A+ Core 2 220-1202 Study Guide

A+ Core 2 moves the support technician closer to the operating system and the user. Hardware still matters, but the question is more likely to ask why Windows will not boot, which account should receive a permission, what a suspicious browser redirect suggests, how to protect a mobile device, or what belongs in a ticket after the problem is fixed.

That makes Core 2 less about naming parts and more about using systems safely and consistently. You need enough Windows, macOS, Linux, security, troubleshooting, documentation, backup, scripting, and support-process knowledge to choose the right action in context.

Use the official CompTIA objectives as the complete checklist. This guide organizes the four Core 2 domains around the decisions an entry-level support technician is expected to make.

1. A+ Core 2 220-1202 exam snapshot

The current Core 2 exam is 220-1202, part of the A+ V15 series. CompTIA requires both Core 1 and Core 2 to earn A+.

The current objectives include Windows 10 and Windows 11 content where the objective does not name a specific Windows version. They also include Linux and macOS tools, mobile operating systems, cloud productivity tools, security controls, malware response, troubleshooting, documentation, backups, safety, scripting, remote access, and basic artificial intelligence (AI) concepts.

2. How to use this guide

For each topic, build four kinds of understanding:

1. Locate it. Know where the setting, command, file, tool, or control lives.
2. Explain it. State what it changes or protects.
3. Read the evidence. Connect symptoms, logs, alerts, output, and user reports to a likely cause.
4. Choose the next action. Prefer the narrowest safe step that fits the scenario and preserves data.

For example, knowing that ipconfig shows Windows IP configuration is useful. Core 2 understanding goes further. You should know when the problem calls for ipconfig, when nslookup is more useful, when the issue is probably not network-related at all, and why changing several settings at once makes troubleshooting harder.

The same idea applies to security. Memorizing that BitLocker encrypts a drive is the starting point. You should also know why full-volume encryption protects data at rest, why a standard user should not receive administrator rights just to run ordinary applications, and why an unexpected certificate warning deserves investigation instead of an automatic click-through.

3. The four Core 2 domains

CompTIA weights Core 2 as follows:

The first three domains overlap constantly. A system that cannot access a mapped drive may involve Windows networking, permissions, authentication, a disconnected virtual private network (VPN), or malware. Operational procedures then shape what you document, escalate, back up, or communicate.

4. Domain 1: Operating Systems

Operating Systems ties together installation, configuration, tools, command lines, application support, networking, and multiple desktop platforms. Windows receives the most attention, but the exam also expects practical familiarity with macOS and Linux.

Separate operating systems from filesystems

Windows, Linux, macOS, Chrome OS, iOS, iPadOS, and Android are operating systems. New Technology File System (NTFS), Resilient File System (ReFS), File Allocation Table 32 (FAT32), exFAT, ext4, XFS, and Apple File System (APFS) are filesystems.

That distinction matters because support questions often combine them. A removable drive may need a filesystem compatible with several systems. A Windows permission scenario may depend on NTFS. A Linux repair may involve a filesystem check. Do not treat the storage format and the operating system as the same layer.

Also watch vendor life-cycle limits. End-of-life (EOL) software may no longer receive normal support or security updates. Compatibility, update availability, and business policy can make an otherwise working system unsuitable.

Know installation and upgrade choices

Core 2 includes several deployment methods:

• Clean installation starts with a fresh operating-system installation.
• Upgrade preserves more of the existing system while moving to a newer version.
• Image deployment applies a prepared system image.
• Remote/network installation delivers the operating system across the network.
• Zero-touch deployment reduces manual technician steps.
• Recovery partition provides a local recovery path.
• Repair installation tries to restore the operating system without treating the machine like a new build.
• Multiboot keeps more than one bootable operating system available.

Before changing the operating system, think about user data, drivers, applications, hardware compatibility, product life cycle, and rollback options. An upgrade that technically starts but leaves a required application unusable is not a successful support outcome.

You should also recognize Master Boot Record (MBR) and Globally Unique Identifier Partition Table (GPT) as partitioning schemes. Modern Unified Extensible Firmware Interface (UEFI) systems commonly pair with GPT. The exam may give you a deployment or boot scenario where the firmware, partition style, and operating-system requirements have to agree.

Use Windows tools by job

Memorizing a long list of .msc filenames is less useful than grouping tools by what they reveal.

Other useful tools include Task Scheduler, Certificate Manager, Local Users and Groups, Group Policy Editor, Resource Monitor, System Configuration, Disk Cleanup, Disk Defragment, and Registry Editor.

The registry is powerful enough to create new problems quickly. If a scenario offers a safer supported setting or management tool, prefer that before editing the registry directly.

Match Windows command-line tools to evidence

A few commands deserve hands-on practice:

ipconfig
ping 192.0.2.1
nslookup example.com
tracert example.com
netstat -ano
whoami
hostname
sfc /scannow
chkdsk C:

Use them for different questions:

• ipconfig checks addressing, gateway, and DNS configuration.
• ping checks reachability using Internet Control Message Protocol (ICMP) when allowed.
• nslookup asks DNS questions.
• tracert shows the path through routed hops.
• netstat shows connections, listening ports, and related information.
• whoami confirms the current security identity.
• sfc checks protected Windows system files.
• chkdsk checks filesystem and disk-related errors.

Also know diskpart, format, robocopy, net use, net user, gpupdate, gpresult, winver, pathping, md, and rmdir by purpose.

A command is not automatically the best first step simply because it appears in the answer choices. Match the command to the evidence you need.

Know the settings that change normal support behavior

Windows support often comes down to the right control surface: networking, firewall, user accounts, applications, privacy, devices, power, update settings, sound, indexing, File Explorer, or accessibility.

Power options are especially easy to confuse. Sleep, hibernate, fast startup, USB selective suspend, and lid-close behavior affect different parts of power management. If a laptop loses a USB device only after sleep, checking USB selective suspend is more relevant than changing the desktop wallpaper or DNS server.

Windows networking scenarios can include:

• domain membership versus a workgroup
• file and printer shares
• mapped drives
• static versus dynamic addressing
• IP address, subnet mask, gateway, and DNS
• wired, wireless, cellular, and VPN connections
• proxy settings
• public versus private network profiles
• metered connections

When a user can reach the local network but not an internal file share, do not assume the public internet is the problem. When IP connectivity works but names fail, DNS deserves attention. When a remote user loses access only to corporate resources, verify the VPN before reinstalling the operating system.

Use macOS and Linux tools at support depth

For macOS, know common application file types such as .dmg, .pkg, and .app; system locations such as /Applications, /Users, /Library, and /System; and tools or features such as Finder, Keychain, Spotlight, iCloud, Time Machine, Disk Utility, FileVault, Terminal, Force Quit, Mission Control, and Continuity.

For Linux, know the purpose of common commands and files:

Know why /etc/passwd, /etc/shadow, /etc/hosts, /etc/fstab, and /etc/resolv.conf matter. Also recognize the kernel, bootloader, systemd, the root account, and the nano editor.

Install applications and cloud tools with requirements in mind

Before installing software, check architecture, memory, storage, processor, graphics, operating-system compatibility, external hardware tokens, licensing, and business impact.

A user who says "the installer runs" has not proven the application is appropriate. The right question may be whether the system meets requirements, whether the package came from a trusted source, whether the user is licensed, or whether deployment should happen through a managed image instead.

Cloud productivity tools add account and service dependencies: email, synchronized storage, collaboration apps, videoconferencing, presentation tools, word processing, instant messaging, identity synchronization, and license assignment. If the application opens but the user cannot sign in, reinstalling the client may not address the identity or licensing problem.

5. Domain 2: Security

Security ties with Operating Systems as the largest Core 2 domain. The exam expects practical endpoint and small-office security, not just vocabulary.

Connect each control to the problem it reduces

Physical controls include locks, guards, badge readers, cameras, alarms, fences, bollards, motion sensors, and access control vestibules. Logical controls include access control lists (ACLs), multifactor authentication (MFA), single sign-on (SSO), least privilege, just-in-time access, privileged access management (PAM), Mobile Device Management (MDM), Data Loss Prevention (DLP), Identity and Access Management (IAM), directory services, and the Zero Trust model.

Do not choose a control because it "sounds secure." Match it to the requirement:

• A stolen laptop risk may call for equipment locks, device encryption, and strong authentication.
• Excessive local rights call for least privilege and account-management changes.
• Repeated password prompts across approved services may point toward SSO.
• Temporary administrator access may fit just-in-time or privileged access management better than permanent membership in an administrators group.
• A personal phone accessing company data raises MDM, Bring Your Own Device (BYOD), data-separation, and policy questions.

Know basic Windows security controls

Windows support scenarios can involve Defender Antivirus, Windows Defender Firewall, account types, User Account Control (UAC), BitLocker, BitLocker To Go, Encrypting File System (EFS), NTFS permissions, share permissions, Active Directory, and Group Policy.

A few distinctions matter:

• Standard user vs. administrator: ordinary work should not require permanent administrator privileges.
• UAC: prompts before actions that need elevated rights; it does not make every process an administrator.
• BitLocker: protects a volume at rest.
• EFS: encrypts files or folders within NTFS rather than the whole volume.
• NTFS permissions vs. share permissions: both can affect access to a network share. Effective access depends on the combined path and context.
• Local account vs. Microsoft/domain identity: determines where credentials and policy are managed.

If a user cannot open one folder on a shared drive but can reach the server, examine permissions before blaming DNS or the network cable.

Compare wireless security and authentication

Core 2 includes Wi-Fi Protected Access 2 (WPA2), WPA3, Temporal Key Integrity Protocol (TKIP), Advanced Encryption Standard (AES), Remote Authentication Dial-in User Service (RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+), Kerberos, and multifactor authentication.

At A+ depth, focus on purpose and relative fit. WPA3 is newer than WPA2. AES is the stronger modern encryption choice compared with TKIP. RADIUS commonly supports centralized network authentication. Kerberos is associated with ticket-based authentication in domain environments. TACACS+ is commonly associated with centralized administrative access to network devices.

For a small office/home office (SOHO) network, also think about changing default router credentials, updating firmware, configuring secure management, using appropriate wireless encryption, separating guest access, disabling unnecessary services, and understanding what port forwarding exposes.

Recognize malware by behavior and response

Core 2 names malware such as Trojans, rootkits, viruses, spyware, ransomware, keyloggers, boot-sector viruses, cryptominers, stalkerware, fileless malware, adware, and potentially unwanted programs (PUPs).

Symptoms matter more than labels. Unexpected encryption and ransom demands point one direction. Sustained CPU use without a legitimate workload could fit cryptomining. A browser filled with pop-ups may involve adware or a malicious extension. A hidden persistence mechanism may suggest a rootkit.

The current objectives also provide a basic SOHO malware-removal sequence:

1. Investigate and verify malware symptoms.
2. Quarantine the infected system.
3. Disable System Restore in Windows Home.
4. Remediate the infected system.
5. Update anti-malware software.
6. Use scan and removal techniques.
7. Reimage or reinstall when necessary.
8. Schedule scans and run updates.
9. Re-enable System Restore and create a restore point in Windows Home.
10. Educate the user.

Treat the sequence as a workflow, not a collection of interchangeable steps. Quarantine comes early because continued network access can spread damage or leak data. User education comes after the immediate problem is handled because prevention matters too.

Separate social engineering, threats, and vulnerabilities

Phishing, vishing, smishing, QR-code phishing, spear phishing, whaling, shoulder surfing, tailgating, impersonation, and dumpster diving all involve manipulating people or weak processes.

Other threats include denial of service, distributed denial of service, evil twins, zero-day attacks, spoofing, on-path attacks, brute force, dictionary attacks, insider threats, Structured Query Language (SQL) injection, Cross-site Scripting (XSS), Business Email Compromise (BEC), and supply-chain attacks.

Vulnerabilities include systems that are unpatched, unsupported, misconfigured, non-compliant, or missing basic protections.

A useful reasoning chain is:

weakness or exposure → threat uses it → observable symptom or impact → control reduces the risk

That is more useful than memorizing every term in isolation.

Harden workstations, mobile devices, browsers, and SOHO networks

Hardening removes unnecessary exposure and strengthens the controls you actually use. Common actions include:

• encrypt data at rest
• use unique passwords and password managers
• restrict user permissions
• lock screens and systems after inactivity
• disable guest accounts when not needed
• apply failed-login restrictions
• disable AutoRun and unnecessary services
• update operating systems and applications
• enable endpoint protection
• use secure mobile configuration profiles
• enable remote wipe and backup where policy allows
• change default router credentials
• update router firmware
• configure guest wireless access
• use secure browser connections and valid certificates
• keep browsers and extensions patched
• remove untrusted extensions or plug-ins

A hidden service set identifier (SSID) does not replace encryption. A password manager does not replace MFA. A firewall does not make unpatched software safe. Layer controls according to the risk.

Know data destruction by outcome

Deleting a file is not the same as securely destroying the underlying data. Core 2 includes erasing/wiping, low-level formatting, standard formatting, drilling, shredding, degaussing, incineration, third-party destruction, and certificates of destruction or recycling.

Choose the method based on the media, sensitivity, reuse plan, regulatory requirements, and environmental policy. A drive being repurposed has a different goal from a drive containing sensitive data that must never be reused.

6. Domain 3: Software Troubleshooting

This domain asks you to read symptoms without jumping to the most dramatic explanation. The same symptom can have several causes, so gather evidence before changing the system.

Troubleshoot Windows by scope and timing

Common Windows symptoms include blue screens, slow performance, boot failures, shutdowns, services that will not start, application crashes, low-memory warnings, system instability, "no OS found," slow profile loading, and time drift.

Start by asking:

• Did the problem begin after a change?
• Does it affect one application, one user, or the whole system?
• Does the system boot?
• Are there useful Event Viewer entries?
• Is the device low on memory or storage?
• Are drivers, updates, or services involved?
• Does the same problem occur in safe mode or under another user profile?

For example, one application crashing does not prove Windows is corrupt. If every application fails after a recent driver change, the scope is different. A "no OS found" message points toward boot configuration, storage, or firmware before it points toward a browser extension.

Use mobile symptoms to choose the layer

Mobile problems include apps that fail to install, launch, close, or update; slow response; operating-system update failures; battery issues; random reboots; Bluetooth, Wi-Fi, or NFC connectivity problems; and screen-rotation problems.

Again, match the symptom to the subsystem:

• One app fails while others work: inspect that app, its permissions, storage, compatibility, or update state.
• Every networked app fails: check connectivity before reinstalling each app.
• Battery life suddenly drops: check workload, radios, app behavior, updates, and battery health.
• Screen rotation fails: check orientation lock and sensors before resetting the whole device.

Recognize security symptoms without assuming every oddity is malware

Mobile security warning signs can include unofficial application sources, developer mode, rooting/jailbreaking, suspicious apps, high network use, fake security warnings, unexpected ads, leaked data, or strange application behavior.

PC security symptoms can include browser redirection, certificate warnings, pop-ups, degraded browser performance, missing or renamed files, false antivirus warnings, update failures, or loss of network access.

Some of those can have benign causes. A certificate warning can come from a wrong system clock, an intercepted connection, a misconfigured site, or a genuinely invalid certificate. The right support response is to investigate the evidence, not automatically click through and not automatically reimage the machine.

Preserve data before destructive troubleshooting

When troubleshooting crosses into reset, reimage, reinstall, or drive-repair territory, stop and ask what user data must be protected first.

A technically successful repair that destroys irreplaceable local data is a poor support outcome. Core 2 connects troubleshooting with backup, documentation, policy, and escalation for this reason.

7. Domain 4: Operational Procedures

Operational Procedures is where Core 2 turns technical skill into dependable support work. A technician has to leave the environment safer, documented, and understandable after the technical fix.

Write tickets another technician can use

A useful ticket records:

• user and device information
• a clear description of the issue
• category and severity
• troubleshooting steps and evidence
• escalation when needed
• progress notes
• final resolution
• any follow-up or user communication

"Fixed computer" is not a useful resolution note. "Replaced failed SSD, restored user profile from backup, confirmed Windows boots and mapped drive reconnects" is much more useful.

Asset management connects the device to inventory, configuration records, warranty, licensing, procurement, and assigned users. Standard operating procedures (SOPs), onboarding/offboarding checklists, service-level agreements (SLAs), and knowledge-base articles help make repeated work consistent.

Use change management before making the problem larger

Change management asks what will change, why, who approves it, when it happens, what systems are affected, how much risk it creates, how it will be tested, and how to roll back if it fails.

Common elements include:

• request and purpose
• scope and affected systems
• standard, normal, or emergency change
• maintenance windows and change freezes
• risk analysis
• approvals
• backup and rollback plans
• sandbox testing
• implementation responsibility
• peer review
• end-user acceptance

A small desktop change may use a lightweight process. A change to hundreds of systems deserves more structure. The principle is the same: know what you are changing and how to recover.

Know backup types and recovery choices

Core 2 includes full, incremental, differential, and synthetic full backups, plus onsite/offsite storage, Grandfather-Father-Son (GFS), and the 3-2-1 rule.

Backups are useful only if they can be restored. Test them. Know whether recovery overwrites the original location or restores to an alternate location. Keep at least one copy isolated enough that one failure does not destroy every copy.

Work safely around hardware and the environment

Core 2 still expects practical safety: electrostatic discharge (ESD) straps and mats, grounding, antistatic bags, disconnecting power, proper lifting, fire safety, eye protection, airflow, temperature, humidity, dust, battery disposal, toner disposal, surge protection, and uninterruptible power supplies (UPSs).

The exam may make safety the deciding factor. A technically possible action can still be wrong if it risks injury, damages equipment, or violates disposal rules.

Protect privacy, evidence, licenses, and policy

Support technicians often see data the user did not intend to share. Treat it as private. Follow acceptable use, data retention, licensing, regulatory, and confidentiality requirements.

If the situation may involve an incident or investigation, preserve evidence instead of casually modifying it. Core 2 includes chain of custody, order of volatility, drive copies for preservation, incident documentation, and notifying management or law enforcement when policy requires it.

Licensing matters too. Know the difference between valid and invalid use, personal versus corporate use, perpetual licensing, open-source licensing, Digital Rights Management (DRM), and End-user License Agreements (EULAs). "The software runs" does not mean the organization is licensed to use it.

Communicate like support work is part of the technical job

Professional support includes active listening, plain language, realistic timelines, status updates, privacy, and clear documentation.

Avoid flooding a nontechnical user with acronyms. Ask open-ended questions when the problem is unclear, then restate the issue to confirm understanding. Do not argue with the user about what they experienced. The user may describe the symptom imprecisely, but the symptom is still useful evidence.

Understand basic scripting without pretending every technician is a developer

Core 2 includes .bat, .ps1, .vbs, .sh, .js, and .py script files. Typical uses include restarting machines, remapping drives, installing software, running backups, gathering information, and initiating updates.

The important support lesson is automation multiplies both good and bad actions. Test scripts, understand their permissions, and avoid running code from untrusted sources. A script that changes one wrong setting on one machine is inconvenient. The same mistake pushed to hundreds of endpoints is an incident.

Use remote access with security in mind

Remote access technologies include Remote Desktop Protocol (RDP), VPN, Virtual Network Computing (VNC), Secure Shell (SSH), Remote Monitoring and Management (RMM), Simple Protocol for Independent Computing Environments (SPICE), Windows Remote Management (WinRM), and third-party screen-sharing or desktop-management tools.

Choose the tool based on what the technician needs to do and what the organization allows. A remote shell, a full graphical session, a monitoring platform, and a video call solve different problems.

Remote support also raises identity, authorization, encryption, logging, and privacy questions. Do not leave remote access enabled simply because it made one ticket easier.

Treat AI output as assistance, not authority

The current Core 2 objectives include basic AI concepts: application integration, appropriate-use policy, plagiarism, bias, hallucinations, accuracy, and differences between public and private services related to data security and privacy.

For support work, the practical rule is simple: verify technical output before acting on it and do not paste sensitive user or company information into a public AI service unless policy explicitly allows it.

An AI-generated command can still delete the wrong file. An AI-generated explanation can still invent a setting that does not exist. The technician remains responsible for the action.

8. Hands-on study plan

Core 2 rewards practice because so many objectives begin with "Given a scenario." A small lab can cover a large part of the exam.

Try this sequence:

1. Build a Windows practice machine. Use a spare system or virtual machine. Create standard and administrator accounts, inspect Task Manager, Device Manager, Event Viewer, Disk Management, Windows Firewall, power settings, and network configuration.
2. Practice command-line evidence. Run ipconfig, ping, nslookup, tracert, netstat, whoami, hostname, sfc, and chkdsk. Write down what question each command answers.
3. Create a Linux virtual machine. Practice file operations, permissions, package management, sudo, network commands, process tools, and the common /etc files named in the objectives.
4. Inspect macOS if you have access. Learn Finder, System Settings, FileVault, Time Machine, Disk Utility, Keychain, and application installation concepts.
5. Practice account and file security. Compare standard and administrator rights. Work with NTFS permissions, folder sharing, screen locks, and encryption options in a safe lab.
6. Create failure scenarios. Break DNS, disable a service, fill a test volume, install a harmless misbehaving application, or remove a mapped drive. Diagnose from evidence.
7. Build a backup and restore routine. Create a backup, restore one file, then document what would happen if the original system were unavailable.
8. Write tickets for your own lab problems. Record symptom, scope, evidence, action, result, and follow-up.
9. Automate one safe task. Write a short PowerShell, shell, or Python script that gathers system information. Read every line before running it.
10. Review security choices. For each lab change, ask whether you increased privileges, exposed a service, weakened encryption, or handled data in a way that would violate normal policy.

The goal is not to turn your home lab into an enterprise environment. It is to make the exam vocabulary attach to actions you have actually performed.

9. Preparing for performance-based questions

Performance-based questions can turn several objectives into one task. You may need to configure a setting, choose a sequence, interpret output, identify a suspicious symptom, or select the right tool for a support problem.

A useful approach:

1. Read the requested outcome.
2. Identify the platform and scope.
3. Separate what is already known from what still needs evidence.
4. Choose the narrowest safe action.
5. Recheck security, data preservation, and user impact.
6. Verify the result.

For a Windows connectivity problem, you might inspect IP configuration, test the gateway, test an IP address, then test name resolution. For a suspicious endpoint, you may need to isolate the system before you perform cleanup. For a permissions problem, the answer may depend on whether the user is local, domain-based, standard, administrator, or accessing a share.

Do not solve a problem the scenario did not give you. If a user cannot open one application, rebuilding the machine is usually too broad until the evidence points there.

10. Core 2 readiness checklist

Before you move from study into final review, make sure you can do these without leaning on a definition list:

• Explain the purpose of the major Windows tools and choose among them from a symptom.
• Use the common Windows command-line tools for networking, disks, files, identity, and system repair.
• Distinguish clean installs, upgrades, images, remote installs, and recovery options.
• Recognize common Windows, Linux, macOS, mobile, and filesystem concepts.
• Configure basic Windows networking, accounts, permissions, firewall, and encryption choices.
• Compare common physical and logical security controls by purpose.
• Recognize common malware, social engineering techniques, attacks, and endpoint vulnerabilities.
• Recall the basic SOHO malware-removal sequence in the correct order.
• Apply workstation, mobile, browser, wireless, and router hardening.
• Choose an appropriate data-destruction method for reuse versus disposal.
• Troubleshoot Windows, mobile, browser, application, and security symptoms from evidence.
• Write a useful ticket and explain why change management, backups, and rollback plans matter.
• Compare full, incremental, differential, and synthetic full backups.
• Apply basic ESD, electrical, environmental, and personal safety rules.
• Explain why chain of custody, privacy, licensing, and regulated data affect support work.
• Match scripting and remote-access tools to safe support use cases.
• Explain basic AI limitations such as hallucinations, bias, accuracy, privacy, and policy concerns.

If several items still feel like vocabulary rather than working knowledge, return to those sections and create one practical example for each.

11. Official references

Use the official CompTIA A+ certification page to confirm current exam details, policies, and version information before scheduling or buying exam-specific material.

Cert Happens is an independent study resource and is not affiliated with or endorsed by CompTIA.