Security+ SY0-701 Acronym List

Compiled and reviewed by Mani Poopal, CCIE, Lead Networking Instructor at CISNET, who teaches Security+ and CCNP. Last reviewed September 22, 2026.

Security+ questions use acronyms without expanding them, so every second spent decoding SOAR or RPO is a second taken from the scenario itself. This page lists 113 high-value CompTIA Security+ SY0-701 acronyms in full, grouped by exam domain, each with its expansion and, where the expansion alone will not earn the mark, a note on what the question is really testing. The flashcard drill below runs over the same 113 entries, saves the ones you miss between sessions, and lets you re-run only those.

Where this list comes from, and how to use it

The source is the acronym appendix CompTIA publishes with the SY0-701 exam objectives, downloadable from the official CompTIA Security+ page. That appendix is the authoritative boundary of what the exam can use, and it is longer than what follows here. This page is not a copy of it: it carries the entries our instructors see tested, and adds what the appendix does not have, a note on roughly half the entries explaining what the exam actually asks about that term. If an acronym from a practice question is missing below, check the appendix.

Use it in two passes. Read one domain end to end first, so each acronym sits beside its neighbours, because that is the context the exam uses to disambiguate them. Then drill that same domain above until the expansions are automatic and let the missed list narrow what you return to. For a paper copy, print this page or save it as a PDF with Ctrl and P, or Command and P on a Mac: the drill and the calls to action drop out and the full list prints as a clean reference sheet.

Security+ acronym pairs people confuse

These are the pairs that read as synonyms in plain English and mean different things on the exam. CompTIA writes distractors out of exactly this list, so a pair you cannot split in one sentence is a mark you are likely to drop.

What we watch candidates get wrong in class

Mani Poopal, who teaches Security+ at CISNET: the acronyms that cost marks in class are almost never the obscure ones. They are the pairs that sound interchangeable in English. In most cohorts somebody reads RTO and RPO as two ways of saying the same thing, then loses a recovery scenario because the question was about how much data could be lost and they answered about elapsed time. The same pattern repeats with IDS and IPS the moment a question mentions blocking, and with SLE and ALE whenever a figure needs multiplying by the rate of occurrence.

The second trap is the acronyms with more than one expansion. MAC is the clearest case. A student who arrived from the networking side has learned Media Access Control and will reach for a switching answer inside an access control question. The fix we teach is procedural: read the scenario first, expand the acronym second, because the scenario is the only thing that disambiguates it.

The third is treating the appendix as vocabulary rather than behaviour. Knowing that SOAR expands to Security Orchestration, Automation and Response earns nothing by itself, because the exam asks which tool removes the manual step from a repeated response task. So when you drill, say the expansion and then one sentence about what the thing does. If you cannot produce that sentence you do not know the term well enough for a scenario question, and the performance-based questions are built entirely out of scenarios.

Related study tools

Pair this with the Security+ study guide for a week by week plan, the common attack types breakdown for the threat domain, and symmetric versus asymmetric encryption for the cryptography acronyms. The SY0-701 versus SY0-801 comparison tracks what CompTIA has published about the next version, and the ports and protocols reference covers the other list Security+ expects you to have memorised.

Frequently Asked Questions