level I and IAM Level I. The governing rules moved to DoD Manual 8140.03, effective February 15, 2023, which ties qualifications to specific work roles, but Security+ still qualifies people for many of them. Confirm the current 8140 qualification matrix for the exact role you are targeting.

**What is the typical career path after Security+?**
A common ladder runs help desk or IT support, then systems or network administrator or a Tier 1 SOC analyst, then security analyst or administrator, then security engineer, and on to senior engineer, architect, or security management. Many people branch after the analyst stage into incident response, threat intelligence, penetration testing, cloud security, or governance and risk. Advancement generally needs hands-on experience plus a higher cert such as CySA+, PenTest+, or CISSP.

**Can Security+ help me get a government or defense job?**
Yes, and this is one of its strongest uses. DoD rules require anyone with privileged access to DoD systems, including contractors, to hold an approved certification, and Security+ is the most common baseline at the technical tier. A common path is to earn Security+, get hired into an uncleared role, then obtain a Secret clearance, which the employer usually sponsors and which tends to raise pay.

**Is Security+ enough to become a penetration tester?**
Usually not by itself. Security+ now covers a junior IT auditor and penetration tester job role and signals broad security knowledge, but pure junior pentester openings are relatively scarce, and offensive work is typically a mid-career move. Most people add hands-on practice and a dedicated cert such as CompTIA PenTest+, CEH, or OSCP before landing that work.

### Is Security+ Worth It in 2026? An Honest Look
Source: https://secplusmastery.com/security-plus-worth-it

**Is CompTIA Security+ worth it in 2026?**
For most people breaking into cybersecurity, yes. It is the most recognized entry-level, vendor-neutral, ISO 17024-accredited security cert and a DoD 8140 and 8570 baseline, so it gets your resume past filters and meets a hard requirement for many government and contractor jobs. It is a baseline credential, not a guaranteed job, so in a competitive entry market you should pair it with hands-on lab work and ideally some IT experience.

**Who is Security+ actually worth it for?**
Career changers, help desk and IT pros moving into security, students building a foundation, anyone who needs a DoD baseline cert, and anyone targeting roles whose postings list Security+. In those cases it is often the single highest-leverage cert you can hold, because it is so widely requested and satisfies the government baseline requirement.

**Who should not make Security+ their next move?**
Experienced security professionals usually gain little from it unless an employer or DoD contract specifically requires it; CISSP for leadership and architecture or OSCP for hands-on offensive work deliver more. People who mainly need to prove practical skill are also better served by home labs, documented projects, and specialized certs than by another foundational paper cert.

**How much does Security+ cost, and what is the real total?**
The exam voucher is about $439 in the US, often $370 to $395 through authorized resellers, less with student discounts. A realistic self-study total including books and practice tests is roughly $550 to $750, while instructor-led bootcamps run $1,500 to $3,500. The certification lasts three years, and renewal through continuing education costs about $150 over that cycle.

**Will Security+ get me a cybersecurity job by itself?**
Not reliably. There is a real talent gap, but the bottleneck is sharpest at the entry level, where many junior postings still ask for experience and employers increasingly screen on demonstrable skills. Candidates who get hired tend to combine Security+ with home labs, documented projects, some scripting, and prior IT or help desk experience.

**Is the cybersecurity job market still strong?**
Overall demand is strong: CyberSeek data as of mid-2026 puts the supply-to-demand ratio near 74 workers for every 100 openings, with more than 500,000 US listings. The catch is that the shortage is concentrated above entry level, so a first job is genuinely competitive even while senior demand stays high. Honest framing: the field is growing, but a cert alone does not clear the entry-level bar.

### How Hard Is Security+? Difficulty and Study Time
Source: https://secplusmastery.com/security-plus-difficulty

**How hard is the CompTIA Security+ (SY0-701) exam?**
It is a moderate, entry-level exam that tests breadth rather than depth across a wide range of security topics. Most people find it challenging but very passable with focused study. How hard it feels depends mostly on your background: someone with Network+, A+, or hands-on IT experience finds much of it familiar, while a complete beginner faces a steeper climb.

**How long does it take to study for Security+?**
Plan on roughly 80 to 150 focused study hours. Experienced IT or security professionals can be ready in about two to four weeks, the median candidate takes eight to twelve weeks, and complete beginners or career changers typically need twelve to sixteen weeks. Your existing IT experience is the single biggest factor in how long you need.

**What score do I need to pass, and what is the format?**
The exam has a maximum of 90 questions and a 90-minute time limit, mixing multiple-choice and performance-based questions. You need a scaled score of 750 on a 100 to 900 scale. Because 750 is a scaled score and CompTIA weights questions differently, it does not map cleanly to a fixed percentage of questions answered correctly.

**What are the hardest parts of the SY0-701 exam?**
The performance-based questions are the most commonly cited challenge. They are interactive tasks, such as configuring firewall rules or reading logs, that usually appear first and effectively carry more weight than a single multiple-choice item. By volume, Domain 4, Security Operations, is the largest at 28 percent, and many candidates find Domain 3, Security Architecture, the most conceptually demanding.

**How should I study, especially for the PBQs?**
Start with the official CompTIA exam objectives and use them as your checklist. Combine four ingredients: a video course, a study book, hands-on practice, and a large bank of practice questions. For the performance-based questions, get hands-on with real or simulated tools so you can configure and analyze rather than memorize, then take full timed practice exams until you consistently score 80 percent or higher before you book.

**Is it easier if I already have Network+, A+, or IT experience?**
Yes, significantly. CompTIA recommends Network+ and about two years of systems or security administration experience before Security+. With that foundation, much of the networking and systems material is already familiar, so prep can shrink to a few weeks of targeted review rather than months of learning concepts from scratch.

### Security+ Exam Day: What to Expect (SY0-701)
Source: https://secplusmastery.com/security-plus-exam-day

**What is the Security+ exam format and length?**
You get a maximum of 90 questions and 90 minutes. The questions are a mix of multiple-choice and performance-based questions, and you may receive slightly fewer than 90. The passing score is 750 on a scale of 100 to 900.

**Should I test at a Pearson VUE center or online with OnVUE?**
The exam itself, including the questions, format, scoring, and retake rules, is identical either way. A test center gives you a controlled room, lockers for your belongings, biometric check-in, and the option of a short unscheduled break that counts against your time. OnVUE lets you test from home but requires a passed system test, a private and clear room, continuous webcam monitoring, and generally no breaks.

**What do I need for the OnVUE online exam, and what are the room rules?**
You need a computer running Windows 10 or later or macOS 14 or later, a working webcam, microphone, and speaker (no headphones), and internet of at least 6 Mbps download and 2 Mbps upload, and you must run and pass the system test first. The room must be private, quiet, and have a completely clear desk; phones, watches, notes, second monitors, other people, and pets must all be gone. Begin check-in 30 minutes before your appointment.

**What ID do I need, and does the name have to match?**
CompTIA requires two original, unexpired IDs: one primary government photo ID plus one secondary ID with at least your name and a signature or photo. Your first and last name must match your exam registration exactly on both. Note that US military IDs cannot be used to verify identity for the online OnVUE exam, although they are accepted as a primary ID at a test center.

**When do I find out if I passed, and what does the score report show?**
You see a preliminary pass or fail result and a score report immediately when you finish. The official result posts to your CompTIA certification account within about five business days. The report lists the exam objectives tied to questions you missed, but it does not tell you how many you got wrong or how many were needed to pass.

**What is the retake policy if I fail?**
You can retake the exam immediately after a first failure, with no waiting period. Before a third or any later attempt, you must wait at least 14 calendar days from your previous attempt. You pay the full exam fee for every attempt, and there is no cap on the number of attempts and no retake discount.

### Security+ Exam Objectives: Full SY0-701 Breakdown
Source: https://secplusmastery.com/security-plus-objectives

**How many objectives are on the Security+ exam?**
The CompTIA Security+ SY0-701 exam has 28 objectives across five domains: Domain 1 has 4, Domain 2 has 5, Domain 3 has 4, Domain 4 has 9, and Domain 5 has 6.

**What are the five Security+ domains and their exam weights?**
Domain 1 General Security Concepts (12%), Domain 2 Threats, Vulnerabilities, and Mitigations (22%), Domain 3 Security Architecture (18%), Domain 4 Security Operations (28%), and Domain 5 Security Program Management and Oversight (20%).

**Which Security+ domain is the largest?**
Domain 4, Security Operations, at 28% of the exam. It also has the most objectives, nine. Domain 2, Threats, Vulnerabilities, and Mitigations, is next at 22%.

**Are these the current Security+ objectives?**
Yes. These are the objectives for the current SY0-701 version of the exam, which CompTIA released in November 2023. It is the version you sit today.

**Where can I download the official Security+ objectives?**
CompTIA publishes the full objectives PDF on its website. This page summarizes the same five domains and 28 objectives and links free practice questions for each, so you can study the structure and test yourself in one place.

### Security+ Performance-Based Questions (PBQs)
Source: https://secplusmastery.com/security-plus-pbq

**What is a performance-based question on Security+?**
A performance-based question (PBQ) is an interactive task rather than multiple choice. Instead of picking an answer, you complete a job, such as configuring firewall rules, matching attacks to defenses, or reading logs to identify an incident, in a simulated environment.

**How many PBQs are on the Security+ exam?**
Usually a handful, often around two to five, and they typically appear first. The exam has a maximum of 90 questions in total and the rest are multiple choice. CompTIA does not publish an exact PBQ count, and it varies by exam form.

**Are PBQs worth more points than multiple-choice questions?**
CompTIA does not disclose exact weighting, but PBQs are generally treated as worth more than a single multiple-choice item because they test applied skill. Either way, do not let one hard PBQ eat all your time.

**What is the best way to handle PBQs on exam day?**
If a PBQ looks time-consuming, flag it and do the multiple-choice questions first, then come back with your remaining time. You can navigate back to it. Banking the quicker points first protects your score.

**Do you get partial credit on Security+ PBQs?**
In many cases, yes. PBQs are often scored per correct action, so completing part of the task still earns some points. That is another reason never to leave one completely blank.

**How do I practice for Security+ PBQs?**
Get hands-on rather than memorizing. Work with real or simulated tools to configure settings, read logs, and match controls to scenarios. SecPlus Mastery includes graded, interactive PBQ-style tasks across the objectives.

### Security+ Mnemonics and Memory Tricks (SY0-701)
Source: https://secplusmastery.com/security-plus-mnemonics

**Are these Security+ mnemonics free?**
Yes. Every memory hook on this page is free, and you can download the one-page PDF with no account, payment, or signup.

**What is the easiest way to remember AAA?**
Authentication, Authorization, Accounting, in that order. Who are you (authentication), what may you do (authorization), and what did you do (accounting).

**How do I remember RPO vs RTO?**
RPO is the recovery POINT objective: how much data you can lose, measured back to your last backup, so RPO equals data. RTO is the recovery TIME objective: how long you can be down, so RTO equals time.

**How do I tell IDS and IPS apart?**
An IDS only detects and alerts; it sits passively off to the side. An IPS prevents: it sits inline in the traffic path and can drop the attack. P is for Prevent and in-Path.

**Do mnemonics actually help on the Security+ exam?**
For dense acronyms and confusable pairs, yes. They give you a fast, reliable hook under time pressure. Treat them as a supplement to understanding the concept, not a replacement for it.

### Security+ Risk Management Cheat Sheet (Domain 5)
Source: https://secplusmastery.com/security-plus-risk-management

**What are the Security+ risk formulas?**
SLE = Asset Value x Exposure Factor (the cost of one incident). ARO is the Annualized Rate of Occurrence (how many times a year you expect it). ALE = SLE x ARO (the yearly cost). These are the core Domain 5 calculations.

**What is the difference between RTO and RPO?**
RTO (Recovery Time Objective) is how long you can be down before service must be restored. RPO (Recovery Point Objective) is how much data you can afford to lose, measured back to your last good backup. RTO is time; RPO is data.

**What are the four ways to respond to risk?**
Accept, avoid, transfer (for example, buying insurance), and mitigate (apply controls to reduce likelihood or impact). The exam may also mention risk acceptance with an exemption or exception.

**What is the difference between qualitative and quantitative risk analysis?**
Quantitative analysis assigns hard numbers, such as SLE, ARO, and ALE in dollars. Qualitative analysis uses ratings like high, medium, and low. Most real assessments blend the two.

**What do SLA, MOU, MSA, and BPA mean?**
SLA is a Service Level Agreement (performance and uptime commitments). MOU/MOA is a less formal statement of intent. MSA is a Master Service Agreement (overarching terms). BPA is a Business Partners Agreement. SOW is a Statement of Work (the specific deliverables). These third-party agreements are tested in Domain 5.

**Is this risk management cheat sheet free?**
Yes. The full cheat sheet and the printable PDF are free, with no account, payment, or signup required.

### Security+ SY0-801 (V8): What's Changing
Source: https://secplusmastery.com/security-plus-sy0-801

**Is SY0-801 the real exam code for the next Security+?**
Not confirmed. The exams-under-development page lists the next Security+ as "Security+ V8" and gives no exam code for it. Most people assume and search SY0-801, because the number has always gone up with each cycle, but until CompTIA publishes it that is a pattern rather than a fact. Treat any site stating SY0-801 as confirmed with caution, including the ones ranking for it.

**When does Security+ V8 come out?**
No date has been announced. The usual cadence puts it somewhere around November 17, 2026, but that is an estimate from past release patterns and nothing more. These dates move routinely, often by three to six months, so plan on the date you can actually rely on: SY0-701 can be booked through June 11, 2027.

**What is changing in the V8 domains?**
Draft revision 1.2 keeps the same five domains and moves the weights: General Security Concepts 12 to 16 percent, Threats, Vulnerabilities, and Mitigations 22 to 24 percent, Security Architecture 18 to 19 percent, Security Operations 28 to 27 percent, Security Program Management and Oversight 20 to 14 percent. Governance shrinks; the foundational and threat domains grow. Draft objectives change between revisions, so these numbers are a direction of travel and not a blueprint to study against.

**Can I study for V8 now?**
Not usefully. Drafts get published so that training providers can start building, and CompTIA says outright that a draft may contain issues. There is no V8 exam to sit, no confirmed objective list, and no item bank written against it anywhere. Studying a draft means memorising sentences that can be rewritten before launch. If you want to be certified in the next year, study SY0-701.

**Where can I read the V8 draft objectives myself?**
CompTIA publishes them free on the exam-objectives-under-development page, no purchase required. It is the only source worth reading on this subject, and every claim on this page is checked against it. The link is at the bottom.

**Does passing SY0-701 now become worthless when V8 launches?**
No. A CompTIA certification is tied to the certification, not to the exam version you passed. The certificate reads "CompTIA Security+" with no version number on it. It is valid for 3 years from the day you pass, and it renews through continuing education rather than by re-sitting whatever the current exam happens to be. Employers hire against "Security+", never against an exam code.

### SY0-701 or Wait for SY0-801? Which Security+ to Take
Source: https://secplusmastery.com/security-plus-701-or-801

**Should I take SY0-701 now or wait for SY0-801?**
Take SY0-701 now. It can be booked through June 11, 2027, which is longer than any realistic prep window, and the next version has no published exam code and no announced launch date. Waiting trades a certification you could hold in two months for one you might be able to sit for at some point, and every month you wait is a month you are not certified.

**Does the certificate say which exam version I passed?**
No. The credential reads "CompTIA Security+" and the version is not printed on it. The credential stays valid for 3 years from the day you pass and renews through continuing education, so somebody who passes SY0-701 and somebody who passes the next version hold the same certification. No employer, job posting, or HR filter asks which exam code you sat.

**What happens to my SY0-701 certification when the exam retires?**
Nothing. Retirement means the exam stops being bookable. It does not mean certifications earned from it expire early. Your three years run from your pass date regardless of what CompTIA does to the exam afterwards, and you renew by earning continuing education units rather than by sitting the new version.

**Is there a case for waiting?**
One, and it is narrow. Say you cannot start studying for several months anyway, and you would be booking close to June 11, 2027. Then you are choosing between a rushed SY0-701 attempt and a comfortable run at the new version, and that is a real decision. For anyone able to start now, it is not, because a typical prep run is four to twelve weeks and that fits several times over.

**Will my study materials be wasted?**
Mostly no. A Security+ revision rewrites and reweights rather than replacing: the domains keep their subjects and a large share of the objectives survive with new wording. That is why our Lifetime plan includes the Security+ V8 update free and carries your progress across rather than resetting it. The 90-Day Pass covers SY0-701 for its window, which is all a 90-day window can cover.

**What if I fail and the exam retires before I can retake it?**
You have until June 11, 2027 to sit it, retakes included, and CompTIA requires no wait before a second attempt. What actually catches people out is booking before they are ready, not the retirement date. Score 80 percent or better on full timed practice exams before you book and the retake question mostly stops applying.

### AI Security for Security+: Prompt Injection
Source: https://secplusmastery.com/security-plus-ai-security

**Is AI security on the Security+ SY0-701 exam?**
No, not as its own objective. The published SY0-701 objectives do not name prompt injection, model poisoning, or generated phishing, so nothing on this page will be asked under those terms. It is here as bonus material because the underlying vectors sit right next to objectives that ARE examined, and because Security+ V8 is in draft and this is the clearest new subject in it.

**What is prompt injection?**
Untrusted text reaching a language model gets treated as instructions instead of as data. Direct injection is a user typing them. Indirect injection is the one that matters in practice: the instructions are hidden in a web page, document, ticket, or invite that the model reads, so nobody involved ever typed them. Structurally it is the same failure as SQL injection, which is data crossing into an instruction channel.

**How do you defend against prompt injection?**
Assume the injection succeeds and limit what it can reach. Apply least privilege to every tool and credential the model can use, require human approval for consequential actions such as sending mail or moving money, treat anything the model outputs as untrusted input before it reaches a shell or a query, and keep secrets out of the system prompt. Wording the prompt more firmly is a request, never a control.

**What is model poisoning?**
An attacker corrupts the data a model learns from, or the model artifact itself, so the deployed model behaves the way the attacker chose. The targeted form is a backdoor: the model is accurate on everything except a trigger the attacker picked, which is why it survives testing. Downloading a tampered model from a public hub achieves the same thing with no training at all, which makes it a supply-chain problem.

**Why is AI-assisted phishing harder to spot?**
Because the cue most awareness training relies on has stopped working. Spelling and grammar mistakes were only ever an artifact of who was writing, and generated text removes them for free while adding personalisation from public profile data. Voice and video cloning extend the same problem to calls. Urgency, unusual channels, and requests that bypass process are still reliable; spelling is not.

**What actually stops a convincing generated phish?**
Two things that do not depend on anyone noticing. Phishing-resistant MFA, meaning FIDO2 security keys or passkeys, binds the credential to the real site, so a relayed login on a lookalike domain produces nothing usable even from a fully convinced user. And process controls such as out-of-band verification on payment changes and dual authorisation on transfers remove the single point of human judgement the pretext is aiming at.

### Security+ Cram Sheet: Last-Minute Review (SY0-701)
Source: https://secplusmastery.com/security-plus-cram-sheet

**What should I review the night before the Security+ exam?**
Review facts prone to confusion, like port numbers and their secure replacements, risk formulas, incident response order, the order of volatility, and control categories versus types. Don't begin a new topic you haven't studied. There's not enough time for it to stick and it cuts into sleep.

**Can you pass Security+ by cramming?**
Not from nothing. The exam has up to 90 questions in 90 minutes, with many scenario questions that require understanding over rote memorization. Cramming helps just at the end for recalling facts on this sheet after you've worked through all five domains.

**What are the most commonly confused Security+ topics?**
The ones people struggle with most are control categories versus control types and incremental versus differential backups. RTO and RPO get mixed up a lot too, as do IDS and IPS. Each pair is listed above with differences noted in a few lines.

**How do I know I am ready to take Security+?**
Take a full timed practice test and analyze the results by domain. If you score well across every domain, not just on average, you're close. But if one domain scores much lower than others, spend your remaining time there instead of rereading this sheet, or move the appointment. You can push a test center booking back up to 24 hours ahead, and an online one right up to its start time.

### Security+ in 2 Weeks: A 14-Day Study Plan
Source: https://secplusmastery.com/security-plus-2-week-study-plan

**Can you pass Security+ in 2 weeks?**
Yes, if you have an IT background or have studied the material before. People with Network+ or A+ certifications, or a few years in IT, already know a lot about networking and systems, so two weeks of focused review would be realistic for them. For those starting from scratch, our difficulty guide suggests twelve to sixteen weeks.

**How many hours a day does a 2-week Security+ plan take?**
About three to four focused hours a day, or roughly 40 to 55 hours across two weeks. If you have fewer hours than that, the plan will require more days rather than cramming at the end.

**What if my practice test scores are low on day 12?**
Move the exam rather than hoping it works out. For a test center appointment, you can reschedule up to 24 hours before it starts; for an online exam, you can do so up to its start time without losing your fee. Missing those windows means losing the fee, so make the decision on day 12 and not the night before.

**Is the 30-day plan better than the 2-week plan?**
For many people, yes. It includes the same five domains but with more review space available, and review helps material stick. Use the two-week plan if your test date is very near or most of the content is familiar.

### Failed Security+? Retake Policy and a Plan
Source: https://secplusmastery.com/security-plus-retake

**How soon can I retake Security+?**
Right away for a second try; nothing makes you wait between the first and second time. For a third or later attempt, you must wait at least 14 calendar days from your last test.

**Do I have to pay again to retake Security+?**
Yes, unless your voucher included a retake. CompTIA charges the full exam fee each time and doesn't offer free retakes or discounts. A bundle that comes with a retake activates only if you fail the first one.

**Will the Security+ retake have the same questions?**
Don't rely on memorizing questions from your first test. Instead, look over the objectives listed on your score report.

**How many times can you take Security+?**
You can take as many retakes as you need since there's no limit set by the retake policy. However, after your second try, you must wait at least 14 calendar days before each subsequent attempt, and every resit costs the full exam fee.

**What does the Security+ score report show?**
The scaled score, the passing mark of 750, and a list of the exam objectives tied to questions you got wrong. However, it doesn't tell you how many questions were missed or how many needed to be answered correctly to pass.

**Should I wait for the next Security+ version before retaking?**
Not if you're partway through. SY0-701 remains available until CompTIA retires it, and our guide comparing SY0-701 to the upcoming version has the dates.

### IDS vs IPS: Difference Explained (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/ids-vs-ips

**Is an IPS just an IDS that blocks?**
Essentially yes. An IPS performs the same detection an IDS does, but because it sits inline it can drop or reset malicious traffic instead of only alerting on it.

**Can one device be both an IDS and an IPS?**
Yes. Many next-generation firewalls and security appliances include both, and you can run a given signature in detect (alert only) or prevent (block) mode.

### Symmetric vs Asymmetric Encryption (Security+)
Source: https://secplusmastery.com/security-plus/symmetric-vs-asymmetric-encryption

**Which is more secure, symmetric or asymmetric encryption?**
Neither is inherently more secure; they solve different problems. Strength depends on the algorithm and key length. In practice they are used together.

**Is AES symmetric or asymmetric?**
AES is symmetric: the same key encrypts and decrypts. RSA and ECC are the common asymmetric algorithms, used for key exchange and digital signatures.

### Authentication vs Authorization (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/authentication-vs-authorization

**Which comes first, authentication or authorization?**
Authentication. The system must confirm who you are before it can decide what you are allowed to do.

**Where does accounting fit in?**
Accounting is the third A in AAA. After you authenticate and are authorized, accounting records what you did through logging, auditing, and session data.

### Hashing vs Encryption: The Difference (Security+)
Source: https://secplusmastery.com/security-plus/hashing-vs-encryption

**Can you decrypt a hash?**
No. Hashing is one-way by design. Attackers can only guess inputs and compare hashes, which is why salting and slow hashes such as bcrypt, scrypt, and Argon2 matter for passwords.

**Why hash passwords instead of encrypting them?**
Encryption is reversible, so a stolen key would expose every password. A salted one-way hash cannot be reversed, so even the provider never stores the actual password.

### TCP vs UDP: Difference Explained (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/tcp-vs-udp

**Why does DNS use UDP?**
DNS queries are small and fast, so the low overhead of UDP fits. DNS switches to TCP for zone transfers and for responses too large for a single UDP packet.

**What is the TCP three-way handshake?**
SYN, SYN-ACK, ACK. The client and server exchange these to establish a connection before data flows. It also underlies the SYN flood attack, so know the sequence.

### Vulnerability vs Threat vs Risk (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/vulnerability-vs-threat-vs-risk

**What is the relationship between vulnerability, threat, and risk?**
A threat is the danger, a vulnerability is the weakness it targets, and risk is the likelihood and impact if the threat exploits the vulnerability. Remove the vulnerability and the same threat carries far less risk.

**What are the ways to respond to risk?**
The four classic responses are accept, avoid, transfer (for example, insurance), and mitigate (apply controls to reduce likelihood or impact).

### MAC vs DAC vs RBAC: Access Control Models
Source: https://secplusmastery.com/security-plus/mac-vs-dac-vs-rbac

**What is the difference between MAC and DAC?**
In MAC the system enforces access using labels and clearances, and users cannot change them. In DAC the resource owner decides who gets access, which is more flexible but easier to misconfigure.

**Is RBAC the same as rule-based access control?**
No, though both are abbreviated RBAC. Role-based control grants access by job role; rule-based control applies conditions such as time of day or source IP. The exam distinguishes the two.

### Security+ vs Network+: Which to Take First
Source: https://secplusmastery.com/security-plus/security-plus-vs-network-plus

**Should I take Network+ before Security+?**
It helps but is not required. Network+ builds the networking foundation that several Security+ topics rely on, so many people take it first. If you already understand networking basics, you can go straight to Security+.

**Which is better for a cybersecurity job, Security+ or Network+?**
Security+. It is the baseline cybersecurity certification employers and the DoD ask for. Network+ proves networking skills, which support a security role but do not replace Security+.

### Security+ vs CySA+: Difference and Which First
Source: https://secplusmastery.com/security-plus/security-plus-vs-cysa-plus

**Is CySA+ harder than Security+?**
Yes. CySA+ is an intermediate analyst certification that goes deeper into detection, log analysis, and incident response, and it assumes the foundational knowledge Security+ covers. Most candidates earn Security+ first.

**Should I get Security+ or CySA+ for a SOC analyst job?**
Get Security+ first to cover the fundamentals and clear hiring filters, then CySA+ to prove hands-on analyst skills. Many SOC roles list Security+ as a baseline and treat CySA+ as a plus.

### Security+ vs CISSP: Entry vs Advanced Cert
Source: https://secplusmastery.com/security-plus/security-plus-vs-cissp

**Can I take CISSP instead of Security+?**
You can sit the CISSP exam without experience, but you only become fully certified after proving five years of paid security work; until then you are an Associate of ISC2. Security+ has no experience requirement, so it is the realistic starting point.

**Is CISSP harder than Security+?**
Much harder. CISSP is an advanced, broad, management-level exam with a multi-year experience requirement. Security+ is a foundational technical exam designed for people entering the field.

### Security+ vs A+: Which CompTIA Cert to Take
Source: https://secplusmastery.com/security-plus/security-plus-vs-a-plus

**Do I need A+ before Security+?**
No. A+ is not a prerequisite for Security+. A+ helps if you are new to IT, but if you already have IT experience or want a security role specifically, you can take Security+ directly.

**Is Security+ harder than A+?**
They test different things. Security+ is a single, security-focused exam; A+ is two broader IT-support exams. Many people find Security+ more conceptual, while A+ covers more breadth of hardware and operating systems.

### Security+ vs CEH: Defense vs Ethical Hacking
Source: https://secplusmastery.com/security-plus/security-plus-vs-ceh

**Should I take Security+ or CEH first?**
Security+ first. It is cheaper, vendor-neutral, and the baseline most security jobs require. CEH is a specialized offensive-security cert that makes more sense once you want a penetration-testing or red-team role.

**Is CEH worth it compared to Security+?**
They serve different goals. Security+ opens the door to most entry security and SOC roles. CEH targets offensive security specifically and costs significantly more, often bundled with training, so its value depends on whether you want a hacking-focused role.

### TLS vs SSL: The Difference (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/tls-vs-ssl

**Is SSL the same as TLS?**
They are closely related but not the same. TLS is the successor to SSL. All SSL versions are deprecated and insecure, so modern secure connections use TLS even when people still call it "SSL."

**Which TLS version should I use?**
TLS 1.2 at minimum, and TLS 1.3 where supported. TLS 1.0 and 1.1 are deprecated, and all SSL versions should be disabled.

### SIEM vs SOAR: The Difference (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/siem-vs-soar

**What is the difference between SIEM and SOAR?**
A SIEM aggregates and correlates log data to detect and alert on suspicious activity. SOAR takes alerts and automates the response with playbooks. SIEM is about visibility and detection; SOAR is about automated response.

**Does SOAR replace SIEM?**
No. SOAR usually sits on top of a SIEM and consumes its alerts. The SIEM detects, and SOAR orchestrates the response, so most SOCs use both.

### RTO vs RPO: The Difference (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/rto-vs-rpo

**What is the difference between RTO and RPO?**
RTO (Recovery Time Objective) is the maximum acceptable time to restore a service after an outage. RPO (Recovery Point Objective) is the maximum acceptable amount of data loss, measured as time back to the last good backup. RTO is time; RPO is data.

**How does RPO affect backup frequency?**
Your RPO sets a ceiling on how much data you can lose, so backups must run at least that often. A one-hour RPO means backing up at least every hour, or using continuous replication.

### WPA2 vs WPA3: The Difference (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/wpa2-vs-wpa3

**Is WPA3 more secure than WPA2?**
Yes. WPA3 replaces the WPA2 pre-shared key 4-way handshake with SAE, which blocks the offline password-guessing and KRACK attacks WPA2 is vulnerable to, and adds forward secrecy.

**What is SAE in WPA3?**
SAE (Simultaneous Authentication of Equals), also called the Dragonfly handshake, is the WPA3 personal key-exchange method. It replaces the WPA2 4-way handshake and prevents attackers from capturing the exchange and brute-forcing the password offline.

### Vulnerability Scan vs Penetration Test (Security+)
Source: https://secplusmastery.com/security-plus/vulnerability-scan-vs-penetration-test

**What is the difference between a vulnerability scan and a penetration test?**
A vulnerability scan is an automated check that identifies and lists known weaknesses. A penetration test goes further, actively exploiting weaknesses to demonstrate real-world impact. Scanning is broad and frequent; pen testing is deep, intrusive, and periodic.

**Do I need both a vulnerability scan and a penetration test?**
Usually yes. Vulnerability scans run frequently to catch new issues cheaply, while penetration tests periodically validate which findings are genuinely exploitable. Many compliance frameworks require both.

### Red vs Blue vs Purple Team (Security+ SY0-701)
Source: https://secplusmastery.com/security-plus/red-team-vs-blue-team-vs-purple-team

**What is the difference between red, blue, and purple teams?**
The red team plays the attacker and tries to breach systems. The blue team defends, detecting and responding to those attacks. The purple team is the collaboration between them, making sure the defenders learn from exactly how the attackers got in.

**Is purple team a separate team?**
Often not. Purple team usually describes a function or exercise where red and blue work together and share findings in real time, rather than a permanent standalone team. Its goal is to maximize the value both sides get.

### Security+ Domain 1 Practice: Security Concepts
Source: https://secplusmastery.com/security-plus-domain-1-practice

**Are these Security+ Domain 1 practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**How much of the Security+ exam is Domain 1?**
Domain 1, General Security Concepts, accounts for about 12% of the CompTIA Security+ SY0-701 exam.

### Security+ Domain 2 Practice: Threats and Mitigations
Source: https://secplusmastery.com/security-plus-domain-2-practice

**Are these Security+ Domain 2 practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**How much of the Security+ exam is Domain 2?**
Domain 2, Threats, Vulnerabilities, and Mitigations, accounts for about 22% of the CompTIA Security+ SY0-701 exam.

### Security+ Domain 3 Practice: Security Architecture
Source: https://secplusmastery.com/security-plus-domain-3-practice

**Are these Security+ Domain 3 practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**How much of the Security+ exam is Domain 3?**
Domain 3, Security Architecture, accounts for about 18% of the CompTIA Security+ SY0-701 exam.

### Security+ Domain 4 Practice: Security Operations
Source: https://secplusmastery.com/security-plus-domain-4-practice

**Are these Security+ Domain 4 practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**How much of the Security+ exam is Domain 4?**
Domain 4, Security Operations, accounts for about 28% of the CompTIA Security+ SY0-701 exam.

### Security+ Domain 5 Practice: Program Management
Source: https://secplusmastery.com/security-plus-domain-5-practice

**Are these Security+ Domain 5 practice questions free?**
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.

**How much of the Security+ exam is Domain 5?**
Domain 5, Security Program Management and Oversight, accounts for about 20% of the CompTIA Security+ SY0-701 exam.

## Security+ SY0-701 acronym glossary

The full glossary is at https://secplusmastery.com/glossary; each term also has its own page at /glossary/<acronym>.

- **AAA** (Authentication, Authorization, and Accounting): The framework for controlling access: prove who you are, decide what you can do, and record what you did.
- **ACL** (Access Control List): An ordered set of rules that permits or denies traffic or access to a resource.
- **AES** (Advanced Encryption Standard): The widely used symmetric block cipher that replaced DES, available in 128, 192, and 256-bit keys.
- **AES-256** (Advanced Encryption Standard 256-bit): AES using a 256-bit key, the strongest standard AES variant.
- **AH** (Authentication Header): The IPSec protocol that provides integrity and authentication but not confidentiality.
- **AI** (Artificial Intelligence): Systems that perform tasks normally requiring human reasoning, increasingly used by both defenders and attackers.
- **AIS** (Automated Indicator Sharing): A capability that lets organizations exchange cyber threat indicators in real time.
- **ALE** (Annualized Loss Expectancy): The expected yearly cost of a risk, calculated as SLE multiplied by ARO.
- **AP** (Access Point): A device that lets wireless clients connect to a wired network.
- **API** (Application Programming Interface): A defined interface that lets software components talk to each other; a common attack surface.
- **APT** (Advanced Persistent Threat): A well-resourced, stealthy adversary (often nation-state) that maintains long-term access.
- **ARO** (Annualized Rate of Occurrence): How many times per year a given risk is expected to happen.
- **ARP** (Address Resolution Protocol): Maps IP addresses to MAC addresses on a local network; spoofable for on-path attacks.
- **ASLR** (Address Space Layout Randomization): A memory protection that randomizes process address layout to hinder exploitation.
- **ATT&CK** (Adversarial Tactics, Techniques, and Common Knowledge): The MITRE knowledge base of real-world attacker behaviors used for detection and mapping.
- **AUP** (Acceptable Use Policy): A policy defining how employees may use organizational systems and data.
- **AV** (Antivirus): Software that detects and removes malware, traditionally using signatures.
- **BASH** (Bourne Again Shell): A common Unix and Linux command shell often abused in scripting-based attacks.
- **BCP** (Business Continuity Plan): The plan for keeping critical business functions running during and after a disruption.
- **BGP** (Border Gateway Protocol): The routing protocol of the internet; route hijacking targets it.
- **BIA** (Business Impact Analysis): The process that identifies critical functions and the impact of their loss, producing RTO and RPO.
- **BIOS** (Basic Input/Output System): Legacy firmware that initializes hardware at boot, largely replaced by UEFI.
- **BPA** (Business Partners Agreement): A contract defining the terms and responsibilities between business partners.
- **BPDU** (Bridge Protocol Data Unit): Spanning Tree Protocol messages; BPDU Guard protects against rogue switches.
- **BYOD** (Bring Your Own Device): A model allowing personal devices for work, raising data and management concerns.
- **CA** (Certificate Authority): A trusted entity that issues and signs digital certificates in a PKI.
- **CAPTCHA** (Completely Automated Public Turing Test to Tell Computers and Humans Apart): A challenge that distinguishes humans from bots to limit automation abuse.
- **CAR** (Corrective Action Report): A document recording the steps taken to fix a problem and prevent recurrence.
- **CASB** (Cloud Access Security Broker): A control point between users and cloud services that enforces security policy.
- **CBC** (Cipher Block Chaining): A block cipher mode where each block is XORed with the previous ciphertext block.
- **CCMP** (Counter Mode/CBC-MAC Protocol): The AES-based encryption protocol used by WPA2.
- **CCTV** (Closed-Circuit Television): Video surveillance, a physical detective and deterrent control.
- **CERT** (Computer Emergency Response Team): A team that responds to and coordinates handling of security incidents.
- **CFB** (Cipher Feedback): A block cipher mode that turns a block cipher into a self-synchronizing stream cipher.
- **CHAP** (Challenge Handshake Authentication Protocol): An authentication protocol that verifies identity using a periodic challenge and response.
- **CIA** (Confidentiality, Integrity, and Availability): The core triad of information security goals.
- **CIO** (Chief Information Officer): The executive responsible for information technology strategy and operations.
- **CIRT** (Computer Incident Response Team): The designated team that detects, analyzes, and responds to security incidents.
- **CMS** (Content Management System): Software for creating and managing digital content, such as a website platform.
- **COOP** (Continuity of Operations Plan): A plan ensuring essential functions continue during a wide range of emergencies.
- **COPE** (Corporate-Owned, Personally Enabled): A device model where the company owns the device but allows personal use.
- **CP** (Contingency Planning): Preparing alternative courses of action for adverse events.
- **CRC** (Cyclic Redundancy Check): An error-detecting code that checks data integrity in transit or storage.
- **CRL** (Certificate Revocation List): A published list of certificates a CA has revoked before their expiry.
- **CSO** (Chief Security Officer): The executive accountable for the overall security of an organization.
- **CSP** (Cloud Service Provider): A vendor that delivers computing services over the internet, such as IaaS or SaaS.
- **CSR** (Certificate Signing Request): A request containing a public key and identity, submitted to a CA to obtain a certificate.
- **CSRF** (Cross-Site Request Forgery): An attack that tricks an authenticated user into submitting unwanted requests.
- **CSU** (Channel Service Unit): A device connecting a terminal to a digital line, often paired with a DSU.
- **CTM** (Counter Mode): A block cipher mode that turns a block cipher into a stream cipher by encrypting successive counter values.
- **CTO** (Chief Technology Officer): The executive responsible for technology direction and engineering.
- **CVE** (Common Vulnerabilities and Exposures): A standardized identifier for a publicly known vulnerability.
- **CVSS** (Common Vulnerability Scoring System): A framework that rates vulnerability severity on a 0 to 10 scale.
- **CYOD** (Choose Your Own Device): A model letting employees pick a work device from an approved list.
- **DAC** (Discretionary Access Control): An access model where resource owners decide who gets access.
- **DBA** (Database Administrator): The role responsible for managing and securing databases.
- **DDoS** (Distributed Denial-of-Service): A flood of traffic from many sources that overwhelms a target service.
- **DEP** (Data Execution Prevention): A memory protection that marks regions non-executable to block code injection.
- **DES** (Data Encryption Standard): An obsolete 56-bit symmetric cipher, broken by modern brute force.
- **DHCP** (Dynamic Host Configuration Protocol): Automatically assigns IP addresses and network settings to hosts.
- **DHE** (Diffie-Hellman Ephemeral): A key exchange that generates a fresh key per session for forward secrecy.
- **DKIM** (DomainKeys Identified Mail): An email authentication method that signs messages to prove domain origin.
- **DLL** (Dynamic Link Library): Shared Windows code modules; DLL injection and sideloading are common attacks.
- **DLP** (Data Loss Prevention): Technology that detects and blocks unauthorized movement of sensitive data.
- **DMARC** (Domain-based Message Authentication, Reporting, and Conformance): An email policy framework built on SPF and DKIM to fight spoofing.
- **DNAT** (Destination Network Address Translation): Rewrites the destination address of packets, often for port forwarding.
- **DNS** (Domain Name System): Resolves human-readable names to IP addresses; a frequent attack and exfiltration channel.
- **DNSSEC** (Domain Name System Security Extensions): Adds cryptographic signatures to DNS to prevent spoofing and cache poisoning.
- **DoS** (Denial-of-Service): An attack that makes a resource unavailable to legitimate users.
- **DPO** (Data Protection Officer): The role accountable for an organization's data privacy compliance.
- **DRP** (Disaster Recovery Plan): The plan for restoring IT systems and data after a major disruption.
- **DSA** (Digital Signature Algorithm): A standard for generating and verifying digital signatures.
- **DSL** (Digital Subscriber Line): A broadband technology that carries data over ordinary copper telephone lines.
- **EAP** (Extensible Authentication Protocol): A flexible authentication framework widely used in wireless and 802.1X.
- **ECB** (Electronic Codebook): A weak block cipher mode that encrypts identical blocks identically, leaking patterns.
- **ECC** (Elliptic Curve Cryptography): Public-key cryptography offering strong security with smaller keys.
- **ECDHE** (Elliptic Curve Diffie-Hellman Ephemeral): An ephemeral key exchange using elliptic curves for forward secrecy.
- **ECDSA** (Elliptic Curve Digital Signature Algorithm): A digital signature algorithm based on elliptic curve cryptography.
- **EDR** (Endpoint Detection and Response): Tooling that monitors endpoints for threats and supports investigation and response.
- **EFS** (Encrypting File System): A Windows feature that encrypts individual files and folders.
- **ERP** (Enterprise Resource Planning): Integrated software managing core business processes such as finance and HR.
- **ESN** (Electronic Serial Number): A unique identifier assigned to a mobile device.
- **ESP** (Encapsulating Security Payload): The IPSec protocol that provides confidentiality, integrity, and authentication.
- **FACL** (File System Access Control List): Per-file or per-directory permissions that control access at the filesystem level.
- **FAR** (False Acceptance Rate): In biometrics, the rate at which unauthorized users are wrongly accepted.
- **FDE** (Full Disk Encryption): Encryption of an entire drive so data is protected at rest.
- **FIM** (File Integrity Monitoring): Detects unauthorized changes to critical files by comparing against a baseline.
- **FPGA** (Field Programmable Gate Array): A reconfigurable hardware chip used in specialized and embedded systems.
- **FRR** (False Rejection Rate): In biometrics, the rate at which legitimate users are wrongly denied.
- **FTP** (File Transfer Protocol): A legacy file transfer protocol that sends credentials and data in cleartext.
- **FTPS** (File Transfer Protocol Secure): FTP wrapped in TLS for encrypted file transfer.
- **GCM** (Galois/Counter Mode): An authenticated encryption mode providing both confidentiality and integrity.
- **GDPR** (General Data Protection Regulation): The European Union regulation governing personal data protection and privacy.
- **GPG** (GNU Privacy Guard): An open-source implementation of the OpenPGP standard for encryption and signing.
- **GPO** (Group Policy Object): A Windows mechanism for centrally configuring users and computers in a domain.
- **GPS** (Global Positioning System): Satellite-based location service; spoofing can mislead navigation and geofencing.
- **GPU** (Graphics Processing Unit): A parallel processor; often used to accelerate password cracking.
- **GRE** (Generic Routing Encapsulation): A tunneling protocol that encapsulates many network layer protocols.
- **HA** (High Availability): Designing systems for minimal downtime through redundancy and failover.
- **HDD** (Hard Disk Drive): A magnetic storage device; secure disposal requires wiping or destruction.
- **HIDS** (Host-based Intrusion Detection System): Software on a host that detects suspicious activity and alerts.
- **HIPS** (Host-based Intrusion Prevention System): Host software that detects and actively blocks malicious activity.
- **HMAC** (Hash-based Message Authentication Code): A keyed hash that verifies both integrity and authenticity of a message.
- **HOTP** (HMAC-based One-Time Password): A one-time password generated from a counter and a shared secret.
- **HSM** (Hardware Security Module): A tamper-resistant device that generates, stores, and manages cryptographic keys.
- **HTML** (Hypertext Markup Language): The markup language for web pages; a vector for injection when unsanitized.
- **HTTP** (Hypertext Transfer Protocol): The cleartext protocol for web traffic on port 80.
- **HTTPS** (Hypertext Transfer Protocol Secure): HTTP secured with TLS on port 443.
- **HVAC** (Heating, Ventilation, and Air Conditioning): Environmental controls; a target as an OT system and a data-center dependency.
- **IaaS** (Infrastructure as a Service): A cloud model providing virtual machines, storage, and networking.
- **IaC** (Infrastructure as Code): Managing infrastructure through machine-readable definition files.
- **IAM** (Identity and Access Management): The discipline of managing digital identities and their access rights.
- **ICMP** (Internet Control Message Protocol): A network diagnostic protocol used by ping; abused for scanning and floods.
- **ICS** (Industrial Control System): Systems that control industrial processes, often fragile and long-lived.
- **IDEA** (International Data Encryption Algorithm): A 64-bit-block symmetric cipher with a 128-bit key, historically used in early PGP.
- **IDF** (Intermediate Distribution Frame): A wiring closet that connects end devices back to the main distribution frame.
- **IdP** (Identity Provider): A service that authenticates users and asserts identity to relying parties.
- **IDS** (Intrusion Detection System): Monitors traffic or hosts and alerts on suspected malicious activity.
- **IEEE** (Institute of Electrical and Electronics Engineers): A standards body responsible for protocols such as 802.1X and 802.11.
- **IKE** (Internet Key Exchange): The protocol that negotiates security associations and keys for IPSec.
- **IM** (Instant Messaging): Real-time text communication; a channel for phishing and data leakage.
- **IMAP** (Internet Message Access Protocol): A protocol for retrieving and managing email on a server.
- **IoC** (Indicators of Compromise): Forensic artifacts, such as hashes or IPs, that signal a breach.
- **IoT** (Internet of Things): Networked everyday devices that often lack strong security controls.
- **IP** (Internet Protocol): The core protocol for addressing and routing packets across networks.
- **IPS** (Intrusion Prevention System): Inspects traffic inline and blocks detected threats.
- **IPSec** (Internet Protocol Security): A suite that authenticates and encrypts IP traffic, used for VPNs.
- **IR** (Incident Response): The organized approach to handling and recovering from security incidents.
- **IRC** (Internet Relay Chat): A chat protocol historically used for botnet command and control.
- **IRP** (Incident Response Plan): The documented procedures for detecting and handling incidents.
- **ISO** (International Organization for Standardization): A body that publishes standards such as the ISO 27000 security series.
- **ISP** (Internet Service Provider): A company that provides internet connectivity.
- **ISSO** (Information Systems Security Officer): The role responsible for the security of a specific information system.
- **IV** (Initialization Vector): A random value that ensures identical plaintext encrypts differently each time.
- **KDC** (Key Distribution Center): The Kerberos component that issues tickets for authentication.
- **KEK** (Key Encryption Key): A key used to encrypt other keys, central to key management.
- **L2TP** (Layer 2 Tunneling Protocol): A VPN tunneling protocol usually paired with IPSec for encryption.
- **LAN** (Local Area Network): A network covering a small area such as an office or building.
- **LDAP** (Lightweight Directory Access Protocol): A protocol for querying and modifying directory services like Active Directory.
- **LEAP** (Lightweight Extensible Authentication Protocol): A Cisco EAP variant now considered weak and deprecated.
- **MaaS** (Monitoring as a Service): Cloud-delivered monitoring of systems and security events.
- **MAC** (Mandatory Access Control): An access model where the system enforces access based on labels and clearances.
- **MAC (address)** (Media Access Control Address): A hardware identifier for a network interface; spoofable to bypass filtering.
- **MAC (message)** (Message Authentication Code): A short tag that verifies a message's integrity and authenticity.
- **MAN** (Metropolitan Area Network): A network spanning a city or large campus.
- **MBR** (Master Boot Record): The first sector of a legacy-partitioned disk that holds boot code and the partition table.
- **MD5** (Message Digest 5): A 128-bit cryptographic hash function that is now broken and must not be used for security.
- **MDF** (Main Distribution Frame): The central wiring point where external lines meet internal cabling.
- **MDM** (Mobile Device Management): Software for centrally enforcing policy on mobile devices.
- **MFA** (Multifactor Authentication): Authentication using two or more distinct factor types.
- **MFD** (Multifunction Device): A combined printer, scanner, and copier that is also a network endpoint.
- **MFP** (Multifunction Printer): A networked printer with scanning and faxing; an often-overlooked attack surface.
- **ML** (Machine Learning): A subset of AI where systems learn patterns from data, used in detection and attacks.
- **MMS** (Multimedia Messaging Service): A messaging standard for sending media; a mobile attack vector.
- **MOA** (Memorandum of Agreement): A formal agreement defining roles and responsibilities between parties.
- **MOU** (Memorandum of Understanding): A non-binding statement of intent between parties.
- **MPLS** (Multiprotocol Label Switching): A high-performance routing technique using labels rather than addresses.
- **MSA** (Master Service Agreement): An overarching contract setting general terms for future engagements.
- **MSCHAP** (Microsoft Challenge Handshake Authentication Protocol): A Microsoft authentication protocol using a challenge and response, now considered weak.
- **MSP** (Managed Service Provider): A vendor that remotely manages a customer's IT infrastructure.
- **MSSP** (Managed Security Service Provider): A vendor that delivers outsourced monitoring and security management.
- **MTBF** (Mean Time Between Failures): The average operating time between failures of a repairable system.
- **MTTF** (Mean Time to Failure): The average lifespan of a non-repairable component.
- **MTTR** (Mean Time to Repair): The average time required to restore a failed system.
- **MTU** (Maximum Transmission Unit): The largest packet size a network link can carry without fragmentation.
- **NAC** (Network Access Control): Enforces policy on devices before granting network access.
- **NAT** (Network Address Translation): Maps private addresses to public ones, hiding internal hosts.
- **NDA** (Non-Disclosure Agreement): A contract that legally protects shared confidential information.
- **NFC** (Near Field Communication): Very short-range wireless used for contactless payments and pairing.
- **NGFW** (Next-Generation Firewall): A firewall adding deep inspection, application awareness, and IPS.
- **NIDS** (Network-based Intrusion Detection System): Monitors network traffic for malicious activity and alerts.
- **NIPS** (Network-based Intrusion Prevention System): Inspects network traffic inline and blocks threats.
- **NIST** (National Institute of Standards and Technology): A US agency that publishes widely used security frameworks and guidance.
- **NTFS** (New Technology File System): The Windows file system supporting permissions, encryption, and auditing.
- **NTLM** (New Technology LAN Manager): A legacy Windows authentication protocol vulnerable to relay and pass-the-hash.
- **NTP** (Network Time Protocol): Synchronizes clocks across systems, critical for logging and certificates.
- **OAuth** (Open Authorization): A standard that delegates access to resources without sharing credentials.
- **OCSP** (Online Certificate Status Protocol): A real-time protocol for checking whether a certificate is revoked.
- **OID** (Object Identifier): A globally unique identifier used in certificates and directory schemas.
- **OS** (Operating System): The software that manages hardware and runs applications.
- **OSINT** (Open-Source Intelligence): Intelligence gathered from publicly available sources.
- **OSPF** (Open Shortest Path First): A link-state interior routing protocol.
- **OT** (Operational Technology): Hardware and software that monitors and controls physical processes.
- **OTA** (Over-the-Air): Wireless delivery of updates or configuration to devices.
- **OVAL** (Open Vulnerability and Assessment Language): A standardized XML language for describing system state to test for vulnerabilities and configuration.
- **P12** (PKCS #12): A file format that bundles a private key with its certificate chain, usually password protected.
- **P2P** (Peer-to-Peer): A decentralized network model; a channel for data leakage and malware.
- **PaaS** (Platform as a Service): A cloud model providing a managed platform for building applications.
- **PAC** (Proxy Auto Configuration): A file that tells browsers which proxy to use for given URLs.
- **PAM** (Privileged Access Management): Controls and monitors elevated accounts, often with vaulting and just-in-time access.
- **PAM (modules)** (Pluggable Authentication Modules): A Unix and Linux framework for integrating authentication methods.
- **PAP** (Password Authentication Protocol): A legacy authentication protocol that transmits passwords in cleartext.
- **PAT** (Port Address Translation): NAT variant that maps many private hosts to one public IP using ports.
- **PBKDF2** (Password-Based Key Derivation Function 2): A key-stretching function that hashes a password many times with a salt to slow brute-force attacks.
- **PBX** (Private Branch Exchange): An internal telephone switching system, a target for toll fraud.
- **PCAP** (Packet Capture): A recorded set of network packets used for analysis and forensics.
- **PCI DSS** (Payment Card Industry Data Security Standard): The security standard for organizations handling payment card data.
- **PDU** (Power Distribution Unit): A device distributing electrical power within a rack or data center.
- **PEAP** (Protected Extensible Authentication Protocol): An EAP method that wraps authentication inside a TLS tunnel.
- **PED** (Personal Electronic Device): A personally owned gadget that may introduce risk in the workplace.
- **PEM** (Privacy Enhanced Mail): A base64 certificate and key file format widely used in PKI.
- **PFS** (Perfect Forward Secrecy): A property ensuring past sessions stay secure even if a long-term key leaks.
- **PGP** (Pretty Good Privacy): An encryption program for securing email and files.
- **PHI** (Protected Health Information): Health data regulated under laws such as HIPAA.
- **PII** (Personally Identifiable Information): Data that can identify a specific individual.
- **PIV** (Personal Identity Verification): A US government smart card standard for identity and access.
- **PKCS** (Public Key Cryptography Standards): A set of standards defining key and certificate formats.
- **PKI** (Public Key Infrastructure): The system of CAs, certificates, and keys that enables public-key trust.
- **POP** (Post Office Protocol): A protocol for downloading email from a server to a client.
- **POTS** (Plain Old Telephone Service): The traditional analog telephone network.
- **PPP** (Point-to-Point Protocol): A protocol for direct connections between two network nodes.
- **PPTP** (Point-to-Point Tunneling Protocol): An obsolete VPN protocol with known cryptographic weaknesses.
- **PSK** (Pre-Shared Key): A secret shared in advance to authenticate or encrypt, as in WPA2-PSK.
- **PTZ** (Pan-Tilt-Zoom): A camera that can rotate horizontally and vertically and zoom, often remotely controlled.
- **PUP** (Potentially Unwanted Program): Software bundled with a download that is not outright malware but is undesirable.
- **RA** (Registration Authority): A PKI entity that verifies identities before a CA issues certificates.
- **RACE** (Research and Development in Advanced Communications Technologies in Europe): The European research programme that gave RIPEMD the first word of its name.
- **RAD** (Rapid Application Development): A software model that favors fast prototyping and iteration over heavy up-front planning.
- **RADIUS** (Remote Authentication Dial-In User Service): A centralized AAA protocol for network access.
- **RAID** (Redundant Array of Independent Disks): Combines disks for redundancy or performance.
- **RAS** (Remote Access Server): A server that provides remote users access to a network.
- **RAT** (Remote Access Trojan): Malware that gives an attacker covert remote control of a host.
- **RBAC** (Role-Based Access Control): Access granted based on a user's assigned role.
- **RBAC (rule)** (Rule-Based Access Control): Access decided by system-enforced rules such as ACL conditions.
- **RC4** (Rivest Cipher 4): A deprecated stream cipher with known weaknesses.
- **RDP** (Remote Desktop Protocol): A Microsoft protocol for remote graphical access, a frequent attack target.
- **RFID** (Radio Frequency Identification): Wireless tags used for tracking and access badges; cloneable.
- **RIPEMD** (RACE Integrity Primitives Evaluation Message Digest): A family of cryptographic hash functions developed in Europe, with RIPEMD-160 the best known.
- **ROI** (Return on Investment): A measure of the financial benefit of an investment relative to its cost.
- **RPO** (Recovery Point Objective): The maximum acceptable amount of data loss measured in time.
- **RSA** (Rivest-Shamir-Adleman): A widely used public-key algorithm for encryption and signatures.
- **RTBH** (Remotely Triggered Black Hole): A technique that drops attack traffic by routing it to a null destination, often to blunt DDoS.
- **RTO** (Recovery Time Objective): The maximum acceptable time to restore a function after disruption.
- **RTOS** (Real-Time Operating System): An OS for time-critical embedded and control systems.
- **RTP** (Real-Time Transport Protocol): A protocol for delivering audio and video streams over IP networks.
- **S/MIME** (Secure/Multipurpose Internet Mail Extensions): A standard for signing and encrypting email using certificates.
- **SaaS** (Software as a Service): A cloud model delivering applications over the internet.
- **SAE** (Simultaneous Authentication of Equals): The WPA3 handshake that resists offline password cracking.
- **SAML** (Security Assertion Markup Language): An XML standard for exchanging authentication and authorization data for SSO.
- **SAN** (Subject Alternative Name / Storage Area Network): A certificate field listing extra identities, or a dedicated high-speed block-storage network.
- **SASE** (Secure Access Service Edge): A cloud model combining networking and security functions at the edge.
- **SCADA** (Supervisory Control and Data Acquisition): Systems that monitor and control large-scale industrial processes.
- **SCAP** (Security Content Automation Protocol): A suite of standards for automating vulnerability and configuration assessment.
- **SCEP** (Simple Certificate Enrollment Protocol): A protocol that automates issuing and renewing device certificates at scale.
- **SD-WAN** (Software-Defined Wide Area Network): Centralized, software-driven control of WAN connectivity.
- **SDK** (Software Development Kit): Tools and libraries for building applications on a platform.
- **SDLC** (Software Development Lifecycle): The structured process for building and maintaining software securely.
- **SDLM** (Software Development Lifecycle Methodology): The structured process of planning, building, testing, deploying, and maintaining software securely.
- **SDN** (Software-Defined Networking): Separating the network control plane from the data plane for programmability.
- **SE Linux** (Security-Enhanced Linux): A Linux kernel feature enforcing mandatory access control policies on processes and files.
- **SED** (Self-Encrypting Drive): A drive that automatically encrypts data in hardware.
- **SEH** (Structured Exception Handler): A Windows error-handling mechanism that can be abused in exploits.
- **SFTP** (Secure File Transfer Protocol): File transfer carried over SSH for confidentiality and integrity.
- **SHA** (Secure Hash Algorithm): A family of cryptographic hash functions, with SHA-2 and SHA-3 recommended.
- **SHTTP** (Secure Hypertext Transfer Protocol): An obsolete protocol for securing individual web messages, superseded by HTTPS over TLS.
- **SIEM** (Security Information and Event Management): Aggregates and correlates logs for monitoring, alerting, and investigation.
- **SIM** (Subscriber Identity Module): A chip identifying a mobile subscriber; targeted by SIM-swapping.
- **SLA** (Service Level Agreement): A contract defining expected service levels and remedies.
- **SLE** (Single Loss Expectancy): The monetary loss expected from a single occurrence of a risk.
- **SMS** (Short Message Service): Text messaging; a weak MFA channel and a smishing vector.
- **SMTP** (Simple Mail Transfer Protocol): The protocol for sending email between servers.
- **SMTPS** (Simple Mail Transfer Protocol Secure): SMTP secured with TLS.
- **SNMP** (Simple Network Management Protocol): A protocol for monitoring and managing network devices.
- **SOAP** (Simple Object Access Protocol): An XML-based messaging protocol for web services.
- **SOAR** (Security Orchestration, Automation, and Response): Platforms that automate and coordinate security operations with playbooks.
- **SoC** (System on Chip): An integrated circuit combining CPU, memory, and peripherals on one chip.
- **SOC** (Security Operations Center): The team and facility that monitors and defends against threats continuously.
- **SOW** (Statement of Work): A document defining deliverables, timelines, and scope of a project.
- **SPF** (Sender Policy Framework): An email standard that lists which servers may send for a domain.
- **SPIM** (Spam over Instant Messaging): Unsolicited messages delivered through instant messaging platforms.
- **SQL** (Structured Query Language): The language for querying relational databases; injection abuses it.
- **SQLi** (SQL Injection): An attack that injects malicious SQL through unsanitized input.
- **SRTP** (Secure Real-Time Transport Protocol): Encrypts and authenticates voice and video media streams.
- **SSD** (Solid State Drive): Flash-based storage; wear leveling complicates secure erasure.
- **SSH** (Secure Shell): An encrypted protocol for remote administration and tunneling.
- **SSL** (Secure Sockets Layer): The deprecated predecessor to TLS for encrypting connections.
- **SSO** (Single Sign-On): Authenticating once to access multiple systems.
- **STIX** (Structured Threat Information eXpression): A standardized language for describing cyber threat intelligence.
- **STP** (Shielded Twisted Pair): Cabling with shielding to reduce electromagnetic interference.
- **SWG** (Secure Web Gateway): A control that filters and inspects web traffic to enforce policy.
- **TACACS+** (Terminal Access Controller Access Control System Plus): A Cisco AAA protocol that separates authentication, authorization, and accounting.
- **TAXII** (Trusted Automated eXchange of Indicator Information): A transport protocol for sharing STIX threat intelligence.
- **TCP** (Transmission Control Protocol): A reliable, connection-oriented transport protocol.
- **TCP/IP** (Transmission Control Protocol/Internet Protocol): The layered protocol suite the internet runs on, named for its two core protocols.
- **TGT** (Ticket Granting Ticket): A Kerberos credential used to request service tickets; targeted by Golden Ticket attacks.
- **TKIP** (Temporal Key Integrity Protocol): A deprecated WPA encryption protocol replaced by CCMP.
- **TLS** (Transport Layer Security): The standard protocol for encrypting network connections.
- **TOC** (Time-of-Check): The moment a system verifies a condition, the first half of a TOCTOU race condition.
- **TOTP** (Time-based One-Time Password): A one-time code derived from the current time and a shared secret.
- **TOU** (Time-of-Use): The moment a system acts on a condition, the second half of a TOCTOU race condition.
- **TPM** (Trusted Platform Module): A hardware chip that securely stores keys and supports measured boot.
- **TSIG** (Transaction Signature): A shared-key mechanism that authenticates DNS messages such as zone transfers and updates.
- **TTP** (Tactics, Techniques, and Procedures): The behavior patterns that characterize a threat actor.
- **UAT** (User Acceptance Testing): Final testing by users to confirm software meets requirements.
- **UAV** (Unmanned Aerial Vehicle): A drone; a physical reconnaissance and delivery threat.
- **UDP** (User Datagram Protocol): A fast, connectionless transport protocol used in floods and amplification.
- **UEBA** (User and Entity Behavior Analytics): Detects threats by flagging deviations from normal behavior baselines.
- **UEFI** (Unified Extensible Firmware Interface): Modern firmware replacing BIOS, supporting Secure Boot.
- **UEM** (Unified Endpoint Management): A single platform for managing all endpoint types.
- **UPS** (Uninterruptible Power Supply): A battery backup that maintains power during short outages.
- **URI** (Uniform Resource Identifier): A string that identifies a resource, of which a URL is one form.
- **URL** (Uniform Resource Locator): A web address; manipulated in phishing and redirection attacks.
- **USB** (Universal Serial Bus): A common peripheral connector; a vector for malware and data theft.
- **USB OTG** (USB On-the-Go): A feature letting a device act as host to other USB devices.
- **UTM** (Unified Threat Management): An all-in-one appliance bundling firewall, IPS, antivirus, and more.
- **UTP** (Unshielded Twisted Pair): Common network cabling without electromagnetic shielding.
- **VBA** (Visual Basic for Applications): A macro language in Office documents, abused to deliver malware.
- **VDE** (Virtual Desktop Environment): A desktop that runs on centralized infrastructure and is accessed remotely from a thin client.
- **VDI** (Virtual Desktop Infrastructure): Hosting desktops on centralized servers and streaming them to users.
- **VLAN** (Virtual Local Area Network): A logical network segment that isolates traffic on shared switches.
- **VLSM** (Variable Length Subnet Masking): Subnetting with masks of differing lengths for efficient address use.
- **VM** (Virtual Machine): A software-emulated computer; escape attacks target the hypervisor boundary.
- **VoIP** (Voice over Internet Protocol): Carrying voice calls over IP networks.
- **VPC** (Virtual Private Cloud): An isolated, logically private section of a public cloud.
- **VPN** (Virtual Private Network): An encrypted tunnel that extends a private network across a public one.
- **VTC** (Video Teleconferencing): Real-time video and audio meetings between remote participants over a network.
- **WAF** (Web Application Firewall): Filters HTTP traffic to protect web apps from injection and similar attacks.
- **WAP** (Wireless Access Point): A device that bridges wireless clients to a wired network.
- **WEP** (Wired Equivalent Privacy): An obsolete, easily broken Wi-Fi encryption standard.
- **WIDS** (Wireless Intrusion Detection System): Monitors the wireless spectrum for rogue devices and attacks.
- **WIPS** (Wireless Intrusion Prevention System): Detects and actively blocks wireless threats such as rogue APs.
- **WO** (Work Order): A document authorizing and scoping specific work, often issued under a master agreement.
- **WPA** (Wi-Fi Protected Access): A family of Wi-Fi security standards; WPA3 is current.
- **WPS** (Wi-Fi Protected Setup): A simplified Wi-Fi setup feature with known PIN brute-force weaknesses.
- **WTLS** (Wireless Transport Layer Security): The security layer of the legacy Wireless Application Protocol stack for mobile devices.
- **XDR** (Extended Detection and Response): Correlates detection and response across endpoints, network, and cloud.
- **XML** (Extensible Markup Language): A structured data format; XXE and injection target its parsers.
- **XOR** (Exclusive OR): A bitwise operation fundamental to many ciphers.
- **XSRF** (Cross-Site Request Forgery): Another name for CSRF, forcing an authenticated user to make unwanted requests.
- **XSS** (Cross-Site Scripting): Injecting malicious scripts into web pages viewed by other users.
- **ZTNA** (Zero Trust Network Access): Grants per-session access to applications based on identity and policy, never implicit trust.