Domain 1: Operating Systems
- NTFS is the required file system for the Windows system volume, supporting file-level ACL permissions, journaling, encryption (EFS), and compression; exFAT and FAT32 are used mainly for removable media.
- icacls manages NTFS permissions from the command line, for example icacls C:\Data /grant jdoe:F grants Full Control; standard NTFS rights are Read, Write, Modify, and Full Control.
- GPT (GUID Partition Table) supports drives larger than 2 TB and more than four primary partitions and is required for UEFI/Secure Boot; MBR is the legacy scheme limited to 2 TB and four primary partitions.
- Do not defragment an SSD - it has no seek penalty and defragmenting only adds wear; Windows instead runs TRIM to maintain write performance, and Optimize Drives recognizes SSDs automatically.
- Free disk space with Disk Cleanup or Storage Sense (removes temporary files and old Windows Update files), uninstall unused apps, and move large data files to another volume.
- Process and service management on Windows: taskkill /IM notepad.exe /F force-ends a process by image name, sc query spooler checks a service's state, and net stop spooler stops it.
- Linux command essentials: ip addr show lists interfaces and addresses, tail -n 20 /var/log/syslog reads recent log entries, ls -l shows permissions, and chmod changes standard rwx permissions.
- macOS essentials: Finder is the file manager, Spotlight is the system-wide search, Time Machine handles backups, and the Terminal app provides shell access.
- Joining a PC to an Active Directory domain (or Microsoft Entra ID) enables centralized authentication, Group Policy, and management, while a workgroup manages each PC's settings locally.
- Mass OS deployment uses a standardized image pushed over the network (PXE boot) with an unattended answer file for hands-off, repeatable configuration.
- Update rollouts should be tested on a small pilot ring first, then staged in phases with a defined rollback plan to limit the impact of a bad patch.
Domain 2: Security
- The three authentication factor categories are something you know (password/PIN), something you have (token/phone/smart card), and something you are (biometric); combining two different categories is multi-factor authentication (MFA).
- Defense in depth layers multiple overlapping controls so one failed control does not cause a full compromise; Zero Trust never implicitly trusts based on network location and continuously verifies identity for every request.
- BitLocker provides full-volume encryption (AES-128/256) on Windows Pro/Enterprise/Education and protects data at rest if a drive is removed; pair it with TLS to protect data in transit.
- Apply least privilege and role-based access control (RBAC) so accounts get only the access their job requires; administrators should use a separate dedicated admin account, distinct from their daily-use account, with MFA required for admin logins.
- Phishing is a social-engineering attack that tricks users into revealing credentials through fraudulent messages; defenses include user training, unique strong passwords, and MFA.
- Ransomware encrypts a victim's files, often after deleting shadow copies and exfiltrating data, then demands payment; offline or immutable, regularly tested backups are the primary recovery defense.
- On suspected malware infection, the first response step is to isolate/quarantine the machine from wired and wireless networks to stop lateral spread, then investigate and remediate.
- Other malware types to know: a worm self-replicates across a network without user action, a trojan disguises itself as legitimate software, a rootkit hides at a privileged level to evade detection, and a keylogger records keystrokes.
- MDM (Mobile Device Management) centrally enrolls and configures devices, pushes screen-lock/encryption/passcode policies, and supports remote wipe of a lost or stolen device.
- Endpoint hardening: enable a screen lock with a timeout, use biometrics or a strong passcode, enable full-disk encryption, keep the OS and apps patched, and install apps only from trusted stores.
- Place internet-facing servers in a DMZ (screened subnet) isolated from the internal LAN by firewalls; Windows includes Microsoft Defender Antivirus built in for baseline endpoint protection.
Domain 3: Software Troubleshooting
- The CompTIA troubleshooting methodology applies to software too: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action, implement the solution, verify functionality, and document the outcome.
- A PC that boots into an automatic repair loop or shows a blue screen (BSOD) is often fixed by booting into Safe Mode or the Windows Recovery Environment (WinRE) and running sfc /scannow or a system restore.
- sfc /scannow repairs corrupted Windows system files, and DISM /Online /Cleanup-Image /RestoreHealth repairs the underlying component store that SFC depends on; run DISM first if SFC itself fails.
- Slow application performance or a frozen system often traces to insufficient RAM, a failing or full storage drive, malware activity, or too many startup programs; Task Manager's Performance and Startup tabs help isolate which.
- Application crashes or a not-responding state can indicate a corrupted installation, a missing dependency such as a runtime library, or insufficient permissions; reinstalling or repairing the app is a common fix.
- Browser issues such as redirected searches, unwanted toolbars, or pop-ups typically indicate adware or a browser hijacker; remediation includes resetting browser settings and running a full malware scan.
- Mobile app troubleshooting includes checking for app and OS updates, clearing the app's cache or data, verifying free storage space, and confirming the correct permissions such as camera or location are granted.
- A system that will not accept updates or repeatedly fails to update should be checked for sufficient free disk space, a corrupted update cache, and connectivity to the update service.
- Unexpected reboots or shutdowns can point to an overheating CPU, a failing power supply, corrupted drivers, or a Windows stop error logged in the Event Viewer.
- When remediating a confirmed malware infection: quarantine the system, disable System Restore, update and run anti-malware software in Safe Mode, schedule scans and remediate remaining files, re-enable System Restore, and educate the end user.
Domain 4: Operational Procedures
- Follow the 3-2-1 backup rule (3 copies, 2 different media types, 1 offsite) and regularly test restores; 3-2-1-1-0 adds an offline/immutable copy and zero verified errors for ransomware resilience.
- Change management requires assessing risk, obtaining approval, documenting the change, and preparing a rollback/back-out plan before implementing it in production.
- Install a UPS with automatic graceful-shutdown integration to protect servers from data loss during a power failure and to ride out brief outages.
- Proper documentation includes network topology diagrams, asset/inventory records, and standard operating procedures (SOPs); knowledge base articles capture recurring issues and their resolutions for reuse.
- Safety practices: disconnect power before opening a case, use an ESD anti-static wrist strap and mat when handling components, and lift heavy equipment with proper technique to avoid injury.
- Environmental controls include monitoring temperature and humidity in server rooms, using surge suppressors and battery backups, and following proper disposal and recycling procedures for batteries and toner cartridges.
- Material Safety Data Sheets (MSDS/SDS) document the hazards and safe handling procedures for chemicals and equipment used in the workplace.
- Licensing models to know: per-seat/per-device, per-user, volume licensing for organizations, and open-source, which is free to use, modify, and redistribute under its license terms.
- Professionalism and communication: use clear, jargon-free language with end users, actively listen without interrupting, maintain a positive attitude, and avoid being judgmental about a user's technical skill.
- Chain of custody documents who has handled evidence and when, preserving its integrity for a potential legal or disciplinary investigation; first responders should know how to properly preserve evidence and when to escalate to law enforcement.
- Incident response basics: identify and report the incident through proper channels, preserve evidence and data integrity, and document everything before remediation begins.
CompTIA A+ Core 2 (220-1202) exam tips
- Memorize exact command-line syntax (sfc /scannow, DISM /Online /Cleanup-Image /RestoreHealth, icacls, taskkill, chmod) since Core 2 tests literal command knowledge, not just concepts.
- Learn the malware removal process in order; Core 2 scenario questions often ask what to do first or next during remediation.
- Know the operational procedures topics (change management, backup rotation, safety/ESD, documentation) cold - they show up as short, fast-scoring recall questions.
- Read for the BEST or FIRST answer when several options look valid; Core 2 often hinges on the safest or earliest correct step, such as isolating a machine before investigating it, or backing up before changing a system.
- Expect performance-based questions (PBQs) early in the exam; flag one you are unsure of and return to it rather than losing time you need for the multiple-choice questions.
- Build real hands-on comfort with Windows, macOS, and Linux basics side by side, since Core 2 expects you to recognize the equivalent tool or command across all three operating systems.
Study guide FAQ
How many exams do I need to pass, and how does Core 2 differ from Core 1?
You must pass two separate exams to earn the CompTIA A+ certification: Core 1 (220-1201) and Core 2 (220-1202). Core 2 covers operating systems, security, software troubleshooting, and operational procedures. Core 1 covers mobile devices, networking, hardware, and virtualization and cloud computing. Each exam is scored and passed independently.
What is the passing score, and how long is the exam?
CompTIA A+ Core 2 (220-1202) has a maximum of 90 questions with a 90 minute time limit, and requires a scaled score of 700 out of 900 to pass. Questions are a mix of multiple-choice and performance-based simulations (PBQs).
Are these official CompTIA questions?
No. These are independent practice questions written to reflect the topics and style of the CompTIA A+ Core 2 (220-1202) objectives. They are a study aid, not actual exam content, and are not affiliated with or endorsed by CompTIA.
Who is CompTIA A+ Core 2 designed for?
A+ targets entry-level IT support technicians such as help desk agents, desktop support staff, and field service technicians. There is no required prerequisite certification, and Core 2 can be taken before or after Core 1.
Do I need to pass Core 1 before I can take Core 2?
No. Core 1 and Core 2 can be taken in either order and on different dates; the CompTIA A+ certification is awarded only after you have passed both.
What topics make up the largest share of the Core 2 exam?
Operating systems and security make up the largest portions of Core 2, followed by software troubleshooting; operational procedures is a smaller but still tested domain covering documentation, safety, and professionalism.