This independent Cheat Sheet is for candidates preparing for the CompTIA A+ Core 2 (220-1202) exam. Use it to review high-yield operating system, security, troubleshooting, and operational procedure decisions quickly.
Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.
Scope and study context Core 2 is largely about working safely and professionally with operating systems, users, security settings, software problems, endpoint protection, and support procedures. The exam often rewards practical judgment: choosing the next best step, identifying the most likely cause, and applying a standard troubleshooting or security process without overcorrecting.
Use CompTIA’s current exam objectives as your scope authority. This page is IT Mastery practice support, not an official CompTIA resource.
Core 2 Exam Focus Map Area Be ready to do Common exam trap Operating systems Choose installation methods, Windows tools, command-line utilities, recovery options, and OS features Confusing Settings, Control Panel, MMC snap-ins, and command-line repair tools Security Apply least privilege, authentication, malware removal, device hardening, wireless security, and data handling Treating encryption, MFA, antivirus, or backups as complete security by themselves Software troubleshooting Diagnose OS, application, browser, update, mobile, and network symptoms Jumping to reinstall before checking logs, updates, services, permissions, and recent changes Operational procedures Follow safety, documentation, change management, professionalism, backup, and incident handling practices Skipping documentation, user communication, or verification after a fix
Operating Systems Cheat Sheet Installation and Deployment Choices Scenario Choose Why New device or unrecoverable OS Clean installation Removes previous OS state; requires data backup and app reinstall Preserve apps, files, and settings when supported In-place upgrade Faster migration path, but carries over some misconfigurations Many identical systems Image deployment Consistent baseline; often paired with unattended setup and post-deployment updates Boot over network for imaging/install PXE/network boot Useful for enterprise deployment; requires network support Need to reinstall while keeping user files Reset/refresh/recovery option Faster than manual rebuild; still verify backup first Test multiple OS versions Dual boot/multiboot Separate OS environments; bootloader and partition planning matter Automated install Unattended installation Uses answer/config files to reduce technician interaction Repair boot or system files Recovery environment/repair install Use before destructive reinstall when user data matters
Notes and examples Windows Edition and Feature Selection Feature availability can vary by Windows release and edition. For exam decisions, focus on the feature category.
Need Typical edition direction Notes Basic home use Home-class edition Limited business management features Domain join, Group Policy, business management Pro/Business-class edition Common small business choice Enterprise policy control, advanced security, large-scale management Enterprise/Education-class edition Usually centrally managed BitLocker management Business-class editions Device encryption may exist separately; know BitLocker is the full management feature Remote Desktop host Business-class editions Remote Desktop client is broader than host support Hypervisor features Business-class editions Also requires hardware virtualization support Local users/groups management Business-class editions Home systems may use simplified account management
File Systems, Partitioning, and Boot Modes Item Best use Exam notes NTFS Windows internal drives Supports permissions, encryption features, compression, large files FAT32 Broad compatibility, removable media Limited compared with modern file systems; not ideal for large files exFAT Large removable media across OSs Good for USB drives shared across Windows/macOS APFS Modern macOS storage Used by current macOS systems ext4 Common Linux storage Standard Linux file system choice GPT Modern disks, UEFI systems Preferred for modern Windows deployments MBR Legacy boot environments Legacy compatibility; avoid unless required UEFI Modern firmware Supports Secure Boot and modern boot workflows BIOS/legacy Older firmware May be required for older OS or hardware Secure Boot Prevent unsigned bootloaders Can block some recovery media or alternate OS installs TPM Hardware-backed security Used by features such as device encryption and measured boot
Windows System Locations and Variables Path or variable Purpose Trap C:\WindowsWindows OS files Do not casually edit or delete C:\Windows\System32Core system binaries On 64-bit Windows, System32 contains 64-bit binaries C:\Windows\SysWOW6432-bit compatibility binaries Name is counterintuitive C:\Program Files64-bit application install path App architecture matters C:\Program Files (x86)32-bit application install path Seen on 64-bit Windows C:\Users\usernameUser profile Includes Desktop, Documents, AppData %USERPROFILE%Current user profile variable Useful in scripts and paths %TEMP%Temporary files Can be cleared carefully during troubleshooting %APPDATA%Roaming app data User-specific application settings %LOCALAPPDATA%Local app data Not intended to roam between devices
Windows editions and feature awareness Know which features are associated with business-oriented Windows environments. Questions may ask why a feature is unavailable or which edition/configuration is appropriate.
Feature/category Review point Domain or enterprise management Business editions are commonly used where centralized identity and policy management are needed BitLocker-style disk encryption Commonly associated with protecting data at rest; know recovery-key implications Remote Desktop host capability Do not confuse being able to connect outward with accepting inbound remote desktop sessions Group Policy Centralized configuration in managed environments; local policy affects one machine Update controls Enterprise environments may use staged updates, maintenance windows, and rollback planning
Installation and deployment choices Method Use when… Watch for… Clean installation Starting fresh, replacing corrupted OS, repurposing device Data wipe risk; backup first Upgrade installation Keeping apps/data while moving to a newer supported OS Compatibility checks matter Repair/in-place repair OS components are damaged but user environment should be preserved Not a substitute for backup Image deployment Standardizing many machines Drivers, licensing, naming, domain identity, post-deployment updates Recovery/reset Returning a malfunctioning system to working state Understand keep-files vs remove-everything style choices Network/PXE deployment Deploying over the network Requires network boot support and deployment infrastructure
File systems and storage concepts File system/concept High-yield point NTFS Windows permissions, encryption/compression features, large file support FAT32 Broad compatibility but file size and feature limitations exFAT Useful for removable media and cross-platform exchange ext family Common in Linux environments APFS Modern macOS file system Partition Logical division of a physical disk MBR vs GPT Partitioning schemes; GPT is common on modern UEFI systems Basic vs dynamic-style storage Know that advanced volume features add complexity and recovery considerations
Boot and recovery decision table Symptom Consider first Useful tools/actions Windows fails after driver update Bad driver or update Safe Mode, rollback driver, uninstall update, System Restore/recovery tools Repeated startup repair loop Boot files, disk, update failure, corruption Startup Repair, command-line repair, disk diagnostics, restore/reset Blue screen after new hardware Driver, firmware, incompatible hardware Remove device, update/rollback driver, check vendor support Slow boot Startup apps, services, disk health, malware, updates Task Manager startup tab, Services, Event Viewer, disk checks User cannot sign in Password, account lockout, profile corruption, domain connectivity Verify credentials, network, account status, local admin recovery path “Operating system not found” Boot order, missing bootloader, failed disk BIOS/UEFI boot order, recovery media, disk diagnostics
Tool Use when High-yield notes Settings app Modern Windows configuration First stop for user-facing configuration Control Panel Legacy/admin settings Still appears in exam scenarios Device Manager Driver/device state Disable, update, roll back, uninstall devices Disk Management Partitions, volumes, drive letters Not for deep file repair; use chkdsk for file system checks Services Start/stop/configure services Startup type can be Automatic, Manual, Disabled Task Manager Processes, startup apps, performance snapshot Quick triage for high CPU/RAM/disk Resource Monitor More detailed resource usage Useful for disk/network/process correlation Performance Monitor Counters and long-term performance tracking More detailed than Task Manager Event Viewer Logs for system, security, application events Check timestamps around the reported issue Task Scheduler Scheduled jobs and triggers Malware and admin scripts may persist here System Configuration Boot and startup troubleshooting Safe boot and service isolation scenarios Registry Editor Low-level configuration database Back up before edits; wrong edits can break Windows Local Users and Groups Local account/group management Not the same as domain account management Local Security Policy Password, audit, and local security settings Local-only unless overridden by domain policy Group Policy Editor Policy settings Domain Group Policy usually overrides local policy Windows Defender Firewall Host firewall rules Check profile: domain, private, public Windows Security Antivirus, threat protection, device security Central security dashboard BitLocker management Full-volume encryption Protects data at rest, not data after login Windows Update OS and driver updates Failed updates often need logs, disk space, services System Restore Roll back system state Does not replace user data backup Backup/File History User file recovery Verify restore capability, not just backup existence Recovery Environment Startup repair, reset, restore, command prompt Use for boot failures and offline repairs
Command-Line Reference Windows Commands Command Primary use Example exam clue ipconfigShow IP configuration Verify address, gateway, DNS ipconfig /allDetailed network configuration MAC address, DHCP, DNS servers ipconfig /release and ipconfig /renewRenew DHCP lease APIPA or stale DHCP lease ipconfig /flushdnsClear DNS resolver cache Website resolves incorrectly on one PC pingBasic connectivity test Test loopback, gateway, remote host tracertTrace network path Determine where routing fails nslookupDNS query testing Confirm name resolution netstatShow network connections Suspicious connections or listening ports net useMap network shares Drive mapping/login script issues net userManage local users Local account reset or review gpupdateRefresh Group Policy Policy change not applied yet gpresult /rShow applied policies Confirm user/computer policy scope chkdskCheck file system/disk errors File corruption or improper shutdown sfc /scannowVerify/repair protected system files Missing/corrupt Windows files DISM /Online /Cleanup-Image /RestoreHealthRepair Windows component store Use when SFC cannot repair everything diskpartAdvanced disk/partition management Powerful; wrong disk selection is destructive robocopyRobust file copy Preserve directory structures and retry copies tasklistList running processes Command-line process review taskkillEnd a process Hung application or script shutdownRestart/shut down from CLI Remote or scripted shutdown scenarios bootrecBoot repair in recovery environment MBR/BCD repair scenarios bcdbootRebuild boot files UEFI/GPT boot repair scenarios
Notes and examples Linux and macOS Commands Command Primary use Notes lsList files Use options for details/hidden files cdChange directory Know absolute vs relative paths pwdPrint working directory Confirms current path cpCopy files Recursive copy needed for directories mvMove/rename Can overwrite if careless rmRemove files Recursive/force options are dangerous mkdirCreate directories Common scripting command catDisplay file contents Good for short text files lessView longer text files Safer than editing grepSearch text Common log and config search tool findLocate files Searches by name, type, time, size chmodChange permissions Numeric modes such as 755 are common chownChange ownership Requires elevated privileges psShow processes Pair with grep for process search killSend signal to process Use process ID sudoRun command with elevated privileges Prefer over logging in directly as root suSwitch user Often used to become root where allowed dfFile system free space Use for full disk symptoms duDirectory space usage Find large folders ifconfig or ipNetwork interface info ip is common on modern LinuxpingConnectivity test Same concept as Windows traceroutePath trace Equivalent concept to tracert dig or nslookupDNS testing dig is common on Linux/macOSmanManual pages Built-in command reference apt, dnf, yumPackage management Distribution-specific passwdChange password Local account password command
Command-line quick review Memorize what each command is for, not just its name.
Command Use Exam trap ipconfigView IP configuration; release/renew DHCP; flush DNS cache DNS cache flush does not fix a bad gateway pingBasic connectivity and name-resolution check ICMP may be blocked; failure is not always outage tracertPath to destination and where routing may fail It does not prove application-layer availability nslookupDNS query testing If DNS works, the app can still fail for other reasons netstatActive connections and listening ports Requires interpretation; many connections may be normal net userView/create/manage local users from CLI Local account commands do not manage cloud/domain identities net useMap network drives/resources Drive mapping failure may be permissions or DNS gpupdateRefresh Group Policy Policy may not apply if scope/filtering is wrong gpresultShow applied policies Better for policy troubleshooting than guessing chkdskFile system/disk checks Not a backup; can take time and may require reboot sfcVerify/repair protected Windows system files Not designed to fix third-party applications DISMRepair Windows image/component store Often used before or with SFC in corruption scenarios shutdownShutdown/restart/logoff from CLI Useful for remote or scripted administration robocopyRobust file copy/sync Wrong switches can mirror deletion; test carefully xcopyLegacy extended copy Know it, but robocopy is often stronger diskpartDisk/partition management Dangerous if wrong disk is selected formatPrepare a volume with a file system Destroys existing data on target volume
Linux and macOS command awareness Command/tool Platform High-yield use ls, cd, pwdLinux/macOS Navigate and list files cat, less, tailLinux/macOS View files/logs grepLinux/macOS Search text/output chmodLinux/macOS Change permissions chownLinux/macOS Change ownership ps, topLinux/macOS View processes/resource usage killLinux/macOS Stop a process sudoLinux/macOS Run command with elevated privileges ifconfig / ipLinux/macOS/Linux Network configuration review manLinux/macOS Command documentation apt, dnf, yumLinux Package management, depending on distribution Disk Utility macOS Disk formatting/repair Activity Monitor macOS Process and performance review Keychain Access macOS Credentials/certificates Time Machine macOS Backup and restore
Security Cheat Sheet Security Principles Concept Meaning Exam decision point CIA triad Confidentiality, integrity, availability Identify which goal a control protects Least privilege Give only required access Prefer standard user over administrator Defense in depth Multiple layered controls No single control is enough Zero trust Verify explicitly; assume no implicit trust Strong identity, device posture, and least privilege AAA Authentication, authorization, accounting Login, permissions, and logging are separate Non-repudiation Proof that an action occurred Logs, signatures, and audit trails Separation of duties Split sensitive tasks Reduces fraud and mistakes Need to know Access only to required data Often paired with least privilege
Notes and examples Authentication and Account Controls Control Use for Trap Password Basic knowledge factor Complexity alone does not stop reuse or phishing PIN Device-bound quick sign-in Not the same as a reusable password Biometrics Inherence factor Usually paired with device security Smart card/security key Possession factor Stronger than password-only login MFA Uses two or more factor types Two passwords are not true MFA SSO One identity for many apps Convenient but high-impact if compromised Password manager Unique complex passwords Protect the vault with MFA Account lockout Slows brute force attacks Can cause denial-of-service if too aggressive UAC Prompts for elevation Does not replace NTFS permissions Local account Stored on one device Not centrally managed Domain account Managed by directory service Central policy and access control Cloud identity Used for SaaS/cloud services Check sync, MFA, and conditional access symptoms
Permission and Sharing Rules Item What to remember NTFS permissions Apply locally and over network; support inheritance Share permissions Apply only over network share access Effective permissions Combination of user, group, inherited, explicit, share, and NTFS controls Most restrictive result When share and NTFS both apply, the more restrictive effective access wins Explicit Deny Usually overrides Allow; use sparingly Inheritance Child objects inherit parent permissions unless inheritance is changed Ownership Owner can usually change permissions; taking ownership is a major admin action Move vs copy Permissions may be retained or inherited depending on volume and operation Groups Assign permissions to groups, not individual users, when possible
Wireless and Network Security Choices Need Choose Avoid Secure Wi-Fi WPA2/WPA3 with strong passphrase or enterprise auth WEP, weak PSK, shared passwords Guest access Guest network/VLAN isolation Putting guests on internal LAN Easier device onboarding QR code or managed provisioning WPS if security is a concern Remote administration VPN or secure management path Open RDP/SSH to the internet Secure web access HTTPS HTTP for sensitive logins Secure shell access SSH Telnet Secure file transfer SFTP/FTPS/HTTPS Plain FTP Internal name resolution issue DNS troubleshooting Assuming internet outage first Suspected rogue wireless Check SSIDs, BSSIDs, placement, logs Trusting SSID name alone
Common Ports and Secure Alternatives Service Common port Security note SSH 22 Secure remote CLI DNS 53 Required for name resolution; can be abused HTTP 80 Not encrypted HTTPS 443 Encrypted web traffic SMB 445 Windows file sharing; restrict exposure RDP 3389 Protect with VPN/MFA/strong policy SMTP 25, 587 Mail sending; 587 commonly used for authenticated submission POP3 110, 995 995 is encrypted POP3 IMAP 143, 993 993 is encrypted IMAP LDAP 389, 636 636 is LDAPS Kerberos 88 Common domain authentication protocol
Authentication and account security Control What it protects against Review point MFA Password-only compromise Stronger when factors are truly different Password manager Weak/reused passwords Protect the vault with strong MFA Account lockout Brute-force attempts Too strict can cause denial-of-service issues Biometrics Credential sharing and convenience issues Usually paired with device or PIN Smart card/security key Phishing-resistant authentication in some setups Requires enrollment and recovery process Single sign-on Reduces password prompts A compromised primary identity has broad impact Local admin restriction Malware and accidental system changes Use standard accounts for daily work Screen lock Unauthorized local access Short timeout for shared/public areas
Endpoint hardening Control Why it matters Patch OS and applications Reduces known vulnerabilities Enable host firewall Limits unsolicited inbound access Use antivirus/EDR protections Detects and blocks malware behavior Disable unused services Reduces attack surface Remove unnecessary apps Fewer vulnerabilities and conflicts Encrypt storage Protects data if device is lost or stolen Use secure boot/firmware protections Helps protect startup integrity Configure automatic lock Reduces walk-up access risk Use standard user accounts Limits damage from user mistakes and malware
Wireless and network security Topic High-yield point WPA2/WPA3 Prefer modern encryption over obsolete wireless security WPS Convenient but often discouraged in secure setups Guest network Isolates visitors from internal resources Strong passphrase Prevents easy unauthorized access MAC filtering Weak as a primary security control SSID hiding Not real security by itself Captive portal Common in public/guest environments VPN Protects traffic over untrusted networks and supports remote access DNS filtering Helps block known malicious domains Firewall profiles Public networks should be more restrictive than private/domain profiles
Social engineering recognition Attack Recognition cue Phishing Deceptive message asking for credentials/action Spear phishing Targeted phishing using personal or business context Whaling Targets executives or high-value users Vishing Voice-based social engineering Smishing SMS/text phishing Impersonation Pretending to be support, vendor, executive, courier Shoulder surfing Observing screens/keystrokes Tailgating Following an authorized person into a restricted area Dumpster diving Searching discarded materials Evil twin Rogue wireless network posing as legitimate On-path attack Intercepting/modifying communications between parties
Data handling and disposal Scenario Best practice Sensitive file no longer needed Secure deletion according to policy Disk repurposed internally Wipe or reimage according to data classification Disk leaving organization Sanitize, destroy, or follow approved chain-of-custody process Lost encrypted laptop Verify encryption status and report through incident process Shared printer output Retrieve promptly; use secure print where appropriate Emailing sensitive data Use approved encryption and recipients only Ticket notes Do not expose unnecessary secrets or personal data
Malware, Social Engineering, and Hardening Malware and Attack Types Threat Key clue Response focus Virus Attaches to files/programs Scan, remove, restore clean files Worm Self-propagates over network Isolate and patch vulnerable systems Trojan Disguised as legitimate software Remove payload and source app Ransomware Encrypts files and demands payment Isolate, preserve evidence, restore from clean backup Spyware Tracks activity Remove, review browser/app permissions Keylogger Captures keystrokes Remove and reset credentials from clean device Rootkit Hides deeply in OS Offline scan or rebuild may be required Cryptominer High CPU/GPU use, unknown process Remove malware and patch entry point Phishing Fraudulent message/link Verify sender and report Spear phishing Targeted phishing Higher credibility; verify out of band Smishing SMS phishing Do not use message links Vishing Voice phishing Verify caller identity independently Shoulder surfing Observing screen/keyboard Privacy filters and awareness Tailgating Following into secure area Badge enforcement Dumpster diving Searching discarded data Shred and sanitize Evil twin Fake Wi-Fi AP Verify network identity, use VPN where appropriate Rogue AP Unauthorized AP on network Locate, disconnect, investigate
Notes and examples Malware Removal Workflow Step Action Exam note 1 Identify and research symptoms Pop-ups, redirects, slow system, unknown processes, disabled security 2 Quarantine infected system Disconnect network to prevent spread or data loss 3 Disable restore points if used Prevent restoring infected state; re-enable after cleanup 4 Remediate Update anti-malware, scan, remove, or rebuild if needed 5 Schedule scans and run updates Patch OS, apps, browsers, plugins 6 Re-enable restore and create clean point Only after system is verified clean 7 Educate user Explain cause, prevention, and reporting path 8 Document Record symptoms, actions, tools, and outcome
Endpoint Hardening Checklist Use standard user accounts for daily work. Apply OS, browser, firmware, and application updates. Enable host firewall and endpoint protection. Remove unnecessary software, services, browser extensions, and startup items. Use full-disk encryption on portable devices. Enforce screen lock and strong authentication. Disable autorun/autoplay where appropriate. Restrict local administrator membership. Back up important data and test restores. Log security events and review alerts. Software Troubleshooting Reference CompTIA Troubleshooting Method Step Action What not to skip 1 Identify the problem Question user, identify changes, back up data if needed 2 Establish a theory of probable cause Start with simple/common causes 3 Test the theory If theory fails, establish a new one or escalate 4 Establish and implement a plan of action Consider business impact 5 Verify full functionality and implement preventive measures Confirm with the user when appropriate 6 Document findings, actions, and outcomes Required for repeatability and support history
Notes and examples Windows Software Symptoms Symptom Likely checks Possible fix Slow performance Task Manager, startup apps, disk space, malware, updates Disable unnecessary startup items, remove malware, free space, upgrade resources App crashes Event Viewer, app updates, compatibility, permissions Repair/reinstall app, update dependencies, run compatibility mode Missing DLL or dependency App install state, runtime packages Repair app or reinstall required runtime Blue screen/restart loop Drivers, hardware changes, updates, Event Viewer Safe Mode, roll back driver, uninstall update, system restore Service will not start Services console, dependencies, account permissions Correct startup type, credentials, dependency service Windows update failure Disk space, services, network, logs Free space, restart update services, run troubleshooter, repair components User cannot access file NTFS/share permissions, ownership, encryption Correct group membership or permissions Profile issue Local profile corruption, sync errors Recreate profile after data backup Certificate warning Date/time, hostname mismatch, untrusted cert Correct clock, verify site, install trusted certificate only when appropriate Browser redirects/pop-ups Extensions, proxy settings, malware Remove extensions, reset browser, scan system Cannot install software Admin rights, OS compatibility, installer integrity Use admin approval, correct version, trusted source App blocked Security policy, SmartScreen, allowlist Verify trust, then adjust policy if authorized File association wrong Default apps, registry/app install Reset default app association Drive full Disk Cleanup, temp files, large profiles Remove temp files, archive data, expand storage No network after update Driver, IP settings, VPN, firewall Roll back driver, renew IP, check firewall/VPN
Boot and Recovery Decision Table Problem First options Escalation Windows fails after driver update Safe Mode, roll back driver System Restore or uninstall update Boot files damaged Startup Repair bootrec, bcdboot, or rebuildCorrupt system files SFC DISM, then rerun SFC OS unstable after recent change System Restore Reset/reinstall if unresolved User data at risk Boot to recovery media and back up Remove drive or use external tools if authorized macOS disk issue Recovery, Disk Utility First Aid Restore from Time Machine or reinstall macOS Linux boot/config issue Recovery/single-user mode, logs Repair bootloader or restore config backup
Browser and SaaS Troubleshooting Symptom Check Works in one browser, not another Cache, cookies, extensions, browser version Login loop Cookies blocked, SSO issue, time skew, MFA challenge Access denied Account status, license/entitlement, group membership, conditional access Slow web app Browser cache, network latency, DNS, service status Certificate error System time, hostname, trust chain, inspection proxy Pop-ups/toolbars Extensions, notifications, malware Sync not working Account sign-in, storage quota, network, service health MFA prompt repeatedly fails Clock sync, registered device, push fatigue, phone change
Core troubleshooting method Use the standard troubleshooting flow whenever the question asks for the “next” or “best” action.
Step What it means Candidate trap Identify the problem Gather symptoms, question the user, determine changes, duplicate issue if possible Fixing before understanding scope Establish a theory Start with probable cause; consider simple causes first Choosing rare causes without evidence Test the theory Confirm or rule out the cause Making irreversible changes as a “test” Establish a plan Decide remediation and consider effects No rollback plan or user impact check Implement solution Apply the fix or escalate Escalating too late or too early Verify functionality Confirm the issue is resolved and preventive steps work Stopping after the first successful reboot Document findings Record cause, action, outcome, and future prevention Treating documentation as optional
Scope decision rules If the issue affects… Think first about… One user on one device Profile, local settings, permissions, app config, cached credentials One device for all users OS corruption, local service, driver, hardware, firewall, disk, malware Many users on one application Application service, update, certificate, authentication, server-side change Many users on the network DNS, DHCP, routing, firewall, identity provider, shared service outage Only remote users VPN, MFA, conditional access, endpoint compliance, split tunnel, DNS Only after an update Driver rollback, update history, compatibility, known issue, restore point
Windows symptom table Symptom Likely areas to check Better first action than reinstalling App crashes on launch Updates, dependencies, permissions, profile corruption, event logs Check Event Viewer/Reliability Monitor App works for admin only File/registry permissions, elevation requirement Adjust permissions or app configuration Slow system Startup apps, disk health, memory pressure, malware, updates Use Task Manager/Resource Monitor BSOD Driver, hardware, memory, update, firmware Check stop information, recent changes, drivers Windows update fails Disk space, services, network/proxy, corrupted update cache Review update history and logs; retry after clearing issue Printer unavailable Spooler, driver, queue, network path, default printer Check queue/spooler/connectivity No sound Output device, mute, driver, service, app setting Verify selected output and driver Cannot access share DNS, credentials, permissions, offline server, firewall Test path, credentials, effective permissions Time/date wrong Time service, time zone, CMOS/firmware, domain sync Correct sync source and time zone Certificate warning Wrong date/time, expired cert, interception, wrong hostname Do not bypass without validation
Browser troubleshooting Symptom Possible cause Pop-ups/redirects Malicious extension, adware, notification permission, DNS issue Certificate errors Date/time wrong, expired certificate, captive portal, inspection proxy One site fails DNS cache, browser cache, site issue, security block All sites fail Network, proxy, DNS, firewall, VPN Slow browser only Extensions, cache, profile, hardware acceleration Saved passwords missing Profile sync issue, browser profile, password manager problem
Quick checks: private/incognito window, alternate browser, disable extensions, clear cache for the affected site, verify proxy/VPN, check DNS, review security warnings.
Mobile OS and app troubleshooting Symptom Review actions App crashes Update app/OS, clear cache where supported, reinstall app, check permissions Battery drains quickly Review battery usage, background activity, radios, location, failing battery Device overheats Heavy app, charging issue, environment, battery problem Cannot email/sync Credentials, MFA, server settings, network, account lock, storage Location not working Permissions, location services, airplane mode, app settings No network Airplane mode, Wi-Fi/cellular settings, SIM/eSIM, carrier issue, VPN Storage full Remove unused apps/media, clear cache, cloud sync settings Suspicious behavior Remove unknown apps/profiles, scan where supported, update OS, reset if needed
Trap: assuming every mobile issue is hardware. App permissions, account authentication, and OS updates are frequent causes.
Mobile OS and Application Security Need or symptom Check or choose Lost or stolen phone Remote lock/wipe, account password reset, revoke sessions BYOD management MDM/MAM policy, containerization, minimum OS version Excessive permissions Review app permissions and privacy settings Battery drain Background apps, location services, push sync, malware App crashes Update app/OS, clear cache, reinstall app No email sync Credentials, MFA/app password policy, server settings, network Untrusted app source Avoid sideloading unless explicitly authorized Public Wi-Fi use VPN, HTTPS, avoid sensitive work if untrusted Device resale/disposal Back up, sign out, factory reset, remove from account/MDM Screen lock PIN/passcode/biometric with auto-lock
Backup, Recovery, and Data Handling Backup Types Type Captures Restore characteristic Full All selected data Simplest restore; more storage/time Incremental Changes since last backup of any type Efficient backup; restore needs chain Differential Changes since last full backup Larger over time; restore needs full plus latest differential Image Entire system/volume state Useful for bare-metal recovery File-level Selected files/folders Good for user data Snapshot Point-in-time state Fast rollback; not always a separate backup Cloud backup Offsite copy Depends on bandwidth, account, provider availability Offline backup Disconnected copy Helps against ransomware
Notes and examples Recovery Terms Term Meaning Exam use RPO Maximum acceptable data loss Determines backup frequency RTO Maximum acceptable downtime Determines recovery method and urgency Versioning Multiple historical copies Helps recover from accidental overwrite Retention How long backups are kept Balance recovery needs and storage policy Test restore Proves backup is usable Backup is not complete until restore is verified 3-2-1 strategy Multiple copies, media types, and offsite copy Best-practice concept, not a substitute for policy
Data Destruction and Disposal Media/data Appropriate action Notes Paper records Shred or use approved destruction bin Protects printed sensitive data Hard drives Wipe, degauss where appropriate, or destroy Degaussing does not apply to all media types SSDs/flash Secure erase or physical destruction Wear leveling makes simple overwrite less reliable Optical media Shred/crush Do not just throw away Mobile devices Factory reset, remove accounts, wipe via MDM Verify encryption and account removal Toner/printer parts Recycle per policy Avoid spills and environmental mishandling Batteries Recycle properly Do not puncture or discard casually
Operational Procedures Change Management Phase Technician responsibility Request Define what is changing and why Impact analysis Identify affected users, systems, risks, and rollback needs Approval Get authorization before production changes Communication Notify stakeholders of timing and impact Implementation Follow documented steps Rollback Restore previous state if change fails Validation Test system and user functionality Documentation Record final state, issues, and lessons learned
Notes and examples Documentation and Ticketing Record Include Ticket User, asset, symptoms, priority, contact method Troubleshooting notes Tests, results, error messages, timestamps Change record Scope, approval, schedule, rollback plan Asset record Serial/tag, owner, location, warranty/support status Knowledge base article Symptoms, cause, resolution, prevention Incident record Timeline, affected data/systems, containment, escalation
Safety and Environmental Practices Situation Correct response Working inside PC Power off, unplug when appropriate, use ESD protection ESD-sensitive components Use antistatic strap/mat, handle by edges Heavy equipment Use proper lifting or get assistance Liquid spill Disconnect power safely, follow site procedure Battery swelling Stop use, isolate safely, follow disposal process Laser printer service Be careful around fuser heat and toner Chemical exposure Refer to safety data sheet and PPE guidance Fire Use correct extinguisher type and evacuate if unsafe Cable hazards Route and secure cables to prevent trips E-waste Recycle through approved process
Professional Communication Scenario Best practice Upset user Listen, acknowledge, avoid blame Nontechnical user Use plain language, avoid jargon Need downtime Explain impact and expected duration Unauthorized request Follow policy; do not bypass controls Privacy-sensitive data visible Minimize exposure and do not discuss unnecessarily Escalation needed Provide concise summary and evidence Work completed Verify with user and document outcome Mistake made Report promptly and follow remediation process
Change management Step Why it matters Define the change Prevents unclear or expanding work Identify risk and impact Avoids surprise outages Get approval Ensures accountability Schedule maintenance window Reduces user disruption Communicate Sets expectations Back up and create rollback plan Allows recovery if change fails Implement and test Confirms intended result Document outcome Supports future troubleshooting
Trap: making an urgent fix without documenting what changed. In later troubleshooting questions, the undocumented change is often the hidden cause.
Ticketing and documentation Good ticket notes usually include:
User/device/application affected Symptoms and error messages Time started and recent changes Scope and business impact Troubleshooting steps already tried Root cause if known Fix applied Verification performed User communication and follow-up Escalation details if applicable Avoid recording passwords, unnecessary personal data, or unapproved sensitive details in tickets.
Professional communication Situation Strong technician behavior User is frustrated Listen, acknowledge, ask focused questions User caused the issue Avoid blame; educate respectfully You need more time Set expectations and provide updates Issue is outside your authority Escalate with clear notes You do not know the answer Say you will research or escalate; do not guess Working around sensitive data Maintain privacy and follow policy Remote support session Get permission before taking control or viewing files
Safety and environmental procedures Topic Review point ESD Use antistatic handling, grounding, proper bags/mats Electrical safety Disconnect power where appropriate; avoid unsafe equipment Batteries Handle swollen/damaged batteries carefully; follow disposal rules Lifting Use proper lifting technique and assistance for heavy equipment Cables Avoid trip hazards and blocked airflow Toner/chemicals Follow safety documentation and disposal practices Fire suppression Use the correct class/type for the environment Ventilation Prevent overheating and exposure to fumes Personal protective equipment Match PPE to task and workplace policy
Scripting and Automation Basics Concept Know Script types Batch, PowerShell, Bash, Python, JavaScript Variable Stores reusable value Conditional Runs logic based on true/false test Loop Repeats actions Function Reusable block of code Comment Explains code; ignored by interpreter Input validation Prevents bad or unsafe input Error handling Responds to failures predictably Exit code Indicates success/failure to calling process Scheduling Use Task Scheduler, cron, or management platform Security Do not run unknown scripts; review source and permissions Least privilege Run automation with only required rights Testing Test in nonproduction or limited scope first
Notes and examples Script Decision Points Task Good script candidate? Why Rename many files Yes Repetitive and rule-based Collect logs from many devices Yes Consistent output and time savings One-time uncertain repair Maybe Manual verification may be safer Delete files across profiles High risk Requires backup, testing, and narrow scope Change security settings High risk Requires approval and rollback plan Install approved app on many PCs Yes Use management tools and logging
Scripting and automation basics The CompTIA A+ Core 2 (220-1202) candidate does not need to be a software engineer, but should understand what scripts do and why they can be risky.
Concept Review point Variables Store values such as paths, usernames, or counters Environment variables System/user values like paths and temp locations Conditionals Run different actions based on true/false tests Loops Repeat actions; dangerous if logic is wrong Comments Explain script purpose and assumptions Exit codes Indicate success/failure for automation Input validation Prevents bad data from causing damage Permissions Scripts run with the privileges of the executing context Testing Run in a safe environment before production Signing/execution policy Helps control unauthorized scripts
File extensions to recognize Extension Typical association .bat / .cmdWindows batch scripts .ps1PowerShell .shShell script .pyPython .jsJavaScript .vbsVBScript
Script trap: a script that deletes, moves, formats, changes permissions, or modifies many accounts should be treated as high risk. Review it, test it, back up first, and confirm the target path or scope.
High-Yield Traps to Review Trap Correct distinction Encryption equals backup Encryption protects confidentiality; backup protects recovery RAID equals backup RAID improves availability; it does not replace backups Admin account for daily work Use standard user; elevate only when needed Share permission only NTFS permissions also apply to network access Explicit Deny everywhere Deny can override Allow and cause difficult troubleshooting SSID hiding is strong security It is not a substitute for WPA2/WPA3 and strong authentication MAC filtering is strong security MAC addresses can be spoofed Antivirus alone stops all malware Layer controls: patching, least privilege, filtering, backups, training Reinstall first Preserve data and diagnose before destructive action Clear logs to fix issue Logs are evidence; preserve relevant records SFC and DISM are identical SFC checks protected system files; DISM repairs component store UAC is permission management UAC controls elevation prompts; permissions still matter Public vs private firewall profile Public is more restrictive; wrong profile can block services Local policy vs domain policy Domain policy can override local settings System Restore is user backup It rolls back system state, not a full user data backup Safe Mode fixes issue permanently It isolates causes; still remediate root cause
Notes and examples “Best next step” traps Choosing a final fix before confirming the problem. Reimaging before checking logs, drivers, updates, or user profile issues. Escalating without collecting basic information. Continuing troubleshooting after discovering a security incident that must be isolated/escalated. Making a change without rollback or documentation. Bypassing certificate or security warnings for convenience. Giving admin rights instead of fixing the specific permission problem. Assuming wireless signal strength means authentication, DHCP, DNS, and internet access all work. Confusing backup, sync, restore point, and full system image. Treating user education as optional after malware or phishing events. If asked to… Prefer… Not usually… Find why an app crashed yesterday Reliability Monitor/Event Viewer Randomly reinstalling drivers See current CPU/memory hogs Task Manager/Resource Monitor Registry Editor Troubleshoot policy application gpresult, gpupdate, policy toolsChanging local settings blindly Check DNS resolution nslookup, ipconfig /displaydnsReplacing the NIC Repair Windows system files sfc, DISMFormatting the disk first Manage partitions Disk Management/diskpart File Explorer permissions Investigate malware symptoms Security tools, isolation, logs Ignoring network spread risk
Last-Week Review Checklist Match Windows tools to symptoms without guessing. Practice command purposes, especially network, boot, disk, and system repair commands. Review NTFS/share permission interactions and Deny behavior. Memorize malware removal order and why quarantine comes early. Compare backup types and recovery use cases. Review Wi-Fi, browser, MFA, account, and SaaS access troubleshooting. Practice deciding when to repair, restore, reset, reimage, or escalate. Review change management, documentation, safety, and user communication scenarios. For performance-based questions, read the task carefully before changing settings. High-yield Core 2 map Area What to review quickly What questions often test Operating systems Windows features, installation methods, recovery tools, file systems, command-line utilities, macOS/Linux basics Best tool for a task, correct installation/recovery choice, command output interpretation Security Authentication, permissions, malware response, endpoint hardening, wireless security, social engineering, data handling Least privilege, order of response, secure configuration, recognizing attack types Software troubleshooting Boot issues, OS errors, application crashes, update failures, browser symptoms, mobile OS issues Most likely cause, next troubleshooting step, safe remediation Operational procedures Documentation, change management, safety, professionalism, backups, scripting risks, environmental controls Technician behavior, escalation, rollback planning, evidence preservation
Exam-day thinking pattern When a question gives a scenario, slow down and identify what it is really asking:
Symptom — What is broken or risky?Scope — One user, one device, many users, one application, entire network?Recent change — Update, driver, policy, installation, permission change, malware event?Impact — Data loss risk, security incident, safety issue, business outage?Best next step — Verify, contain, document, escalate, remediate, or test?A common mistake is jumping to a dramatic fix—reimage, replace hardware, reinstall OS—before checking simpler or safer causes such as credentials, permissions, network settings, services, updates, or user profile issues.
Know the right tool for the task. Many exam questions are essentially tool-selection questions.
Tool Best use Common trap Task Manager Processes, performance, startup apps, quick service view Using it for deep historical logs Event Viewer System/application/security logs and error patterns Ignoring timestamps and event source Device Manager Drivers, disabled devices, hardware conflicts Reinstalling OS for a driver issue Disk Management Partitions, volumes, drive letters Confusing it with file-level permissions Services Start/stop/configure services Disabling services without dependency review System Configuration Startup and boot troubleshooting Permanent changes without documenting Performance Monitor Counters and long-term performance analysis Using it when Task Manager is enough Resource Monitor Real-time CPU, disk, network, memory detail Overlooking disk queue or network activity Reliability Monitor Timeline of crashes, updates, and failures Forgetting it is useful after “it started yesterday” Registry Editor Low-level OS/application configuration Editing without backup or exact instruction Local Users and Groups Local account/group management Not available in all environments/editions Local Security Policy Local password/audit/security settings Confusing local policy with domain policy Group Policy tools Managed policy application and troubleshooting Assuming local settings override domain policy Windows Defender Firewall Host firewall rules and profiles Opening broad inbound access unnecessarily Windows Security tools Antivirus, threat protection, device security Disabling protection instead of adding controlled exclusions Windows Update Patch status and update history Ignoring rollback/uninstall options Backup and recovery tools Restore files/system state Backups are useful only if restore works
Permissions and access control Core permission principles Principle Meaning Exam application Least privilege Give only the access required Avoid making users local admins for convenience Need to know Access should match job role and data sensitivity Restrict confidential files by group/role Separation of duties Split sensitive tasks across roles One person should not control all critical steps Role-based access Assign rights through groups/roles Manage groups, not one-off user exceptions Explicit deny Deny can override allow in many permission models Use carefully; it can block intended access Inheritance Permissions flow from parent containers Check inherited permissions before adding new ones
Notes and examples NTFS and share permission traps Situation Rule of thumb Local access to files NTFS permissions apply Network access to shared folder Both share and NTFS permissions matter Share allows Full Control, NTFS allows Read Effective network access is limited by NTFS Share allows Read, NTFS allows Modify Effective network access is limited by share permission User belongs to multiple groups Combined allows generally accumulate, but denies can override User suddenly loses access Check group membership, inheritance, explicit deny, moved folder, token refresh/sign-out
Candidate mistake: selecting “reinstall the application” when the actual issue is that the user cannot write to a folder, access a share, or inherit the right group membership.
Malware and incident response Malware types to distinguish Type Core behavior Virus Attaches to files/programs and spreads through execution Worm Self-propagates across systems/networks Trojan Disguises itself as legitimate software Ransomware Encrypts or blocks access and demands payment Spyware Collects information without consent Keylogger Captures keystrokes Rootkit Hides privileged malicious activity Botnet agent Enrolls device into remote-controlled network Cryptominer Uses system resources to mine cryptocurrency Adware/PUP Displays ads or unwanted behavior; may be bundled
Notes and examples Malware response sequence A practical endpoint malware-removal sequence is:
Identify symptoms — pop-ups, redirects, disabled security tools, high CPU, unknown processes, file encryption, suspicious network traffic.Isolate or quarantine — disconnect from network if needed to prevent spread or data loss.Preserve what matters — if it may be an incident, follow policy before wiping evidence.Disable persistence where applicable — startup entries, scheduled tasks, malicious services, browser extensions.Update tools and scan — use trusted antimalware and offline scanning if appropriate.Remediate — remove malware, repair settings, patch exploited software, reset affected credentials.Verify — rescan, confirm symptoms are gone, check logs and network behavior.Restore protections — firewall, antivirus, updates, restore/recovery features where applicable.Educate user and document — record cause, impact, actions, and prevention.Common trap: immediately deleting or reimaging a system that may require evidence preservation, management approval, or incident escalation.
Security troubleshooting scenarios Scenario Best first thinking User reports suspicious email Do not click links; report/quarantine according to policy Workstation shows ransomware note Isolate immediately; escalate; preserve evidence; follow incident plan User cannot access encrypted drive Recovery key, TPM/firmware change, account permissions Browser redirects to unknown search page Extension/adware/DNS settings; scan and reset browser settings Repeated account lockouts Mapped drives, saved credentials, mobile email, brute-force attempt Unknown admin account appears Treat as security incident; investigate and escalate Antivirus disabled Check policy, tampering, malware, service status Public Wi-Fi use VPN, firewall public profile, avoid sensitive activity without protection
Backups and recovery Backup types Type What it does Restore implication Full Copies all selected data Simplest restore, more storage/time Incremental Copies changes since last backup of any type Restore needs last full plus each incremental Differential Copies changes since last full backup Restore needs last full plus latest differential Image Captures system state/disk image Useful for bare-metal or standardized recovery File-level Captures selected files/folders Good for user data restore Cloud backup/sync Stores data off-device Sync is not always the same as versioned backup
Backup decision rules Test restores . A backup is only useful if restoration works.Keep offline or immutable copies where ransomware risk matters.Match recovery method to the problem : deleted file, corrupted profile, failed disk, or compromised system require different recovery choices.Protect backup credentials . Backup systems are high-value targets.Document retention according to organizational policy.Practice priorities before a mock exam Use original practice questions to test whether you can apply concepts under exam-style wording. Do not only memorize tables.
Topic drills to run first Drill area What to prove Windows tools Choose the correct utility for a scenario Commands Match command to symptom and interpret basic purpose Permissions Calculate effective access and identify least-privilege fix Malware response Put containment, remediation, verification, and education in order Boot troubleshooting Select Safe Mode, recovery, rollback, repair, or reset appropriately Browser/mobile issues Identify app, permission, network, certificate, or malware causes Operational procedures Apply documentation, change control, safety, and professionalism Security hardening Choose practical endpoint, account, and wireless controls
Notes and examples How to review explanations When using a question bank with detailed explanations, review every missed question this way:
Why was the correct answer best? Which clue in the scenario pointed to it? Why were the distractors tempting but wrong? Was the issue scope, sequence, tool choice, or terminology? What similar scenario could appear with a different symptom? Final rapid checklist Before your next CompTIA A+ Core 2 (220-1202) practice exam, confirm you can:
Select the correct Windows administrative tool for a troubleshooting task. Distinguish clean install, upgrade, repair, reset, image, and recovery options. Use common Windows commands for network, policy, disk, file, and system repair tasks. Recognize Linux/macOS commands and support tools at a practical level. Apply least privilege, MFA, encryption, firewall, patching, and account-hardening concepts. Troubleshoot NTFS/share permission scenarios. Identify malware types and follow a safe response sequence. Diagnose common application, browser, boot, update, and mobile OS symptoms. Choose safe backup and restore approaches. Apply change management, documentation, safety, privacy, and professional communication. Recognize scripting benefits and risks. Put the review into practice IT Mastery
Practice 220-1202 \u2014 CompTIA A+ Core 2 on Web Use the web app to preview question style, then practise the topics you need to revisit.
Original IT Mastery practice, independent of the exam provider; not official exam questions.
Open in IT Mastery Free preview
Included
before subscription
Practice bank
2,460
total questions
in the app