100 CompTIA Security+ Terms to Know: Your Certification Vocabulary Guide

CompTIA Security+ is the most widely recognized entry-level cybersecurity certification in the industry. It’s DoD 8140 approved, required for thousands of government and federal contractor roles, and accepted by organizations worldwide as the baseline for security knowledge. If you’re building a cybersecurity career, Security+ is one of the most important vocabulary sets you’ll ever learn.

The challenge with Security+ isn’t the difficulty — it’s the breadth. The exam covers threats, architecture, cryptography, identity, operations, and governance. Candidates who struggle aren’t usually lost on the concepts. They’re unfamiliar with the precise language that connects those concepts. Zero-day. PKI. SOAR. Non-repudiation. Knowing these terms before you study changes how fast everything else clicks.

We created 100 CompTIA Security+ Terms to Know as a vocabulary foundation for exactly that reason. Watch it below, then read on to understand how these terms map to the domains that define the certification.

Why Security+ Vocabulary Matters Beyond the Exam

Security+ isn’t just a certification — it’s a professional communication standard. When a SOC analyst says “we’re seeing IOCs consistent with lateral movement” or a GRC professional says “this control maps to NIST CSF Detect,” they’re using Security+ vocabulary in real work. The exam teaches you the language of the field, not just isolated facts.

The professionals who get the most out of their Security+ study — and who carry that knowledge into their careers — are the ones who learned the vocabulary layer first. These 100 terms build that layer so the deep study that follows lands faster and sticks longer.

Five Domains Every Security+ Candidate Should Know

The 100 terms in the video map to five core domains covered in the Security+ exam. Understanding the domain structure — not just memorizing definitions — is what builds real security fluency.

1. Threats, Attacks & Vulnerabilities

Malware types (ransomware, spyware, Trojan, rootkit, worm, fileless malware), social engineering tactics (phishing, vishing, smishing, pretexting, tailgating), application attacks (SQL injection, XSS, buffer overflow, directory traversal), and network attacks (DDoS, man-in-the-middle, replay, MITM) form the offensive vocabulary of Security+. Defenders who don’t understand how attacks work are always reactive. This domain gives you the threat model that everything else is designed against.

A zero-day exploit targets a vulnerability that the vendor doesn’t know about yet — meaning no patch exists. Understanding the difference between a vulnerability, a threat, and an exploit isn’t just exam content. It’s the vocabulary that determines whether the right team responds to the right problem in the right timeframe.

2. Architecture & Design

Zero trust architecture, defense in depth, network segmentation, microsegmentation, secure by default, least privilege, separation of duties, and the principle of least functionality describe how secure systems are designed — not just how they’re defended after the fact. Security+ tests whether you understand why these architectural choices exist, not just that they exist. This domain separates technicians from security thinkers.

3. Implementation & Cryptography

PKI (Public Key Infrastructure), digital certificates, TLS/SSL, symmetric vs. asymmetric encryption, hashing (SHA, MD5), MFA, SSO, federation, PAM (Privileged Access Management), and key management are the technical implementation vocabulary of Security+. Cryptography in particular is an area where many candidates struggle — not because the math is hard, but because the terminology is unfamiliar. Knowing what a certificate authority does, or why asymmetric encryption is used for key exchange rather than bulk data, clarifies entire sections of the exam.

4. Operations & Incident Response

SIEM (Security Information and Event Management), SOAR (Security Orchestration, Automation and Response), EDR, vulnerability scanning, penetration testing, the incident response lifecycle (preparation, identification, containment, eradication, recovery, lessons learned), chain of custody, and digital forensics procedures are the operational vocabulary of security work. Security+ tests whether you know how to respond when something goes wrong — not just how to prevent it.

5. Governance, Risk & Compliance

GRC (Governance, Risk, and Compliance), risk assessment, risk tolerance, NIST CSF, ISO 27001, PCI-DSS, HIPAA, CMMC, due diligence, data classifications, business continuity, and disaster recovery are the governance vocabulary of Security+. Security doesn’t happen in isolation — it happens inside organizations with legal obligations, board-level risk discussions, and audit requirements. This domain prepares you for every role beyond purely technical execution.

How Cover6 Uses Security+ in Our Training

At Cover6, Security+ is the professional baseline. Every course we offer — from our Breaking Into Cybersecurity roadmap to our SOC Analyst and GRC tracks — assumes that the professional understands the Security+ vocabulary layer. It’s not the ceiling of knowledge. It’s the shared language that makes everything else learnable and communicable.

If you’re working toward Security+ or refreshing your foundations, this video is built for you. Watch it, bookmark it, and share it with your network — especially anyone entering the field or studying for the exam. Follow along with Cover6 for more vocabulary breakdowns, certification prep resources, and career guidance.