What does 220-1202 cover?

Core 2 (220-1202) covers four domains: Operating Systems (28%), Security (28%), Software Troubleshooting (23%), and Operational Procedures (21%). It's the software, OS, and security half of CompTIA A+.

What's the hardest Core 2 domain?

Operating Systems and Security are tied as the largest domains (28% each), and both go deep — Windows command-line and utility knowledge on one side, malware and hardening scenarios on the other. Most candidates spend the most study time here.

How long should I study for Core 2?

It depends on your background, but plan on several weeks of dedicated study covering all four domains, with extra time for ordered procedures like malware removal.

Do I need Core 1 before Core 2?

No — CompTIA doesn't require a specific order. Most people take Core 1 first since its hardware fundamentals provide useful context, but you can take either exam first as long as you eventually pass both.

CompTIA A+ Core 2 (220-1202) Study Guide

By Jonathon Eades, IT instructor · Updated October 2026

Core 2 (220-1202) is the software, OS, and security half of CompTIA A+. This guide walks all four domains in exam order, tells you what each one actually tests, and closes with a study sequence you can follow start to finish.

1.0 Operating Systems (28%)

Tied for the largest domain on Core 2. It covers Windows editions and features in depth, the Windows and macOS/Linux command lines, OS installation and imaging methods, and the Microsoft-specific administrative tools you'll actually use in a support job.

Windows dominates this domain because it dominates the job — CompTIA expects you to navigate the built-in GUI tools and the command line for the same tasks, since real tickets don't tell you which one to use. Build muscle memory for both paths to the same fix (say, disabling a startup app through Task Manager vs. through msconfig) so a PBQ can't box you into an interface you haven't practiced.

Windows editions and features: Home vs. Pro vs. Enterprise, feature differences (BitLocker, Group Policy, Remote Desktop host, domain join), and the built-in utilities (Disk Management, Task Manager, Event Viewer, Services, MSConfig, Registry Editor).
Command line: know common Windows commands (ipconfig, sfc /scannow, chkdsk, diskpart, gpupdate, gpresult, robocopy, net use, ping, tracert, nslookup) and their basic switches — practice picking the right one for a symptom.
macOS and Linux basics: Finder/Terminal fundamentals, common macOS utilities (Disk Utility, Time Machine, Keychain Access), and Linux command-line basics (ls, grep, chmod, ps, sudo, apt/dnf).
OS installation types: in-place upgrade, clean install, image deployment, repair install, and choosing the right one for a given scenario — for example, an in-place upgrade preserves apps and files, a clean install doesn't.
Windows update and feature/driver management: update rings, driver rollback, and why a failed update sometimes calls for System Restore instead of a repair install.
File systems and permissions: NTFS, ReFS, FAT32, exFAT, ext4, XFS and APFS, plus NTFS vs. share permissions and inheritance — practice working out why a user can't open a folder.

2.0 Security (28%)

The other largest domain — and arguably the most consequential in real jobs. It covers malware types and removal, social engineering, physical and logical security controls, wireless and workstation hardening, and secure data destruction.

Practice Security with scenarios: read a symptom or an incident, name the attack type, then pick the mitigation. Similar-sounding terms (like a virus vs. a trojan, or phishing vs. vishing) are easy to mix up, so build a comparison table for the malware and social-engineering categories side by side and practice telling them apart under time pressure.

Malware types: trojans, rootkits, viruses, boot sector viruses, spyware, ransomware, keyloggers, cryptominers, stalkerware, fileless malware, and adware/PUPs — know the distinguishing symptoms of each, not just definitions (a cryptominer quietly burns CPU; a trojan disguises itself as legitimate software).
Social engineering: phishing, vishing, shoulder surfing, tailgating, dumpster diving, and impersonation — plus why user education, not just technology, is the actual mitigation.
Physical and logical security controls: badge readers, biometrics, access control vestibules, and the principle of least privilege applied to user accounts and permissions.
Wireless and workstation hardening: WPA2/WPA3, disabling unused ports/services, screen locks, login restrictions like failed-attempt lockout, and multifactor authentication.
Data destruction and disposal: the difference between formatting, wiping (overwrite standards), degaussing, and physical destruction (shredding, drilling) — and when each is appropriate for a given data sensitivity level.
Browser and email security: certificate warnings, invalid certificates, pop-up blockers, and recognizing a spoofed sender address before it becomes a phishing incident.

3.0 Software Troubleshooting (23%)

Troubleshooting for software instead of hardware. It covers Windows OS issues, mobile OS and app issues, mobile app security issues, and PC security symptoms.

Malware removal sits in 2.0 Security (objective 2.6) in 220-1202, but it pairs with the PC security symptoms here. It's a fixed sequence, so treat it as a memorized checklist, not a general idea.

Windows symptoms: slow performance, application crashes, blue screens (BSOD), boot failures, service failures, and update failures — mapped to likely causes and the right built-in tool to check first (Event Viewer, Task Manager, Reliability Monitor).
The malware removal procedure has ten ordered steps in 220-1202: 1) investigate and verify malware symptoms, 2) quarantine the infected system, 3) disable System Restore in Windows Home, 4) remediate the infected system, 5) update anti-malware software, 6) scan and remove (from safe mode or a preinstallation environment), 7) reimage or reinstall, 8) schedule scans and run updates, 9) enable System Restore and create a restore point in Windows Home, 10) educate the end user. Learn the order, not just the steps; the A+ cheat sheet has it on one line per step.
PC security symptoms: browser redirects, pop-ups, unwanted notifications, unauthorized certificate warnings, and a system running unusually hot or slow due to hidden processes.
Mobile OS issues: app crashes, unable to sync, unauthorized data usage or account access, and unexpected battery drain — with typical causes for each (background app refresh, malicious apps, degraded battery).
Recovery tools: know when to reach for Safe Mode, the Windows Recovery Environment, System Restore, a repair install, or a full factory reset — each undoes a different amount of damage, and picking the wrong one wastes a support ticket's worth of time.

4.0 Operational Procedures (21%)

The "soft skills and process" domain — smaller than the other three, but it's easy to skip studying. It covers documentation, change management, backups, safety, professionalism, incident response basics, elementary scripting, remote access, and AI basics.

Don't treat this as filler — it's 21% of the exam, more than a fifth, and the questions are often straightforward if you've actually read the objectives once, since the content is procedural rather than deeply technical.

Documentation and change management: knowledge base articles, incident/ticket documentation, asset management, and the standard change management steps (request, purpose, scope, risk analysis, plan, backout/rollback plan, and sign-off).
Backup strategies: full vs. incremental vs. differential, backup testing, and the 3-2-1 backup rule (3 copies, 2 different media types, 1 offsite).
Safety and environmental controls: ESD precautions (anti-static straps, mats), proper lifting technique, MSDS/SDS sheets, and disposal regulations for batteries, toner, and other e-waste.
Professionalism and communication: active listening, avoiding jargon with end users, setting and meeting realistic expectations, maintaining confidentiality, and knowing how to de-escalate a frustrated caller without dismissing the issue.
Ticket prioritization and licensing: triaging by business impact rather than by who complains loudest, plus basic software licensing concepts (perpetual, subscription, open-source, EULA/DRM restrictions).
Scripting basics: recognizing script file types (.bat, .ps1, .vbs, .sh, .js, .py), common use cases (automation, restarts, remapping drives, installs, backups, updates), and the risks, like introducing malware or changing system settings by accident.
Remote access technologies: RDP, VPN, and remote monitoring/management (RMM) tools — plus the security tradeoffs of each when supporting a user's machine from a distance.

How to study this

Start from the official objectives for 220-1202 — everything on the exam maps to one of its objectives, though CompTIA says its example lists aren't exhaustive.
Work one domain at a time, in order, and don't move on until you can explain it without notes.
Start PBQ practice early, not at the end — practice PBQs free at examwizardz.app/pbq-practice, including ordered procedures like malware removal.
Take a free practice test at examwizardz.app/practice-test/comptia-a-plus-core-2 once you've covered all four domains, then re-drill whatever it exposes. For a quick readiness check across the whole exam, the 60-question test at examwizardz.app/practice-test/comptia-a-plus covers both cores.

Core 2 passes at 700 out of 900 — a higher bar than Core 1's 675. Operating Systems (28%) and Security (28%) together make up more than half the exam.