Glossary

141 terms from CompTIA Security+ SY0-801 Exam Prep, in plain words, each with the chapter that teaches it.

Search the glossary

A

AAA (Authentication, Authorization, and Accounting): Three steps in order: prove who you are, decide what you may do, then log what you did.
Access control vestibule: An entrance with two doors that lets only one person through at a time. It physically stops tailgating.
AES (Advanced Encryption Standard): The standard symmetric cipher for bulk data. It uses keys of 128, 192 or 256 bits.
ALE (Annualized Loss Expectancy): The expected yearly cost of a risk: ALE = SLE x ARO. Three lost laptops a year at $1,500 each gives an ALE of $4,500.
ARO (Annualized Rate of Occurrence): How many times a year an incident is expected. Once every N years is 1 ÷ N, so once every 4 years is 0.25.
Array: In awk, a table of values looked up by a key. check.sh stores each of your answers in an array keyed by question number.
Asset value (AV): What an asset is worth in dollars. It is the starting point of SLE = AV x EF.
Asymmetric encryption: Encryption with a key pair. You encrypt to someone's public key and only their private key can open it. RSA and ECC are examples.
Authentication: Proving who you are, for example with a password or a passkey. It answers 'who are you?'
Authorization: Deciding what a signed-in user may do. It answers 'what may you do?'
Availability: Keeping systems reachable when needed. As a number it is the share of time a system works: MTBF ÷ (MTBF + MTTR), for example 99.01%.

B

Brain dump: The key facts you write on your note board in the first minute after the exam timer starts, such as the IR order, ports and risk formulas.
Brute force: Many password guesses against one account. In auth.log, 203.0.113.7 tried 8 passwords on root within 16 seconds.

C

Certificate authority (CA): A trusted organization that vouches that a public key belongs to a name by signing its certificate.
CEU (continuing education unit): Credit you earn from training, conferences or teaching. Earning 50 in three years, plus CompTIA's fee, renews Security+.
Chain of custody: A record of who held a piece of evidence, and when. Alex writes the sha256sum hashes into it.
Change management: The fixed path every change follows: request, impact analysis, approval, test, schedule, do it, verify, document. Nothing changes without approval.
CIA (Confidentiality, Integrity, and Availability): The three goals of security: kept secret, kept unchanged, and reachable when needed.
Cold site: A recovery site with only space and power. It takes weeks to get running.
Compensating control: A control that stands in for one you can't have, such as isolating a legacy PC that can't be patched. Ask about it first in the control-type decision tree.
Containment: The incident response phase that stops the spread, such as isolating Kettle & Crane's infected file server. It comes before eradication.
Corrective control: A control that fixes things after an incident, such as restoring a server from backup.
CRL (Certificate Revocation List): A downloadable list of certificates that have been revoked.
CVE (Common Vulnerabilities and Exposures): The public ID number given to a known vulnerability.
CVSS (Common Vulnerability Scoring System): A 0-10 score for how severe a flaw is: Low, Medium, High or Critical. It describes the flaw, not your own risk.

D

Data loss (AI): Sensitive data leaking through AI tools, such as staff pasting customer data into a public chatbot.
Defense in depth: Using several layers of controls of different kinds, so one failure doesn't expose everything.
Detective control: A control that notices or records an event, such as a camera or a monthly log review.
Deterring control: A control that only discourages, such as an 'Alarmed door' sign. A determined person could still go ahead.
Dictionary: In Python, a table of values looked up by a key. WEIGHTS in plan.py maps each domain number to its weight.
Digital signature: You sign with your private key and anyone can verify with your public key. It proves integrity and non-repudiation, for example that Sam approved a price change.
Directive control: A control that tells people what to do, such as a policy or a 'Staff only' sign.
Distractor: A wrong option written to look right. Most are siblings, near misses, terms from the wrong list, or the right tool for the wrong goal.
DKIM (DomainKeys Identified Mail): Signs outgoing email so receiving servers can check it really came from that domain and wasn't changed.
DLP (Data Loss Prevention): Tools that stop sensitive data leaving, on endpoints, the network or the cloud. For example, it would block an email of card numbers sent to a personal address.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): An email record that tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports.
Domain: One of the exam's five main areas, such as Domain 4, Security Operations, at 27%.

E

Encoding: Changing data's format, such as base64, so systems can carry it. There is no key, so anyone can reverse it.
Encryption: Making data unreadable so that only someone with the key can reverse it. Of encoding, hashing and encryption, only encryption gives confidentiality.
End state: The finished result of a PBQ, which is what gets scored. Any correct way of reaching it earns credit.
Eradication: The incident response phase that removes the cause, such as the malware. It comes after containment.
Exam code: The code for one version of an exam, such as SY0-801.
Exposure factor (EF): The share of an asset's value lost in one incident, written from 0 to 1, so 25% is 0.25.

F

Fail-open and fail-closed: What a device does when it breaks. Fail-open lets traffic flow (favors availability). Fail-closed blocks it (favors security).
False positive and false negative: A false positive is an alarm with no attack. A false negative is an attack with no alarm.
Firewall: A device or program that allows or blocks network traffic by checking each packet against an ordered list of rules.
Firewall rule table: An ordered list of allow and deny rules matched on source, destination and port. It is the most reported PBQ type.
First match wins: A firewall reads its rules from the top, and the first rule that matches a packet decides. Specific rules therefore go above general ones.
Flag: Marking an exam question for review so you can come back to it from the review screen before you finish.
Full disk encryption (FDE): Encrypts a whole drive. It protects a laptop's data only while the laptop is switched off.

H

Hashing: A one-way, keyless fingerprint of data, used to prove integrity. The same input always gives the same hash, and you can't turn the hash back into the data.
High availability: Designing systems to stay up, using load balancing, clustering and failover.
Hot site: A fully equipped recovery site with current data, ready to run within minutes.
HTTPS: Web traffic encrypted with TLS, on port 443. Rule 1 of rules.csv allows it to Kettle & Crane's web server.

I

IDS (Intrusion Detection System): A sensor that watches traffic and alerts on attacks, but doesn't block them.
Immutable backup: A backup that can't be changed or deleted, so ransomware can't touch it.
Implicit deny: If no firewall rule matches a packet, the packet is blocked.
Incident response: The process for handling an incident, in this order: preparation, detection, analysis, containment, eradication, recovery, lessons learned.
Indicator of compromise (IoC): A sign in logs or behavior that an attack may have happened, such as impossible travel, account lockouts, unusual resource use or missing logs.
Injection: An attack that slips commands into input, such as ' OR 1=1-- in a URL to attack a database.
IPS (Intrusion Prevention System): A sensor that sits inline and blocks attacks as well as detecting them.

K

Key (correct option): The correct option of a multiple-choice question. The other three are distractors.

L

Least privilege: Giving people only the access their job needs, which limits the damage from a stolen account. For example, only the HR group may read the payroll share.
Lessons learned: The last incident response phase: a review of what happened, which feeds back into preparation.
Load balancing: Spreading traffic across several servers so no single one is overloaded.

M

Managerial control: A control that is a decision or a document, such as a risk assessment or policy.
MFA (Multifactor Authentication): Signing in with two or more kinds of factor, such as a password plus a code. MFA bypass attacks try to get around it.
MTBF (Mean Time Between Failures): The average time a system runs between failures. Higher is better.
MTTR (Mean Time to Repair): The average time a repair takes. Lower is better.
Multiple-choice question: An exam question with four options, of which you pick one.

N

Non-repudiation: Proof that a sender can't later deny sending something. It needs a digital signature, not just a hash.

O

Objective: A numbered part of a domain, such as 4.7, with its list of terms. Its verb, such as 'Given a scenario', shows how deep the questions go.
On-path attack: An attacker sitting between two parties, able to read or change their traffic.
OnVUE: Pearson VUE's online exam delivery: you take the exam at home while a proctor watches through your webcam.
Operational control: A control that is a person doing a job, such as a guard checking badges.
Options: The four answers, A to D, to a multiple-choice question.
Order of volatility: Collect evidence that disappears fastest first: memory, then disk, then remote logs and backups.

P

Partial credit: Marks for each correct part of a PBQ. Not every PBQ gives it.
Passkey: A key pair bound to one website, used to sign in without a password. It resists phishing.
Password spraying: One or a few passwords tried against many accounts, slowly enough to avoid lockouts. In auth.log, 198.51.100.23 tried six different users once each.
PBQ (performance-based question): A hands-on exam task on screen, such as editing a firewall table or putting incident response steps in order.
Penetration test: An authorized simulated attack. The report lists the findings and how to fix them.
Phishing: Tricking people by email. Spear phishing targets a chosen person, and whaling targets an executive.
PKI (Public Key Infrastructure): The system of CAs, certificates and revocation that lets people trust public keys.
Port: A number that identifies a network service, such as 22 for SSH or 443 for HTTPS. Firewall rules match on it.
Preventive control: A control that actually stops something from happening, such as a guard who refuses entry.
Privilege creep: Access that piles up as people change jobs, like a user who moved from sales to shipping but kept sales access.
Privilege escalation: An attacker gaining more rights than they were given.
Prompt injection: Hidden text that an AI model reads as instructions, such as a supplier web page telling a chatbot to email the customer list.

Q

Qualifier: The word in a stem that decides what 'correct' means: first, next, best, most likely, least or not.
Qualitative risk analysis: Rating risks on a scale such as 1 to 5, like risks.csv's likelihood x impact.
Quantitative risk analysis: Measuring risk in dollars, using SLE, ARO and ALE.

R

Ransomware: Malware that encrypts files and demands payment, like the ransom note on Kettle & Crane's file server.
Recovery: The incident response phase after eradication, when systems are restored, for example from backup, and returned to normal use.
Reset: The PBQ button that clears all your work on that task. Press it only if your work is truly lost.
Residual risk: The risk that remains after controls are applied.
Restoration testing: Actually restoring from a backup to prove it works. A backup counts only after it has passed a restore test.
Risk appetite: How much risk the owners are willing to carry. Kettle & Crane's allows no score above 8 without written approval.
Risk register: A table with one row per risk, giving its score, owner and treatment, like risks.csv.
Risk score: In a qualitative risk register, likelihood x impact. In risks.csv, phishing scores 4 x 4 = 16, the highest risk.
Risk treatment: The four responses to a risk: transfer (insurance), accept (a signed decision), avoid (stop the activity) or mitigate (add controls).
Role-based access control: Access given according to a person's job role.
Rootkit: Malware that hides itself and needs admin rights to install. The fix is to rebuild the system.
RPO (Recovery Point Objective): How much data, measured in time, you may lose. The worst gap between good backups must be no longer than the RPO.
RTO (Recovery Time Objective): How long a system may be down before it must be restored.

S

Salting: Adding a random value to each password before hashing, so the same password gives different hashes. It defeats rainbow tables.
SAML (Security Assertion Markup Language): Signed XML assertions that carry a sign-in from one organization to another. It is used for SSO and federation.
Scaled score: The exam result on a 100-900 scale, with 750 to pass. It is not a percentage of questions right.
Scenario: A short workplace situation at the start of a stem. About half of stems begin with one.
Score report: Your exam result, listing the objectives where you missed questions.
Screened subnet: The network zone for systems the internet must reach, such as the web server. Internal systems like the order database stay behind it.
SHA-256: The recommended hash algorithm. It always gives a 64-character fingerprint.
Shadowed rule: A firewall rule that never matches because an earlier, more general rule catches its packets first, as in rules-bad.csv.
SIEM (Security Information and Event Management): A system that collects logs from many sources, correlates them and raises alerts.
Simulation: A limited copy of a screen or device, such as a firewall screen or terminal, used for a PBQ.
SLA (Service Level Agreement): An agreed service level with consequences, such as 99.9% uptime with credits if missed. An SLO is an internal target without them.
SLE (Single Loss Expectancy): The cost of one incident: SLE = AV x EF. A $60,000 stock with a quarter lost gives $15,000.
Social engineering: Tricking people rather than machines, through channels such as email, text or voice.
SPF (Sender Policy Framework): An email record that lists which servers may send mail for a domain.
SSH (Secure Shell): Encrypted remote login on port 22. It replaces Telnet. rules.csv allows it only from the office.
SSO (Single Sign-on): Signing in once to use many apps.
Stem: The text of a question. It holds the qualifier and often begins with a scenario.
SY0-801: The exam code of Security+ V8, launching on or around November 17, 2026: up to 90 questions in 90 minutes, with 750 to pass.
Symmetric encryption: Encryption where one shared key both encrypts and decrypts. It is fast, so it is used for bulk data, for example with AES.

T

Tabletop exercise: A discussion-based practice run for an incident or disaster. No systems are touched.
Tailgating: Following someone through a secured door without scanning a badge.
Technical control: A control that is software or a system setting, such as a firewall.
Threat actor: Whoever is behind an attack, such as an unskilled attacker, hacktivist, insider, organized crime group or state.
TLS (Transport Layer Security): The protocol that encrypts data in transit, used by HTTPS, LDAPS and syslog on port 6514.
Trojan: Malware that pretends to be legitimate software.

V

Vector: The way an attacker gets in, such as email, a text message or a USB drive.
Virus: Malware that needs a host file and a user to run it.
Voucher: A prepaid code for one exam attempt. Every retake needs a new one.
VPN (Virtual Private Network): An encrypted tunnel that connects remote users or sites to the company network.
Vulnerability scanner: A tool that finds known weaknesses on systems. It finds them but doesn't stop an attack in progress.

W

WAF (Web Application Firewall): A firewall that protects web applications from attacks such as injection.
Warm site: A recovery site with hardware but not current data. It takes days to get running.
Weight: The share of exam questions that come from one domain. Domain 4's 27% is about 24 of 90 questions.
Worm: Malware that spreads by itself, without a user running it.

Z

Zero Trust: Trusting nothing because of its network location and verifying every request. A policy engine decides and an enforcement point applies the decision.
Zero-day: A flaw for which no patch exists yet. You respond with a compensating control.