Practice security abbreviations: CVE, CVSS, OWASP, SAST, DAST, SBOM, SLSA, SOC2, ISO27001, GDPR, WAF, SIEM, SOAR, IOC, and IOA.
0 / 26 completed
1 / 26
What does CVE stand for and what does a CVE number identify?
CVE (Common Vulnerabilities and Exposures) is a standardized numbering system for known security vulnerabilities. A CVE ID like CVE-2021-44228 (Log4Shell) uniquely identifies a specific vulnerability, enabling consistent tracking across tools and reports.
2 / 26
What is the difference between SAST and DAST?
SAST analyzes source code, bytecode, or binaries at rest — finding vulnerabilities early in the pipeline. DAST sends requests to a running application to find vulnerabilities from an attacker's perspective. Both are complementary in a DevSecOps pipeline.
3 / 26
What does SBOM stand for and why has it become important?
An SBOM (Software Bill of Materials) lists every dependency, library, and component in your software. After major supply chain attacks (e.g., SolarWinds, Log4Shell), SBOMs became a security requirement — they let you quickly identify whether you're affected by a new CVE.
4 / 26
What does SIEM stand for and what is its role?
A SIEM (Security Information and Event Management) platform ingests logs from firewalls, servers, applications, and endpoints, then correlates events to detect threats and generate alerts. Examples: Splunk, Microsoft Sentinel, Elastic SIEM.
5 / 26
What is the difference between an IOC and an IOA in security?
IOC (Indicator of Compromise) identifies that a system has been compromised — like a known malware hash found on disk. IOA (Indicator of Attack) identifies attack behavior happening in real time — like unusual process creation patterns — enabling proactive defense before compromise.
6 / 26
Reviewer: 'The API response is returning a 403 with this error message: 'Insufficient permissions'. I'm seeing a lot of these lately. Can you check if the user roles are correctly configured in our IAM system? It might be related to the new feature rollout.'
Which abbreviation does Reviewer likely refer to when discussing this issue?
The reviewer is discussing issues related to user permissions and access control. IAM (Identity and Access Management) is the correct answer because it directly addresses the problem of 'insufficient permissions' and managing who has access to what within a system. JWTs and OAuth2 relate to authentication *mechanisms*, while PCI DSS is a compliance standard, not an abbreviation for a specific security concept.
7 / 26
PR Description: 'We're implementing a new data validation layer to prevent SQL injection attacks. We've used OWASP guidelines and added input sanitization throughout the application. To ensure ongoing security monitoring, we'll be integrating with our SIEM system.'
Which abbreviation is being utilized for continuous security monitoring?
The description mentions 'integrating with our SIEM system' to monitor the application. SIEM (Security Information and Event Management) systems are designed for real-time monitoring of security events and logs within an organization. CVEs (Common Vulnerabilities and Exposures), SAST (Static Application Security Testing), IOCs (Indicators of Compromise), and IOAs (Indicators of Attack) relate to vulnerability identification and response, but not continuous monitoring.
8 / 26
Slack Message: '@john.doe just reported a potential vulnerability – we're seeing unusual network traffic patterns targeting our database servers. He's flagged these as potential IOCs and forwarded the logs to the security team.'
What does 'IOC' stand for in this message?
'IOC' stands for 'Indicators of Compromise'. In cybersecurity, an IOC is a signal that suggests a system or network has been compromised. It's a key element in incident response and threat hunting – John is using it to report suspicious activity based on observed data. The other options represent related but distinct security concepts.
9 / 26
Standup Update: 'I've been working on updating the SBOM for our microservices. We need to ensure we have a complete and accurate record of all software components to comply with new regulations regarding supply chain security.'
What does 'SBOM' stand for in this context?
SBOM stands for 'Software Bill of Materials'. It's a comprehensive list of all the software components (libraries, frameworks, and dependencies) used in building a piece of software. Maintaining an SBOM is crucial for supply chain security – it helps identify potential vulnerabilities introduced by third-party components and ensures compliance with regulations that require transparency about software origins.
10 / 26
Reviewer: 'The API response is returning a 403 with this error message: 'Insufficient permissions'. I'm seeing a lot of these lately. Can you check if the user roles are correctly configured in our IAM system? It might be related to the new feature rollout.'
Which abbreviation does Reviewer likely refer to when discussing this issue?
The reviewer is discussing issues related to user permissions and access control. IAM (Identity and Access Management) is the correct answer because it directly addresses the problem of 'insufficient permissions' and managing who has access to what within a system. JWTs and OAuth2 relate to authentication *mechanisms*, while PCI DSS is a compliance standard, not an abbreviation for a specific security concept.
11 / 26
PR Description: 'We're implementing a new data validation layer to prevent SQL injection attacks. We've used OWASP guidelines and added input sanitization throughout the application. To ensure ongoing security monitoring, we'll be integrating with our SIEM system.'
Which abbreviation is being utilized for continuous security monitoring?
The description mentions 'integrating with our SIEM system' to monitor the application. SIEM (Security Information and Event Management) systems are designed for real-time monitoring of security events and logs within an organization. CVEs (Common Vulnerabilities and Exposures), SAST (Static Application Security Testing), IOCs (Indicators of Compromise), and IOAs (Indicators of Attack) relate to vulnerability identification and response, but not continuous monitoring.
12 / 26
Slack Message: '@john.doe just reported a potential vulnerability – we're seeing unusual network traffic patterns targeting our database servers. He's flagged these as potential IOCs and forwarded the logs to the security team.'
What does 'IOC' stand for in this message?
'IOC' stands for 'Indicators of Compromise'. In cybersecurity, an IOC is a signal that suggests a system or network has been compromised. It's a key element in incident response and threat hunting – John is using it to report suspicious activity based on observed data. The other options represent related but distinct security concepts.
13 / 26
Standup Update: 'I've been working on updating the SBOM for our microservices. We need to ensure we have a complete and accurate record of all software components to comply with new regulations regarding supply chain security.'
What does 'SBOM' stand for in this context?
SBOM stands for 'Software Bill of Materials'. It's a comprehensive list of all the software components (libraries, frameworks, and dependencies) used in building a piece of software. Maintaining an SBOM is crucial for supply chain security – it helps identify potential vulnerabilities introduced by third-party components and ensures compliance with regulations that require transparency about software origins.
14 / 26
Reviewer: 'The API response is returning a 403 with this error message: 'Insufficient permissions'. I'm seeing a lot of these lately. Can you check if the user roles are correctly configured in our IAM system? It might be related to the new feature rollout.'
Which abbreviation does Reviewer likely refer to when discussing this issue?
The reviewer is discussing issues related to user permissions and access control. IAM (Identity and Access Management) is the correct answer because it directly addresses the problem of 'insufficient permissions' and managing who has access to what within a system. JWTs and OAuth2 relate to authentication *mechanisms*, while PCI DSS is a compliance standard, not an abbreviation for a specific security concept.
15 / 26
PR Description: 'We're implementing a new data validation layer to prevent SQL injection attacks. We've used OWASP guidelines and added input sanitization throughout the application. To ensure ongoing security monitoring, we'll be integrating with our SIEM system.'
Which abbreviation is being utilized for continuous security monitoring?
The description mentions 'integrating with our SIEM system' to monitor the application. SIEM (Security Information and Event Management) systems are designed for real-time monitoring of security events and logs within an organization. CVEs (Common Vulnerabilities and Exposures), SAST (Static Application Security Testing), IOCs (Indicators of Compromise), and IOAs (Indicators of Attack) relate to vulnerability identification and response, but not continuous monitoring.
16 / 26
Slack Message: '@john.doe just reported a potential vulnerability – we're seeing unusual network traffic patterns targeting our database servers. He's flagged these as potential IOCs and forwarded the logs to the security team.'
What does 'IOC' stand for in this message?
'IOC' stands for 'Indicators of Compromise'. In cybersecurity, an IOC is a signal that suggests a system or network has been compromised. It's a key element in incident response and threat hunting – John is using it to report suspicious activity based on observed data. The other options represent related but distinct security concepts.
17 / 26
Standup Update: 'I've been working on updating the SBOM for our microservices. We need to ensure we have a complete and accurate record of all software components to comply with new regulations regarding supply chain security.'
What does 'SBOM' stand for in this context?
SBOM stands for 'Software Bill of Materials'. It's a comprehensive list of all the software components (libraries, frameworks, and dependencies) used in building a piece of software. Maintaining an SBOM is crucial for supply chain security – it helps identify potential vulnerabilities introduced by third-party components and ensures compliance with regulations that require transparency about software origins.
18 / 26
Reviewer: 'The API response is returning a 403 with this error message: 'Insufficient permissions'. I'm seeing a lot of these lately. Can you check if the user roles are correctly configured in our IAM system? It might be related to the new feature rollout.'
Which abbreviation does Reviewer likely refer to when discussing this issue?
The reviewer is discussing issues related to user permissions and access control. IAM (Identity and Access Management) is the correct answer because it directly addresses the problem of 'insufficient permissions' and managing who has access to what within a system. JWTs and OAuth2 relate to authentication *mechanisms*, while PCI DSS is a compliance standard, not an abbreviation for a specific security concept.
19 / 26
PR Description: 'We're implementing a new data validation layer to prevent SQL injection attacks. We've used OWASP guidelines and added input sanitization throughout the application. To ensure ongoing security monitoring, we'll be integrating with our SIEM system.'
Which abbreviation is being utilized for continuous security monitoring?
The description mentions 'integrating with our SIEM system' to monitor the application. SIEM (Security Information and Event Management) systems are designed for real-time monitoring of security events and logs within an organization. CVEs (Common Vulnerabilities and Exposures), SAST (Static Application Security Testing), IOCs (Indicators of Compromise), and IOAs (Indicators of Attack) relate to vulnerability identification and response, but not continuous monitoring.
20 / 26
Slack Message: '@john.doe just reported a potential vulnerability – we're seeing unusual network traffic patterns targeting our database servers. He's flagged these as potential IOCs and forwarded the logs to the security team.'
What does 'IOC' stand for in this message?
'IOC' stands for 'Indicators of Compromise'. In cybersecurity, an IOC is a signal that suggests a system or network has been compromised. It's a key element in incident response and threat hunting – John is using it to report suspicious activity based on observed data. The other options represent related but distinct security concepts.
21 / 26
Standup Update: 'I've been working on updating the SBOM for our microservices. We need to ensure we have a complete and accurate record of all software components to comply with new regulations regarding supply chain security.'
What does 'SBOM' stand for in this context?
SBOM stands for 'Software Bill of Materials'. It's a comprehensive list of all the software components (libraries, frameworks, and dependencies) used in building a piece of software. Maintaining an SBOM is crucial for supply chain security – it helps identify potential vulnerabilities introduced by third-party components and ensures compliance with regulations that require transparency about software origins.
22 / 26
During a code review of the new payment processing API, the automated scanner flagged a potential vulnerability: 'Insufficient permissions' returned as a 403 error. Sarah, the senior developer, comments to the junior developer, Mark: 'This keeps popping up – it seems like some users don't have access to the relevant data tables. We need to investigate the IAM roles associated with this user account. What action should Mark take immediately?',
The error 'Insufficient permissions' indicates a lack of proper authorization. Immediately reviewing the user's IAM roles is the correct initial step – disabling the account (option B) could disrupt legitimate operations and isn't a diagnostic action. A full audit (option A) is too broad; escalation (option C) delays immediate resolution, and running another automated scanner without understanding the root cause won't solve it (option D).
23 / 26
In a Slack channel dedicated to incident response, @alex.smith posts: 'We're seeing elevated DNS query attempts originating from our load balancers targeting what appears to be a known malicious IP address – this is being flagged as a potential IoC. The logs show frequent requests for the /api/v1/users endpoint. What does Alex likely mean by 'IoC'?',
'Indicators of Compromise' (IoCs) are specific data points that suggest a security breach is occurring. The context – unusual DNS requests targeting a malicious IP and a specific endpoint – aligns perfectly with the definition of IoCs. The other options represent entirely different concepts within cybersecurity.
24 / 26
During a standup meeting, David states: 'I'm updating the SBOM for our microservices platform to ensure compliance with NIST CSF controls. We need to maintain an accurate record of all software components to identify potential supply chain vulnerabilities and track dependencies. What is the primary goal of maintaining an SBOM?',
An SBOM (Software Bill of Materials) is primarily used for vulnerability management – specifically, it allows you to track software components and their dependencies. While an accurate SBOM can *support* efficient deployment, its core purpose isn't patching or cost reduction; it's about understanding the supply chain's security posture.
25 / 26
You are reviewing a PR that adds a new feature to an e-commerce application. The PR description includes the following line: 'We've implemented input sanitization throughout the application to prevent SQL injection attacks and ensure data integrity.' What is the *primary* reason for using input sanitization in this scenario?',
Input sanitization is a crucial defense against SQL injection attacks. By cleaning and validating user input *before* it's used in a database query, you prevent attackers from crafting malicious code that could compromise your system – GDPR compliance is an outcome of this secure practice.
26 / 26
A developer, Liam, reports the following error message in a production API response: 'Too Many Redirects'. He's investigating and discovers that a misconfigured routing rule is causing an infinite loop. What security concern does this *primarily* highlight?',
'Too Many Redirects' is a classic symptom of a Denial of Service (DoS) attack – specifically, a request loop. An attacker can trigger excessive redirects, consuming server resources and making the API unavailable to legitimate users. While misconfiguration *causes* the problem, the *security concern* it highlights is DoS.
What will I practice in "Security & Compliance Abbreviations"?
This is an IT Abbreviations exercise set. It walks through 26 scenario-based multiple-choice questions built around real usage of IT Abbreviations terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 26 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the IT Abbreviations vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more IT Abbreviations exercises?
See the IT Abbreviations exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — IT Abbreviations vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.