CompTIA A+ Core 2 (220-1202): The New Exam Is Security-Heavy — Study Accordingly

The 220-1202 replaced the 220-1102 as CompTIA's A+ Core 2 exam, and the headline change is impossible to miss: security now dominates. Roughly a third of the exam sits in the Security domain alone, and security thinking bleeds into the operating-system and troubleshooting domains too. Candidates who treat Core 2 as "the Windows exam" the way the old series sometimes felt are in for a surprise. Here is the new exam, domain by domain, and how to aim your study time.

The 220-1202 at a Glance

• Format: up to 90 questions, multiple-choice plus performance-based (PBQs)
• Length: 90 minutes
• Passing score: 700 out of 900 (higher than Core 1's 675 — CompTIA expects more from you here)
• Domains: Operating Systems (28%), Security (33%), Software Troubleshooting (24%), Operational Procedures (15%)

Note the passing score: 700. That is the same bar as many professional-level exams. Core 2 is not the "easy half" of A+.

Operating Systems (28%): Windows First, Then Everything Else

Windows: Versions, Features, and Tools

Know the current Windows landscape cold — editions (Home vs. Pro vs. Enterprise feature differences: BitLocker, Group Policy, Remote Desktop hosting, Hyper-V, domain join), upgrade paths, and the tools:

• Settings vs. Control Panel vs. MMC — the exam still tests which tool does what: Disk Management, Device Manager, Event Viewer, Task Manager/Scheduler, Group Policy Editor (gpedit), Registry Editor, Services.msc
• Command-line tools — this is high-yield: ipconfig/ping/tracert/nslookup (networking), chkdsk/diskpart/format (disks), sfc (system file checker), DISM (image servicing — know that DISM repairs the component store that SFC depends on), robocopy/xcopy, shutdown, taskkill, gpupdate, gpresult
• The SFC/DISM relationship is a classic exam trap: if SFC cannot repair files, the next step is DISM to repair the Windows image, then SFC again. Know the order.

macOS and Linux: Enough to Troubleshoot

You are not expected to be a Linux admin, but you must know:

• Linux: common distros' package managers (apt vs. yum/dnf), file permissions (chmod octal notation — 755, 644), key commands (ls, cd, pwd, cp, mv, rm, mkdir, grep, ps, top, df, du, nano/vi basics), and the filesystem layout (/etc, /var, /home, /root)
• macOS: Disk Utility, Time Machine, Keychain, Mission Control/Spotlight, system integrity concepts, and the Apple menu recovery options
• Cross-platform concepts: file systems (NTFS vs. FAT32 vs. exFAT vs. APFS vs. ext4 — know the 4GB file limit of FAT32 and where each belongs), disk partitioning (MBR vs. GPT, and why GPT for drives over 2TB)

Virtualization on the Desktop

Client-side virtualization: hypervisor requirements (CPU virtualization extensions, RAM allocation), virtual networking modes (NAT vs. bridged vs. host-only — a favorite scenario question: "the VM needs its own IP on the LAN" is bridged), and snapshots vs. backups.

Security (33%): The Domain That Decides Your Score

This is the largest domain on either A+ exam, and it is where the 1200 series shows its modernization most clearly.

Threats: Know the Taxonomy

• Malware types — virus vs. worm vs. Trojan vs. ransomware vs. spyware vs. keylogger vs. rootkit vs. RAT. The exam tests distinguishing characteristics: a worm self-propagates, a Trojan needs user execution, ransomware encrypts for payment, a rootkit hides its existence.
• Social engineering — phishing, spear phishing, whaling, vishing, smishing, pretexting, baiting, tailgating, shoulder surfing, watering-hole attacks. Scenario questions describe an attack and ask for the name — learn each as a one-sentence story.
• Other vectors — zero-day, DDoS (and the amplification variant), man-in-the-middle, evil twin (rogue AP), DNS poisoning, ARP spoofing, brute force vs. dictionary attacks, rainbow tables (and why salting defeats them).

The Incident Response Mindset

CompTIA wants a specific response order, and the exam tests it:

1. Investigate — identify symptoms, determine scope
2. Quarantine — isolate the affected system (but do NOT power it off immediately if forensic evidence matters — a beloved trap)
3. Remediate — remove the malware (safe mode, anti-malware scans, system restore considerations)
4. Recover — restore from known-good backup, verify functionality
5. Document and educate — findings, actions, and user training to prevent recurrence

The "do not immediately wipe" principle appears in multiple forms: investigation and evidence preservation come before remediation. If an answer choice jumps straight to "reformat the drive," it is almost certainly wrong.

Windows Security Features You Must Know

• Windows Defender / Microsoft Defender — real-time protection, firewall profiles (domain/private/public), and how firewall rules are ordered
• BitLocker — full-disk encryption, TPM requirements, recovery keys (and where they are stored — the exam asks what to do when a user is locked out)
• User Account Control (UAC) — privilege escalation prompts; know the secure desktop concept
• NTFS permissions vs. share permissions — the effective permission is the MOST restrictive of the two combined. This is one of the most-tested single facts on the exam.
• Authentication — MFA factors (something you know/have/are), biometrics, smart cards, and why password managers beat password reuse
• Certificates — the chain of trust concept, expired vs. revoked vs. untrusted certificates, and what each browser warning actually means

Wireless and SOHO Security

WPA2 vs. WPA3 (and why WEP/WPA are unacceptable), changing default credentials, disabling WPS, guest network isolation, firmware updates. The exam loves the "technician secured the wireless network — what did they miss?" scenario where the answer is the unchanged default router admin password.

Software Troubleshooting (24%): Methodology Under Pressure

Same six-step methodology as Core 1, applied to OS and application problems:

• Boot problems — know the Windows Recovery Environment (WinRE) tools: Startup Repair, System Restore, System Image Recovery, Command Prompt, Startup Settings (safe mode variants). If Windows will not boot: WinRE → Startup Repair → System Restore → check the disk → reinstall as last resort. The ORDER matters and the exam tests it.
• Performance issues — Task Manager for resource hogs, low disk space, failing drive symptoms (clicking sounds, SMART warnings), insufficient RAM
• Application crashes — update/reinstall the app, check compatibility mode, check logs in Event Viewer, consider corrupt user profile (a classic: "one user cannot log in but others can" points to profile corruption)
• Mobile OS issues — app crashes, battery drain, connectivity failures, and the standard mobile troubleshooting ladder: restart app → restart device → check for updates → reset settings → factory reset (last resort, with backup warning)

The "Best Next Step" Question Format

Core 2 troubleshooting questions almost always ask for the NEXT step, not the final fix. The discipline: identify → theorize → test → plan → implement → verify → document. When stuck between two plausible answers, choose the one that gathers information before acting. "Check Event Viewer for error codes" beats "reinstall Windows" every time at the investigation stage.

Operational Procedures (15%): The Professionalism Domain

The smallest domain, but nearly free points if you learn its logic:

• Safety — ESD precautions (wrist straps, mats, air filters), power safety (unplug, discharge capacitors), cable management, proper lifting, handling toner and batteries (MSDS/safety data sheets)
• Environmental controls — temperature, humidity, dust, and surge protection vs. UPS vs. power conditioning
• Documentation — incident reports, change management (purpose, scope, risk analysis, rollback plans — and the exam's emphasis that even small changes follow the process), knowledge bases, acceptable use policies
• Communication — the "soft skills" questions: use clear language, avoid jargon with non-technical users, maintain professionalism, respect privacy (do not snoop through a user's files during a repair — this appears as an ethics scenario regularly)

Change Management in Miniature

Even at the A+ level, CompTIA tests the change process: document the purpose and scope, assess risk, get approval, have a rollback plan, document the outcome. A scenario where a technician makes an undocumented change that breaks something is always answered with "followed the change management process."

PBQs: Expect Hands-On Security and OS Tasks

Typical Core 2 PBQs: configuring Windows firewall rules for a scenario, setting NTFS/share permissions to achieve a stated access outcome, matching command-line tools to tasks, ordering the malware-removal steps, or identifying the social engineering attack in a scenario set. The permissions PBQ in particular rewards practicing the "most restrictive wins" rule until it is reflex.

A Study Plan That Respects the Weighting

1. Weeks 1–2: Security. It is a third of the exam — give it a third of your time. Build a threat taxonomy deck, drill the incident response order, and practice NTFS/share permission scenarios until the "most restrictive" rule is automatic.
2. Weeks 3–4: Operating systems. Command-line tools daily (actually type them), Windows tools matched to tasks, Linux basics, file systems. Set up a dual-boot or VM and break things on purpose.
3. Week 5: Software troubleshooting + operational procedures. Timed scenario practice with the methodology; safety and documentation as straightforward memorization.
4. Week 6: Full timed exams + PBQ practice. Target 85%+ consistently. Review every wrong answer by domain — if Security is below 80%, you are not ready, because it is the biggest domain and the passing score is 700.

Core 2 rewards the candidate who thinks like a technician, not a memorizer: investigate before acting, secure by default, document everything. Drill those instincts with realistic exam-style questions — the free 220-1202 practice test at https://study4pass.com/study-material/comptia/220-1202 is a solid gauge of whether your troubleshooting methodology survives timed conditions — and the 700 you need will take care of itself. That is the pattern the Study4Pass team sees in every passing cohort: methodology first, memorization second, panic never.

Readers also found Study4Pass on: https://www.tupalo.co/sheridan-wyoming/study4pass