CompTIA A+ / Network+ / Security+ CompTIA A+ Core 2: Operating Systems, Security & Operational Procedures (220-1102) Syllabus

What is the difference between a Standard user account and an Administrator account in Windows?

A Standard account can use software and change settings that don't affect other users or system security. An Administrator account can install software, change all settings, and manage other accounts.

In the Control Panel, what does the Indexing Options applet control?

It defines which locations Windows Search indexes to speed up file and content searches, and lets you rebuild the search index.

Which Control Panel applet controls power plans, and what do Sleep, Hibernate, and Shut Down each do?

Power Options. Sleep saves state to RAM (low power, fast resume). Hibernate saves state to disk (hiberfil.sys) and powers off. Shut Down closes everything and fully powers down.

What file system should be used for a Windows OS installation drive, and why not FAT32 or exFAT?

NTFS — it supports file/folder permissions, encryption (EFS), compression, journaling, and large volumes/files. FAT32 lacks security and has a 4 GB file-size limit; exFAT lacks NTFS security and journaling features.

What is the difference between MBR and GPT partitioning schemes?

MBR supports up to 2 TB disks and 4 primary partitions, used with BIOS. GPT supports disks larger than 2 TB and up to 128 partitions, requires UEFI, and stores redundant partition tables.

List common Windows installation/boot methods a technician might use.

USB/optical media (local), network/PXE boot, internet-based recovery, image deployment, recovery partition, and external/hot-swappable drive installation.

What is the difference between a repair installation and a recovery (reset) of Windows?

A repair install reinstalls Windows while keeping files, apps, and settings to fix corruption. A recovery/reset reinstalls Windows and can keep or remove personal files but removes installed apps and settings.

In macOS, what is Time Machine, Disk Utility, and Mission Control used for?

Time Machine is the built-in backup tool. Disk Utility manages/formats/repairs disks. Mission Control shows all open windows, desktops (Spaces), and full-screen apps.

What is the difference between APT, YUM/DNF, and the use of sudo in Linux?

APT (Debian/Ubuntu) and YUM/DNF (Red Hat/Fedora) are package managers for installing/updating software. sudo runs a single command with elevated (superuser) privileges.

What is the principle of least privilege, and why is it a core security measure?

Users and processes should be granted only the minimum access needed to perform their tasks. It limits the damage from compromised accounts, malware, and mistakes.

Compare a mantrap (access control vestibule), bollard, and badge reader as physical security controls.

An access control vestibule (mantrap) uses two interlocking doors to prevent tailgating. Bollards are sturdy posts that block vehicle access. A badge reader authenticates entry via a smart card or RFID badge.

What is multifactor authentication, and what are the standard authentication factor categories?

MFA requires two or more factors from different categories: something you know (password/PIN), something you have (token/smart card), something you are (biometrics), somewhere you are (location), and something you do (behavior).

What is the difference between authentication, authorization, and accounting (AAA)?

Authentication verifies identity. Authorization determines what the authenticated entity is permitted to do. Accounting logs and tracks actions for auditing.

Compare WEP, WPA, WPA2, and WPA3 wireless security protocols.

WEP is obsolete and insecure (RC4). WPA added TKIP. WPA2 uses AES-CCMP and is the long-standing standard. WPA3 adds SAE (Simultaneous Authentication of Equals) for stronger key exchange and forward secrecy.

What is the difference between WPA2-Personal (PSK) and WPA2-Enterprise?

Personal uses a shared pre-shared key (passphrase). Enterprise uses 802.1X with a RADIUS authentication server so each user authenticates with unique credentials.

What does a firewall do, and what is the difference between a host-based and a network firewall?

A firewall filters traffic based on rules. A host-based firewall (e.g., Windows Defender Firewall) protects a single device. A network firewall protects an entire network segment at the perimeter.

What is port forwarding versus a DMZ on a SOHO router?

Port forwarding maps a specific external port to an internal host/port for a service. A DMZ exposes one internal host to all inbound traffic, placing it outside the protected LAN — riskier and broader.

What are the standard steps of the CompTIA malware removal best-practice procedure?

1) Investigate and verify malware symptoms; 2) Quarantine infected systems; 3) Disable System Restore (in Windows); 4) Remediate (update anti-malware, scan and remove); 5) Schedule scans and run updates; 6) Enable System Restore and create a restore point; 7) Educate the end user.

Why must System Restore be disabled during malware remediation and re-enabled afterward?

Malware can hide in restore points; disabling System Restore clears infected snapshots so the malware can't return. It is re-enabled afterward and a clean restore point is created.

Compare a virus, a worm, and a Trojan.

A virus attaches to a file and needs the host to be executed to spread. A worm self-replicates and spreads across networks without user action. A Trojan disguises itself as legitimate software to trick the user into running it.

What is ransomware and what is the recommended primary defense against it?

Ransomware encrypts a victim's data and demands payment for the decryption key. The best defense is maintaining tested, offline/off-site backups so data can be restored without paying.

Define rootkit and keylogger.

A rootkit hides deep in the OS (often kernel level) to maintain privileged, stealthy access and evade detection. A keylogger records keystrokes to capture passwords and sensitive input.

Compare phishing, spear phishing, and whaling.

Phishing is a broad fraudulent message to many recipients. Spear phishing targets a specific individual or group with tailored content. Whaling targets high-value executives (the 'big fish').

What is the difference between tailgating and shoulder surfing?

Tailgating is following an authorized person through a secure door without credentials. Shoulder surfing is observing someone's screen or keypad to steal information such as passwords or PINs.

Define impersonation, dumpster diving, and evil twin attacks.

Impersonation is pretending to be someone with authority to gain access. Dumpster diving is retrieving discarded documents/media for useful information. An evil twin is a rogue Wi-Fi access point mimicking a legitimate SSID to intercept traffic.

What is the difference between a DoS and a DDoS attack?

A DoS (Denial of Service) floods a target from a single source to exhaust resources. A DDoS (Distributed DoS) uses many compromised hosts (a botnet) simultaneously, making it harder to block.

What is the difference between an on-path (man-in-the-middle) attack and a zero-day attack?

An on-path attack intercepts/alters traffic between two parties without their knowledge. A zero-day exploits a vulnerability unknown to the vendor with no available patch.

List recommended best practices for securing a Windows workstation account/password policy.

Enforce strong/complex passwords, require periodic expiration, restrict reused passwords, set account lockout thresholds, disable the Guest account, rename/secure the default admin account, and remove unused accounts.

What are key methods for securing mobile devices in an enterprise?

Screen locks (PIN, pattern, biometric), full-device encryption, remote wipe/lock, MDM enrollment, OS/app updates, app source restrictions, and remote backup.

What is the difference between a screen lock failure lockout and remote wipe on a mobile device?

After too many failed unlock attempts, a device can lock out (delay) or auto-wipe locally. Remote wipe is an administrator/owner action initiated from the cloud/MDM to erase a lost or stolen device.

Compare standard formatting, drive wiping/zero-fill, and physical destruction for data disposal.

Standard format only removes file pointers (recoverable). Drive wiping/zero-fill overwrites all sectors making recovery impractical. Physical destruction (shredding, drilling, degaussing, incineration) renders media permanently unusable.

What is degaussing, and which storage media does it work on?

Degaussing uses a strong magnetic field to scramble data on magnetic media (HDDs, tapes). It does NOT work on SSDs or flash media because they store data electronically, not magnetically.

What is the difference between a certificate of destruction and outsourcing to a third-party shredding service?

A certificate of destruction is documented proof that media was destroyed per policy. A third-party service performs the physical destruction (on-site or off-site) and typically issues that certificate for compliance/audit.

In Windows, what is the BSOD typically caused by, and what is a first troubleshooting step?

A Blue Screen of Death (stop error) is usually caused by faulty drivers, hardware failures, or corrupt system files. First steps: note the stop code, boot into Safe Mode, roll back recent drivers/updates, and run memory/disk diagnostics.

What Windows boot option loads a minimal set of drivers for troubleshooting, and how is it reached?

Safe Mode loads only essential drivers and services. It is reached through the Windows Recovery Environment (WinRE) > Troubleshoot > Advanced options > Startup Settings, or by interrupting boot to trigger Automatic Repair.

What causes 'slow performance' and 'limited connectivity' as common Windows symptoms, and a remediation each?

Slow performance: too many startup apps, low RAM/disk, or malware — remediate by disabling startup items, adding resources, and scanning. Limited connectivity: bad IP/DHCP — remediate with ipconfig /release and /renew or checking the adapter.

What are typical symptoms that indicate a malware infection on a workstation?

Browser redirection, unexpected pop-ups, certificate/security alerts, renamed or missing files, altered system files, OS/application slowdown, random restarts, and unwanted services or processes.

What does it mean when a Windows system shows 'rogue antivirus' or fake security alerts, and how is it handled?

It is scareware/rogue antivirus — malware posing as a legitimate scanner to trick users into paying or installing more malware. Handle it by following the malware-removal steps: quarantine, scan with legitimate anti-malware, and remove.

List common troubleshooting symptoms of mobile OS/application issues.

Apps fail to launch or crash, app fails to update, slow performance, frozen system, device won't turn on, no sound, dim/no display, overheating, fast battery drain, and inability to decrypt email.

What are first-line fixes when a mobile app crashes or won't launch?

Force-stop the app, clear its cache/data, update the app and OS, restart the device, check storage/permissions, and uninstall/reinstall the app if needed.

What are common indicators of a security/privacy problem on a mobile device?

High/unexpected data usage, fast battery drain, slow response, unintended Wi-Fi/Bluetooth connections, unauthorized account access, location tracking, camera/microphone activation, and unexpected app activity.

What is a leaked personal file/data indicator on mobile, and a typical cause?

Signs include unauthorized account access, unintended camera/mic activation, and high resource use. A common cause is a malicious or over-permissioned app exfiltrating data — review and revoke app permissions and uninstall the offender.

What is the difference between root access (Android) and jailbreaking (iOS), and why are they security risks?

Both remove built-in OS restrictions to gain full privileged control. This bypasses sandboxing and the official app store, allowing unsigned apps and increasing exposure to malware and data leaks.

What is a bootleg/sideloaded app, and why is it a mobile security concern?

It is an app installed from outside the official store (APK sideloading). It bypasses store vetting, may contain malware, and can request excessive permissions to steal data.

Why is reviewing app permissions important on mobile devices?

Excessive or unnecessary permissions (e.g., a flashlight app requesting contacts/location) can indicate data harvesting or malware; restricting permissions limits exposure of personal data.

What is a knowledge base/articles document, and how does it support IT operations?

A knowledge base is a searchable repository of articles, how-tos, and known-issue solutions. It speeds troubleshooting, standardizes fixes, and enables self-service and consistent support.

What is asset management, and what are key fields tracked in an asset database?

Asset management tracks an organization's hardware/software inventory throughout its lifecycle. Key fields include asset tags/IDs, barcodes, procurement/warranty dates, assigned user, location, license entitlements, and end-of-life status.

What is the difference between an Acceptable Use Policy (AUP) and a network topology diagram?

An AUP defines acceptable behavior and rules for using company systems and data. A network topology diagram visually maps devices, connections, and layout of the network for design and troubleshooting.

What is a Standard Operating Procedure (SOP), and why document new-user setup checklists?

An SOP is a documented step-by-step process ensuring tasks are done consistently. New-user setup checklists guarantee every account, access right, and device is provisioned uniformly and nothing is missed.

What is the purpose of a formal change-management process?

To control modifications to systems so changes are documented, risk-assessed, approved, tested, and reversible — minimizing disruption and unauthorized changes.

What is a change request (RFC) and what core elements should it contain?

A Request for Change documents a proposed change. Core elements: purpose/scope, risk analysis, risk level, plan for change, rollback (backout) plan, end-user acceptance, and approvals by the change board (CAB).

What is a rollback (backout) plan in change management?

A predefined procedure to revert a system to its previous working state if a change fails or causes problems, minimizing downtime and impact.

What is the role of the Change Advisory Board (CAB)?

The CAB reviews, assesses risk, and approves or rejects proposed changes, ensuring changes align with business needs and have adequate planning and rollback provisions.

Compare full, incremental, and differential backups.

A full backup copies all selected data. An incremental backup copies only data changed since the last backup (any type) — fast backup, slower restore (needs the chain). A differential backup copies all data changed since the last FULL backup — larger each time, faster restore (full + one differential).

What is the 3-2-1 backup rule?

Keep 3 copies of your data, on 2 different media types, with 1 copy stored off-site.

Why must backups be tested, and what is the difference between on-site and off-site backup storage?

Backups must be periodically test-restored to verify integrity and recoverability. On-site backups allow fast recovery but are vulnerable to local disasters; off-site backups protect against site-wide events like fire or theft.

What is the difference between RPO and RTO in backup/recovery planning?

RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how often you must back up). RTO (Recovery Time Objective) is the maximum acceptable time to restore service after an outage.

What is an ESD strap, and what does a proper anti-static workstation include?

An ESD (electrostatic discharge) wrist strap grounds a technician to prevent static damage to components. A proper anti-static setup includes the wrist strap, an anti-static mat, anti-static bags for parts, and a grounded work area.

What is an MSDS/SDS, and when must one be consulted?

A (Material) Safety Data Sheet describes a product's hazards, handling, storage, disposal, and first-aid/spill procedures. Consult it before handling, storing, or disposing of chemicals, batteries, toner, and other hazardous materials.

How should lithium-ion batteries, toner cartridges, and CRT monitors be disposed of?

They are hazardous and must not go in regular trash — recycle batteries and toner through approved programs/manufacturers, and dispose of CRTs (which contain lead) via certified e-waste/hazmat recyclers per local regulations and the SDS.

What environmental controls protect IT equipment, and what is the ideal relative humidity range?

Maintain proper temperature, humidity, ventilation, and dust control. Relative humidity should be roughly 40-60%: too low increases static (ESD) risk; too high increases condensation and corrosion risk.

What safety equipment and practices prevent personal injury when servicing equipment?

Remove jewelry, disconnect power, use proper lifting technique (lift with legs, not back), wear safety goggles and air filter masks when needed, follow electrical safety, and never open power supplies or CRTs that hold lethal charge.

What are key elements of professional communication and customer service for a technician?

Use clear language and avoid jargon, maintain a positive attitude, actively listen and don't interrupt, be culturally sensitive, be on time and set expectations, and follow up to confirm satisfaction.

How should a technician handle a difficult or angry customer professionally?

Stay calm and avoid arguing or being defensive, listen and clarify rather than dismiss the issue, do not minimize their problems, avoid being judgmental, and find a solution while keeping them informed.

How should a technician handle confidential or private customer materials found during service?

Maintain confidentiality — do not access, copy, share, or disclose private data, follow the organization's privacy and incident-handling policies, and adhere to applicable regulations governing customer information.

What is the difference between SSH, RDP, and a VPN for remote access?

SSH provides encrypted command-line access (port 22). RDP (Remote Desktop Protocol, port 3389) provides a remote graphical desktop. A VPN creates an encrypted tunnel to a private network, securing all traffic over an untrusted link.

Compare a .bat, .ps1, .vbs, and .sh script file.

.bat is a Windows batch file (cmd). .ps1 is a PowerShell script. .vbs is a VBScript file. .sh is a Unix/Linux shell script (Bash). Each is interpreted by its respective shell/engine.

What are common use cases (and risks) of scripting in IT administration?

Uses: basic automation, restarting machines, remapping network drives, installing applications, automated backups, gathering information, and initiating updates. Risks: unintentionally changing system settings, browser/system crashes from mishandled resources, and introducing malware via untrusted scripts.

What is the difference between an environment variable and a comment in a script?

An environment variable (e.g., %PATH% in batch, $PATH in Bash) stores reusable system/configuration values referenced by scripts. A comment (REM/:: in batch, # in PowerShell/Bash) is non-executed text used to document the script.