What does 220-1202 cover?

Core 2 (220-1202) covers four domains: Operating Systems (28%), Security (28%), Software Troubleshooting (23%), and Operational Procedures (21%). It's the software, OS, and security half of CompTIA A+.

What's the hardest Core 2 domain?

Operating Systems and Security are tied as the largest domains (28% each), and both go deep — Windows command-line and utility knowledge on one side, malware and hardening scenarios on the other. Most candidates spend the most study time here.

How long should I study for Core 2?

It depends on your background, but plan on several weeks of dedicated study covering all four domains, with extra time for the ordered-procedure PBQs (like malware removal) that Core 2 favors.

Do I need Core 1 before Core 2?

No — CompTIA doesn't require a specific order. Most people take Core 1 first since its hardware fundamentals provide useful context, but you can take either exam first as long as you eventually pass both.

CompTIA A+ Core 2 (220-1202) Study Guide

Updated August 2026

Core 2 (220-1202) is the software, OS, and security half of CompTIA A+. This guide walks all four domains in exam order, tells you what each one actually tests, and closes with a study sequence you can follow start to finish.

1.0 Operating Systems (28%)

Tied for the largest domain on Core 2. It covers Windows editions and features in depth, the Windows and macOS/Linux command lines, OS installation and imaging methods, and the Microsoft-specific administrative tools you'll actually use in a support job.

Windows dominates this domain because it dominates the job — CompTIA expects you to navigate the built-in GUI tools and the command line for the same tasks, since real tickets don't tell you which one to use. Build muscle memory for both paths to the same fix (say, disabling a startup app through Task Manager vs. through msconfig) so a PBQ can't box you into an interface you haven't practiced.

Windows editions and features: Home vs. Pro vs. Enterprise, feature differences (BitLocker, Group Policy, Remote Desktop host, domain join), and the built-in utilities (Disk Management, Task Manager, Event Viewer, Services, MSConfig, Registry Editor).
Command line: know common Windows commands (ipconfig, sfc /scannow, chkdsk, diskpart, gpupdate, bootrec /fixmbr and /fixboot, robocopy, net use) and their basic switches — this is directly PBQ-tested, often as "which command fixes this symptom."
macOS and Linux basics: Finder/Terminal fundamentals, common macOS utilities (Disk Utility, Time Machine, Keychain Access), and Linux command-line basics (ls, grep, chmod, ps, sudo, apt/yum).
OS installation types: in-place upgrade, clean install, image deployment, repair install, and choosing the right one for a given scenario — for example, an in-place upgrade preserves apps and files, a clean install doesn't.
Windows update and feature/driver management: update rings, driver rollback, and why a failed update sometimes calls for System Restore instead of a repair install.
File systems and permissions: NTFS vs. exFAT vs. APFS vs. ext4, and NTFS permission inheritance vs. explicit deny — a recurring source of "why can't this user access this folder" scenarios.

2.0 Security (28%)

The other largest domain — and arguably the most consequential in real jobs. It covers malware types and removal, social engineering, physical and logical security controls, wireless and workstation hardening, and secure data destruction.

Security questions on Core 2 are heavily scenario-based: you're given a symptom or an incident and asked to identify the attack type first, then the correct mitigation. Confusing similar-sounding terms (like a worm vs. a trojan, or phishing vs. vishing) is the single most common way people lose points here. Build a comparison table for the malware and social-engineering categories side by side — the exam is really testing whether you can tell them apart under time pressure, not whether you can define one in isolation.

Malware types: ransomware, trojans, worms, spyware, rootkits, and keyloggers — know the distinguishing symptoms of each, not just definitions (a worm self-replicates across a network; a trojan disguises itself as legitimate software).
Social engineering: phishing, vishing, shoulder surfing, tailgating, dumpster diving, and impersonation — plus why user education, not just technology, is the actual mitigation.
Physical and logical security controls: badge readers, biometrics, mantraps, and the principle of least privilege applied to user accounts and permissions.
Wireless and workstation hardening: WPA2/WPA3, disabling unused ports/services, screen locks, login restrictions like failed-attempt lockout, and multifactor authentication.
Data destruction and disposal: the difference between formatting, wiping (overwrite standards), degaussing, and physical destruction (shredding, drilling) — and when each is appropriate for a given data sensitivity level.
Browser and email security: certificate warnings, invalid certificates, pop-up blockers, and recognizing a spoofed sender address before it becomes a phishing incident.

3.0 Software Troubleshooting (23%)

Applies CompTIA's troubleshooting methodology to software instead of hardware. It covers Windows-specific symptoms, the malware removal procedure, PC security symptoms, and mobile OS issues.

Like Core 1's troubleshooting domain, order is everything here — the malware removal procedure in particular is one of the most frequently tested ordered sequences on the whole exam, so treat it as a memorized checklist, not a general idea.

Windows symptoms: slow performance, application crashes, blue screens (BSOD), boot failures, service failures, and update failures — mapped to likely causes and the right built-in tool to check first (Event Viewer, Task Manager, Reliability Monitor).
The malware removal procedure is an ordered 7-step sequence: 1) investigate and verify malware symptoms, 2) quarantine infected systems, 3) disable System Restore, 4) remediate — update anti-malware software and scan/remove, 5) schedule scans and run updates, 6) enable System Restore and create a restore point, 7) educate the end user. PBQs love testing this exact order, so memorize it as seven discrete steps, not a general idea.
PC security symptoms: browser redirects, pop-ups, unwanted notifications, unauthorized certificate warnings, and a system running unusually hot or slow due to hidden processes.
Mobile OS issues: app crashes, unable to sync, unauthorized data usage or account access, and unexpected battery drain — with typical causes for each (background app refresh, malicious apps, degraded battery).
Recovery tools: know when to reach for Safe Mode, System Restore, a repair install, or a full factory reset — each undoes a different amount of damage, and picking the wrong one wastes a support ticket's worth of time.

4.0 Operational Procedures (21%)

The "soft skills and process" domain — smaller than the other three, but it's tested precisely because it's easy to skip studying. It covers documentation, change management, backups, safety, professionalism, incident response basics, and elementary scripting.

Don't treat this as filler — it's 21% of the exam, more than a fifth, and the questions are often straightforward if you've actually read the objectives once, since the content is procedural rather than deeply technical.

Documentation and change management: knowledge base articles, incident/ticket documentation, asset management, and the standard change management steps (request, purpose, scope, risk analysis, plan, backout/rollback plan, and sign-off).
Backup strategies: full vs. incremental vs. differential, backup testing, and the 3-2-1 backup rule (3 copies, 2 different media types, 1 offsite).
Safety and environmental controls: ESD precautions (anti-static straps, mats), proper lifting technique, MSDS/SDS sheets, and disposal regulations for batteries, toner, and other e-waste.
Professionalism and communication: active listening, avoiding jargon with end users, setting and meeting realistic expectations, maintaining confidentiality, and knowing how to de-escalate a frustrated caller without dismissing the issue.
Ticket prioritization and licensing: triaging by business impact rather than by who complains loudest, plus basic software licensing concepts (perpetual, subscription, open-source, EULA/DRM restrictions).
Scripting basics: recognizing common script file types (.bat, .ps1, .py, .sh, .js) and basic constructs (variables, loops, environment variables) — you're tested on reading intent, not writing full scripts.
Remote access technologies: RDP, VPN, and remote monitoring/management (RMM) tools — plus the security tradeoffs of each when supporting a user's machine from a distance.

How to study this

Start from the official objectives for 220-1202 — everything on the exam maps to a line item there.
Work one domain at a time, in order, and don't move on until you can explain it without notes.
Start PBQ practice early, not at the end — practice PBQs free at examwizardz.app/pbq-practice, since ordered-procedure questions like malware removal are a recurring PBQ format on this exam.
Take a free practice test at examwizardz.app/practice-test/comptia-a-plus-core-2 once you've covered all four domains, then re-drill whatever it exposes.

Core 2 passes at 700 out of 900 — a higher bar than Core 1's 675. Operating Systems (28%) and Security (28%) together make up more than half the exam.