Prepare for CompTIA A+ Core 2 (220-1202) with free sample questions, a full-length diagnostic, topic drills, timed practice, operating systems, security, software troubleshooting, operational procedures, recovery sequencing, and detailed explanations in IT Mastery.
CompTIA A+ Core 2 (220-1202) focuses on operating systems, security, software troubleshooting, and operational procedures for real support environments. If you are searching for 220-1202 sample questions, a practice test, mock exam, or simulator, this is the main IT Mastery page to start on web and continue on iOS or Android with the same IT Mastery account.
Start a practice session for CompTIA A+ Core 2 (220-1202) below, or open the full app in a new tab. For the best experience, open the full app in a new tab and navigate with swipes/gestures or the mouse wheel—just like on your phone or tablet.
Open Full App in a New TabA small set of questions is available for free preview. Subscribers can unlock full access by signing in with the same app-family account they use on web and mobile.
Prefer to practice on your phone or tablet? Download the IT Mastery – AWS, Azure, GCP & CompTIA exam prep app for iOS or IT Mastery app on Google Play (Android) and use the same IT Mastery account across web and mobile.
Free diagnostic: Try the 90-question CompTIA A+ Core 2 full-length practice exam before subscribing. Use it to separate misses around operating systems, security, software troubleshooting, operational procedures, and recovery sequencing.
220-1202 questions usually reward the option that respects least privilege, follows the correct remediation sequence, and uses the right recovery tool before escalating to more disruptive action.
Core 2 questions usually test the safest recovery or hardening step, not the most forceful fix.
| Symptom signal | First check | Strong answer usually… | Weak answer usually… |
|---|---|---|---|
| Malware or suspicious behavior appears | Containment and remediation order | Isolates when needed, preserves data/evidence, removes malware, updates, and verifies | Deletes files randomly or wipes first |
| A user cannot access a resource | Identity, permissions, and least privilege | Checks account, group, permissions, policy, and authentication path | Grants broad admin rights to solve quickly |
| Windows will not boot | Recovery sequence | Uses the least destructive recovery tool appropriate to the symptom | Reinstalls before trying repair or restore options |
| A browser or app fails | Scope and recent change | Checks update, cache, extension, permissions, profile, and compatibility | Blames the network before local scope checks |
| Backup success is claimed | Restore validation | Tests restores regularly and after major changes | Trusts backup-success messages only |
| A ticket involves sensitive data | Privacy and documentation | Records necessary facts, protects confidential information, and follows policy | Copies sensitive data into notes or chat for convenience |
| Domain area | What the exam tests | What IT Mastery practice should force | Common trap |
|---|---|---|---|
| Operating systems | Whether you can use OS tools, services, startup behavior, storage, and command utilities | Pick the right tool for the symptom and platform | Memorizing commands without knowing when to use them |
| Security | Whether hardening, identity, permissions, encryption, and malware response are applied correctly | Prefer least privilege, secure defaults, and validated remediation | Over-permissioning users to close tickets |
| Software troubleshooting | Whether app, OS, browser, boot, and performance failures are isolated logically | Narrow scope before disruptive action | Reinstalling or resetting too early |
| Operational procedures | Whether ticketing, documentation, safety, professionalism, and privacy are respected | Solve the issue while preserving process and user trust | Treating documentation as optional after the fix |
| Mobile/MDM awareness | Whether policies and remote actions match device state and ownership | Choose enrollment, wipe, lock, and policy actions carefully | Using destructive remote actions without checking scope |
| Timing | Practice focus | What to review after the set |
|---|---|---|
| Days 7-5 | One 90-question diagnostic plus drills in weak Core 2 domains | Whether misses came from OS tools, permissions, malware, recovery, operational procedure, or MDM concepts |
| Days 4-3 | Mixed OS/security/troubleshooting scenarios | Whether you can choose the least destructive recovery or hardening step |
| Days 2-1 | Light review of malware-removal order, backup restores, Windows tools, permissions, privacy, and ticket documentation | Only recurring traps; avoid learning unfamiliar command lists late |
| Exam day | Short warm-up if useful | Choose the action that is secure, documented, and least disruptive |
If you can score above 75% on several unseen mixed attempts and explain the recovery or hardening sequence behind misses, you are likely ready. Repeating familiar support scenarios can hide weak troubleshooting order, so prioritize unseen mixed sets late.
Use these child pages when you want focused IT Mastery practice before returning to mixed sets and timed mocks.
Need concept review first? Read the CompTIA A+ 220-1202 Cheat Sheet on Tech Exam Lexicon, then return here for timed mocks, topic drills, and full IT Mastery practice.
Topic: Domain 2: Security
A help-desk technician reviews several Windows 10 workstations in a small office. All systems still use the same default local administrator password, AutoRun is enabled for USB media, and multiple trial/support services run in the background but are never used. Management wants a quick, low-cost security improvement with minimal user disruption. Which approach BEST meets this goal?
Options:
Best answer: C
Explanation: The choice to change default local administrator passwords to unique strong values, disable AutoRun for removable media, and stop/disable clearly unused third‑party trial/support services directly addresses each risk described:
All of this is done using existing OS tools, with no new purchases and minimal expected impact on user workflows, so it fully satisfies the “quick, low‑cost, minimal disruption” requirement.
Topic: Domain 4: Operational Procedures
Which statement BEST describes how an organization should handle backup test restores as part of its disaster‑recovery plan?
Options:
Best answer: B
Explanation: The choice that recommends performing test restores on a regular schedule and after major changes is correct because it captures both key ideas:
This matches standard backup best practices and the CompTIA A+ emphasis on verifying backups through test restores.
Topic: Domain 2: Security
In Windows 10/11, which built-in component is primarily responsible for delivering security intelligence (malware definition) and engine updates to Microsoft Defender Antivirus?
Options:
Best answer: C
Explanation: Windows Update is correct because it is the built-in Windows service responsible for downloading and installing Microsoft Defender Antivirus security intelligence and engine updates. Defender’s update mechanism is implemented as part of the Windows Update infrastructure, ensuring systems receive current protection alongside regular OS updates.
Topic: Domain 3: Software Troubleshooting
Which TWO of the following statements about using modern mobile OS settings (Android and iOS/iPadOS) to improve battery life are TRUE? (Select TWO.)
Options:
Correct answers: B and C
Explanation: The statement about reducing screen brightness or using auto-brightness is correct because the display is a major power user; dimming it directly reduces energy use. The statement about the battery usage screen is also correct, as both Android and iOS/iPadOS provide a battery or power usage view that breaks down power consumption by app or category, which is essential for diagnosing and addressing unusual battery drain.
Topic: Domain 2: Security
Which type of malware typically runs in system memory and abuses built-in tools such as PowerShell or WMI, leaving little or no traditional file-based footprint on the disk, making it harder for signature-based antivirus to detect?
Options:
Best answer: B
Explanation: Fileless malware best matches the description because it:
Topic: Domain 1: Operating Systems
Which of the following statements about basic Linux file management commands is NOT correct?
Options:
chmod is used to change the read, write, and execute permission bits on files and directories.grep searches for lines that match a given pattern in files or input passed from another command.ls is commonly used to list the files and directories in the current working directory or a specified path.rm moves files to a recycle bin by default so they can be easily restored later from the command line.Best answer: D
Explanation: The statement claiming that rm moves files to a recycle bin by default so they can be easily restored is incorrect. In standard Linux shells, rm unlinks (removes) files from the filesystem without using a recycle bin. Once rm completes successfully, there is no built-in undelete for those files, which is why technicians must use it carefully and often double-check filenames and paths before running it.
Topic: Domain 4: Operational Procedures
A company’s IT policy states that every change request must clearly state the business purpose, scope of work, type of change, affected systems, and a brief rollback plan, all written in concise language. Which underlying change-management principle does this policy BEST support?
Options:
Best answer: D
Explanation: The choice that emphasizes complete, clear change documentation to assess impact and risk matches the policy described. Listing purpose, scope, type, affected systems, and rollback plan ensures that all key fields of a change form are filled out in a concise way. This directly supports change-management goals: understanding impact, evaluating risk, and making informed approval decisions.
Topic: Domain 1: Operating Systems
A help-desk technician is hardening a Windows 11 laptop for a user who frequently downloads attachments. Security policy requires that users be able to easily spot files that are pretending to be documents but are actually executable malware, and to see any suspicious hidden files left in folders. The technician must meet this requirement by changing settings only in File Explorer. Which of the following File Explorer changes will BEST meet this requirement? (Select TWO.)
Options:
Correct answers: A and B
Explanation: Enabling the display of file name extensions directly addresses the need to spot disguised executables by making the true extension visible regardless of icon or filename. Enabling viewing of hidden files, folders, and drives supports finding suspicious content that uses the Hidden attribute, which is common in malware and troubleshooting scenarios. Together, these two File Explorer settings changes precisely match the security and visibility requirements in the scenario.
Topic: Domain 2: Security
A technician is creating a hardening checklist for new Windows 11 laptops that will be issued to the finance team. The goal is to reduce security risks from default configurations before users receive the systems.
Which of the following actions is NOT an appropriate hardening step for these workstations?
Options:
Best answer: C
Explanation: The choice to leave the default local administrator username and password in place so technicians have easy support access is the only action that clearly violates basic workstation-hardening principles. It keeps a well-known, predictable credential on every system, making it easy for attackers, malware, or unauthorized users to gain full control. This breaks the principles of secure configuration, least privilege, and proper password management.
Topic: Domain 2: Security
A home user has installed an IP security camera that streams video over TCP port 8443. The camera works correctly when viewed from a laptop or phone connected to the home Wi-Fi, but the phone app cannot connect when the phone is on cellular data. The ISP does not block this port, and UPnP is disabled per security policy. Which action on the SOHO router is the BEST next step to allow secure remote access to the camera?
Options:
Best answer: C
Explanation: Creating a port forwarding rule from external TCP 8443 to the camera’s internal IP and TCP 8443 tells the SOHO router exactly where to send inbound traffic for that service. Since the camera is already working on the internal network, this is the missing step to allow external access while limiting exposure to one specific port and device.
Topic: Domain 1: Operating Systems
A technician is preparing to upgrade several Windows 10 workstations to Windows 11. According to best practices, which task should be completed first to protect users in case the upgrade fails?
Options:
Best answer: A
Explanation: The choice to perform a full backup of users’ data and important system settings is correct because it directly protects what cannot be easily replaced: user files and configurations. If the Windows 11 upgrade fails or the system becomes unbootable, the technician can restore data from the backup, minimizing impact to users.
Topic: Domain 2: Security
A SOHO employee’s Windows 11 laptop was infected with ransomware after they opened an unexpected “invoice” email attachment from an unknown sender and clicked “Enable Content” in Word. You have removed the malware and restored files from backup. To most directly reduce the chance of this same type of infection happening again, what should you focus on when educating the user?
Options:
Best answer: C
Explanation: Focusing on how to recognize suspicious emails and attachments, avoid unknown links, and verify unexpected messages is correct because it directly addresses the behavior that caused the ransomware infection. By teaching the user to be skeptical of unsolicited invoices, shipping notices, or password alerts, and to verify with the supposed sender or IT before opening attachments or enabling macros, you significantly reduce the chance of this specific attack vector succeeding again.
Topic: Domain 2: Security
A medical research lab is decommissioning several external hard drives, backup tapes, and laptop SSDs that store unencrypted patient genomic data. Policy requires that the data be destroyed so it is unrecoverable even by advanced forensics, and the hardware will not be reused. Which TWO destruction methods are most appropriate? (Select TWO.)
Options:
Correct answers: B and E
Explanation: Sending the media to a certified shredding vendor is appropriate because shredding physically cuts the drives, tapes, and SSDs into small pieces, destroying the platters and flash chips. This aligns with the requirement that data be unrecoverable, regardless of forensic effort, and the hardware is not needed for reuse.
Using an industrial incineration service also meets the requirement. High-temperature incineration reduces storage media to ash or slag, destroying the magnetic surface of hard drives and tapes and the memory cells of SSDs. Both methods correspond to the highest sensitivity level for data destruction, where the priority is absolute irrecoverability, not reuse of the hardware.
Topic: Domain 3: Software Troubleshooting
A remote employee calls the help desk because their iPhone suddenly stopped connecting to the company Wi‑Fi network, “OfficeSecure,” which worked yesterday. Other employees are connected to the same Wi‑Fi without issues. On the caller’s phone, you see an airplane icon in the status bar and the Wi‑Fi control in Control Center is grayed out. You must restore Wi‑Fi quickly without changing any router settings or erasing user data. Which action should you take FIRST?
Options:
Best answer: C
Explanation: The choice to turn off Airplane Mode directly resolves the root cause indicated by the symptoms: the airplane icon and grayed‑out Wi‑Fi control. Disabling Airplane Mode re‑enables the phone’s wireless radios, including Wi‑Fi, allowing it to reconnect to the known network without deleting any data or modifying infrastructure.
This action is:
Topic: Domain 4: Operational Procedures
Which TWO of the following statements about electrical safety when servicing PCs are NOT correct or safe? (Select TWO.)
Options:
Correct answers: A and C
Explanation: The statement that it is safe to work inside the case if the PC is turned off but still plugged in is incorrect because standby power can remain on internal components; the cord must be unplugged before servicing. The statement that using a three‑to‑two‑prong adapter to bypass a missing ground connection is acceptable is also unsafe, because it intentionally defeats the safety ground and increases shock and fire risk instead of fixing the outlet or using a properly grounded circuit.
Topic: Domain 1: Operating Systems
A user’s Windows 11 laptop can no longer open a line-of-business application. The app shows a “License data corrupt” error. The vendor’s knowledge base says to fix it by deleting a specific key using Registry Editor. Company policy states that Tier 1 technicians must not modify the registry directly. As a Tier 1 tech, what is the BEST next step?
Options:
Best answer: D
Explanation: Escalating the ticket to Tier 2/desktop support so they can perform the vendor-documented registry change using Registry Editor is best because it:
This addresses the likely root cause (corrupt license data in the registry) while minimizing risk to the system and staying within organizational rules.
Topic: Domain 1: Operating Systems
Which TWO of the following statements about assigning licenses for cloud-based productivity suites are NOT correct? (Select TWO.)
Options:
Correct answers: B and C
Explanation: The statement about always giving every user the highest-tier license is incorrect because it ignores both cost and security best practices. Not every role needs advanced features like unlimited storage, advanced compliance tools, or full desktop app suites. Assigning the top tier to everyone usually wastes money and may violate least-privilege principles.
The statement claiming that licenses cannot be removed or reassigned without deleting the entire tenant is also incorrect. In most cloud productivity systems, licenses are managed at the user level. Admins routinely unassign a license from one user and assign it to another, or downgrade and upgrade license tiers as needs change. Deleting the whole tenant is unnecessary and would be an extreme and harmful action.
Topic: Domain 2: Security
A home user calls the help desk because their Windows 11 Home PC is showing constant fake antivirus pop-ups and redirecting every browser session. The PC is still connected to the home Wi-Fi and file sharing is enabled. The user does not have a recent full backup, and you plan to run antivirus scans afterward. To improve the current situation and meet the goals of containing the infection and preventing it from being restored later, what should you do first?
Options:
Best answer: B
Explanation: The choice to disconnect the PC from the network and turn off System Restore before scanning is best because it:
It directly fulfills both goals given in the question: improve containment and prevent restoration of the infection later.
Topic: Domain 4: Operational Procedures
Which script file extension is most commonly associated with shell scripts run in a Linux or macOS terminal (for example, by the Bash shell)?
Options:
Best answer: A
Explanation: The option using the.sh extension is correct because.sh is the conventional extension for shell scripts written for Unix-like shells such as Bash. Users typically execute these files in a Linux or macOS terminal by marking them as executable or by invoking them with the shell (for example, bash script.sh).
Topic: Domain 3: Software Troubleshooting
A user’s Windows 11 laptop is joined to the company domain. Logging in with a local admin account is fast, but logging in with the user’s domain account takes several minutes and sometimes loads a temporary profile. You notice the laptop’s clock is about 25 minutes behind the domain computers. Which action is the BEST next step to resolve the issue?
Options:
chkdsk on the system drive to repair possible file system corruption affecting the profile.Best answer: C
Explanation: Configuring the laptop to automatically synchronize its time with the domain time source targets the core issue: the 25-minute clock drift. In a Windows domain, Kerberos ticketing depends on accurate time. Fixing time sync restores normal authentication, which in turn allows the user’s domain profile to load correctly and quickly.
Topic: Domain 1: Operating Systems
You need to verify whether DNS is correctly resolving a domain name to an IP address on a Windows 11 PC. Which command-line tool is MOST appropriate for this task?
Options:
Best answer: B
Explanation: The choice that uses nslookup is correct because nslookup is explicitly designed to interact with DNS servers and show name-to-IP (and sometimes IP-to-name) mappings. It allows the technician to see exactly what the DNS server returns for a given hostname, which directly addresses the need to verify DNS name resolution.
Topic: Domain 1: Operating Systems
A help-desk technician is working on a Linux workstation that is low on disk space and has reports of web application errors. The technician plans to run several commands while troubleshooting.
Which of the following actions should the technician AVOID? (Select TWO.)
Options:
chmod -R 777 /var/www so that any user can modify the website files if needed.rm -rf /var/log/* to quickly delete all log files and free space.grep -i error /var/log/nginx/error.log to search the web server log for recent failures.find / -name nginx.conf 2>/dev/null to locate the main web server configuration file.ls -lh /var/log to review log file sizes before deciding what to clean up.cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak to create a backup before editing the configuration file.Correct answers: A and B
Explanation: The actions to avoid are the one that deletes all log files with rm -rf /var/log/* and the one that recursively sets chmod -R 777 /var/www.
Running rm -rf /var/log/* is dangerous because it irreversibly deletes all log files in /var/log, removing valuable troubleshooting data and potentially breaking services that expect specific log files or directories to exist. There is no review or backup step.
Using chmod -R 777 /var/www is also unsafe because it grants read, write, and execute permissions to everyone on the system for all web content files and directories. This violates least-privilege and can allow unauthorized modification, web shell uploads, or data exposure if the web server is compromised.
Topic: Domain 4: Operational Procedures
You are reviewing a work order before starting the job.
Exhibit:
| Field | Value |
|---|---|
| Task | Clean accumulated dust from multiple desktop PCs using compressed air |
| Location | Small, poorly ventilated copy room |
| Status | PC cases opened; all power cords unplugged |
| Personnel | Only technician present; no end users in room |
Based on the information in the exhibit, which personal protective measure should you take FIRST before you begin the task?
Options:
Best answer: B
Explanation: The choice to put on safety goggles and an air filter mask before using compressed air inside the PCs best matches the hazards described:
Goggles protect the eyes from dust and flying debris, and an air filter mask protects the lungs from inhaling fine particles. This is the most directly relevant and necessary personal protective measure before starting the described work.
Topic: Domain 4: Operational Procedures
Which TWO of the following statements about non-disclosure agreements (NDAs) and mutual NDAs are NOT correct? (Select TWO.)
Options:
Correct answers: C and E
Explanation: The statement that signing an NDA allows you to freely share confidential information with any third-party vendors is not correct because NDAs typically limit disclosure to specific, authorized parties and require additional agreements for other third parties.
The statement that NDAs usually expire as soon as employment or a contract ends is also not correct because many NDAs explicitly state that confidentiality obligations survive termination and continue for a defined period or indefinitely. These two statements contradict how NDAs are typically written and enforced, which is why they are the correct choices for being NOT correct.
Use this map after the sample questions to connect individual items to the A+ Core 2 operating-system, security, software, and operational-procedure decisions these practice samples test.
flowchart LR
S1["User software or security issue"] --> S2
S2["Identify OS security or procedure domain"] --> S3
S3["Collect symptoms and logs"] --> S4
S4["Apply safe configuration or remediation"] --> S5
S5["Verify user impact and security posture"] --> S6
S6["Document and educate user"]
| Cue | What to remember |
|---|---|
| OS support | Know Windows tools, macOS/Linux basics, boot issues, filesystems, and command-line utilities. |
| Security | Apply malware response, permissions, authentication, least privilege, and user education. |
| Software troubleshooting | Check updates, services, compatibility, logs, and user profile symptoms. |
| Procedures | Follow change management, documentation, backup, privacy, and safety expectations. |
| Mobile and apps | Separate app, OS, account, network, and hardware symptoms. |