CompTIA A+ Core 2

• Explain core security principles, common threats and attack vectors

  ≈ 4%1 h 30 min

  Covers foundational security concepts, common threat types and the ways attackers reach users, endpoints and data. On the exam, candidates must recognise terminology, distinguish threat behaviours and identify the most likely attack vector or security principle in a scenario.

  • Explain core security principles including confidentiality, integrity, availability, least privilege, zero trust and defense in depth.
  • Compare common threat types including social engineering, malware, rogue devices, credential attacks and insider threats.
  • Identify common attack vectors including phishing channels, malicious links and attachments, infected removable media, compromised websites and exposed services.
  • Interpret basic indicators of compromise and suspicious behaviour such as unexpected prompts, fake security warnings, account lockouts, unusual network activity and unauthorized changes.
  • Evaluate common vulnerabilities created by weak passwords, unpatched software, misconfiguration, default settings and excessive permissions.

• Apply identity, authentication, authorization and least-privilege controls

  ≈ 3%1 h 30 min

  Focuses on how identities are created, verified and restricted through authentication, authorization and account-management controls. The exam tests selection and application of the right access control, sign-in method or privilege model for a user, device or support scenario.

  • Differentiate identification, authentication, authorization and accounting in user and administrative access scenarios.
  • Apply least privilege, just-enough access and separation of duties to standard users, power users, administrators and service accounts.
  • Compare authentication factors and methods including passwords, PINs, biometrics, smart cards, hardware tokens, software authenticators and multifactor authentication.
  • Configure account policies and sign-in protections such as password complexity, expiration, failed-attempt lockout and account disablement when appropriate.
  • Explain authorization concepts including permissions, group-based access, share access and local versus domain-based account management.
  • Recognize common identity risks including shared accounts, weak credentials, password reuse, default credentials and privilege escalation.

• Configure wireless security, remote-access protections and basic network security controls

  ≈ 3%1 h 15 min

  Addresses secure wireless configuration, protected remote access and basic network security measures used on client and small-office environments. Exam items typically ask candidates to choose or configure the correct wireless standard, remote-access protection or network control for a given risk.

  • Configure secure wireless settings including strong passphrases, WPA2 or WPA3 security, SSID management and guest-network separation.
  • Differentiate wireless security weaknesses and threats such as evil twin access points, rogue hotspots, weak encryption and default router settings.
  • Explain secure remote-access methods including VPN use, encrypted connections and multifactor authentication for remote logon.
  • Identify basic network security controls including firewalls, content filtering, DNS filtering, network segmentation and disabling unused services.
  • Apply secure small-office or home-office router settings such as changing default credentials, updating firmware and using appropriate wireless encryption.

• Implement physical security measures and device-hardening controls

  ≈ 3%1 h 15 min

  Covers the physical safeguards and device-hardening practices that protect systems from theft, tampering and unauthorized use. The exam tests practical selection of deterrent, preventive and hardening controls for workstations, laptops, mobile devices and peripheral equipment.

  • Implement physical security controls such as locks, badge access, cable locks, privacy screens, secure storage and device tracking.
  • Apply workstation and laptop hardening measures including screen-lock timers, secure boot options, BIOS or UEFI passwords and boot-order restrictions.
  • Configure mobile-device protections such as screen locks, biometric unlock, remote wipe, device encryption and location services when appropriate.
  • Disable or restrict unnecessary hardware and connectivity options including unused ports, removable media access, Bluetooth and autorun features.
  • Explain the purpose of tamper prevention and tamper evidence controls for end-user devices and support environments.

• Configure endpoint protection, host firewalls and workstation security settings

  ≈ 4%1 h 45 min

  Focuses on the built-in protections used to secure client operating systems and endpoints against unauthorized access and exploitation. Exam questions commonly require candidates to configure or verify firewall, anti-malware and workstation security settings in Windows and comparable environments.

  • Configure endpoint protection features including anti-malware, real-time protection, scheduled scans, signature updates and quarantine actions.
  • Use host-based firewall settings to allow, block or scope traffic by application, port, profile or network location.
  • Apply workstation security settings such as user account control, login requirements, lock-screen behaviour and local security policies.
  • Explain the purpose of operating-system security features including secure boot, TPM-backed protections and exploit-mitigation settings.
  • Verify that endpoint protections remain updated and enabled after software installs, policy changes or troubleshooting actions.

• Protect data with encryption, secure disposal and other end-user security controls

  ≈ 3%1 h 30 min

  Examines how user and organizational data is protected at rest, in use and at end of life through encryption, access control and disposal practices. The exam tests when to use a protection method and how to handle storage media, files and sensitive information securely.

  • Differentiate data-at-rest, data-in-transit and data-in-use protections and select appropriate safeguards for each.
  • Use encryption technologies such as full-disk encryption, file encryption and encrypted network sessions to protect sensitive data.
  • Explain the role of TPM, recovery keys and authentication requirements in device and drive encryption scenarios.
  • Apply secure data-handling practices including proper permissions, secure sharing, data minimization and prevention of unauthorized copying to removable media.
  • Choose appropriate secure-disposal methods for paper and electronic media, including shredding, wiping, degaussing and physical destruction where suitable.

• Reduce risk with browser security, email protections and user awareness practices

  ≈ 2%1 h

  Covers the protections that reduce day-to-day user risk in web browsing, email use and routine security awareness. On the exam, candidates must identify safer user practices, safer client settings and warning signs of phishing, spoofing and other common end-user attacks.

  • Configure browser security settings such as pop-up blocking, certificate checks, site permissions and trusted versus untrusted content controls.
  • Identify suspicious email characteristics including spoofed senders, unexpected attachments, mismatched links, urgent language and business email compromise indicators.
  • Explain safe browsing and downloading practices including using trusted sources, avoiding unsolicited links and verifying digital prompts before approving actions.
  • Apply user-awareness practices such as locking devices, reporting suspicious messages, verifying unusual requests and following acceptable-use policies.

• Prevent, detect, contain and remediate malware

  ≈ 3%1 h 45 min

  Addresses the full malware-response cycle: preventing infection, recognizing symptoms, containing spread and restoring normal operation. The exam tests both conceptual recognition of malware types and practical remediation steps in the correct order for workstation support scenarios.

  • Compare common malware categories including viruses, worms, trojans, ransomware, spyware, rootkits and potentially unwanted programs.
  • Identify malware symptoms such as performance degradation, unwanted redirects, disabled security tools, pop-ups, encryption of files and unusual process activity.
  • Apply prevention measures including patching, least privilege, application control, safe downloading practices and current anti-malware protection.
  • Perform basic containment and remediation steps by isolating affected systems, disabling unnecessary connectivity, updating signatures, scanning, removing or quarantining threats and validating system operation afterward.
  • Explain post-remediation actions including restoring clean data, changing compromised credentials, monitoring for recurrence and educating the user on the infection vector.

About 11 h 30 min of study, lessons and core practice

• Apply troubleshooting methodology and gather evidence in scenario-based support

  ≈ 2%1 h

  Covers the CompTIA troubleshooting process and the evidence-gathering habits used in support scenarios. The exam tests whether candidates can follow the method in order, verify probable cause, implement and document fixes, and communicate appropriately while preserving data and system integrity.

  • Apply the CompTIA troubleshooting methodology: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action, implement the solution, verify full system functionality, and document findings, actions, and outcomes.
  • Gather evidence by interviewing users, identifying recent changes, backing up data when appropriate, and reproducing or isolating symptoms without causing unnecessary disruption.
  • Interpret system, application, and user-provided evidence to distinguish symptoms from root cause and to decide whether a quick theory or a divide-and-conquer approach is appropriate.
  • Evaluate whether to escalate based on scope, impact, access level, time constraints, and organizational procedures while maintaining professionalism and clear communication.
  • Verify that the implemented fix resolves the reported issue and does not create new problems, including confirming normal operation with the user where appropriate.

• Troubleshoot Windows boot, startup and recovery failures

  ≈ 4%2 h

  Focuses on diagnosing and correcting Windows failures that prevent normal startup, sign-in, or recovery. The exam commonly presents symptoms and asks for the most likely cause, the best recovery environment tool, or the correct repair sequence.

  • Diagnose Windows boot and startup problems, including missing or corrupt boot files, invalid boot configuration, startup loops, blue screens during startup, failed updates, and inaccessible operating-system volumes.
  • Select and use appropriate recovery options, including Safe Mode, WinRE, Startup Repair, System Restore, uninstalling problematic updates, reset or refresh-style recovery options where available, and recovery from installation or recovery media.
  • Use boot and recovery tools to repair startup components, including rebuilding or correcting boot records and boot configuration data for BIOS/MBR and UEFI/GPT environments.
  • Troubleshoot startup failures caused by storage, partition, file-system, BitLocker recovery, or driver issues that prevent the operating system from loading normally.
  • Verify successful recovery by confirming normal boot, user access, application availability, and the integrity of system and user data after repair.

• Troubleshoot Windows performance, services and stability issues

  ≈ 4%2 h

  Addresses poor Windows performance, failed or misbehaving services, crashes, hangs, and general instability. The exam tests recognition of symptoms, use of built-in tools, and selection of the safest corrective action.

  • Troubleshoot performance problems such as high CPU, memory, disk, or network utilization; excessive startup items; low free storage; application slowdown; and degraded responsiveness using appropriate Windows diagnostic tools.
  • Diagnose service-related issues, including services that fail to start, restart repeatedly, depend on other services, or stop required operating-system or application functionality.
  • Interpret system logs, reliability data, and crash symptoms to identify probable causes of freezes, unexpected shutdowns, application crashes, BSOD events, or recurring instability.
  • Apply corrective actions for stability and performance issues, including disabling unnecessary startup items, repairing system files, adjusting power or performance settings, updating or rolling back drivers, and removing problematic software.
  • Verify that services, scheduled tasks, and dependent applications operate correctly after remediation and that performance returns to acceptable levels.

• Troubleshoot Windows configuration, networking and user-profile issues

  ≈ 4%2 h

  Covers Windows problems caused by incorrect settings, network misconfiguration, and damaged or inaccessible user profiles. The exam expects candidates to isolate whether the fault is system-wide, user-specific, or network-related and then choose the best correction.

  • Troubleshoot Windows configuration issues involving incorrect system settings, display or device options, mapped resources, printer settings, power configuration, updates, and other local operating-system preferences.
  • Diagnose networking problems in Windows, including incorrect IP configuration, DNS issues, gateway or routing problems, connectivity loss, name-resolution failures, limited resource access, and profile-specific network symptoms.
  • Use built-in tools and settings to identify whether a problem is caused by local configuration, network services, firewall rules, credential problems, or remote-resource availability.
  • Troubleshoot user-profile issues such as corrupt profiles, temporary profiles, missing desktop items, inaccessible user settings, logon problems, and profile-permission errors.
  • Apply and verify corrective actions, including renewing configuration, correcting settings, repairing or recreating user profiles, and confirming access to local and network resources.

• Troubleshoot application, driver and compatibility issues

  ≈ 3%1 h 30 min

  Focuses on resolving problems with applications, device drivers, and compatibility between software, hardware, and Windows versions. The exam typically presents installation failures, application errors, or post-update problems and asks for the best fix.

  • Diagnose application problems including failed installation or uninstallation, crashes, missing dependencies, blocked execution, patching failures, licensing or activation symptoms, and application-specific performance issues.
  • Troubleshoot driver issues such as missing, corrupt, unsigned, incompatible, or unstable drivers that affect device functionality, startup behavior, or operating-system stability.
  • Apply compatibility solutions for legacy or incompatible software and hardware, including compatibility mode, running with appropriate permissions, architecture awareness such as 32-bit versus 64-bit, and virtualization or alternative deployment methods where appropriate.
  • Select corrective actions for update-related problems, including repairing or reinstalling applications, rolling back or updating drivers, removing problematic updates, and restoring known-good operation.
  • Verify that the application or device functions correctly after remediation, including confirming user access, expected features, and absence of recurring errors.

• Troubleshoot security controls, access failures and malware symptoms

  ≈ 3%1 h 45 min

  Covers failures related to security settings, permissions, authentication, encryption, and signs of malware infection. The exam tests whether candidates can distinguish between legitimate security controls and compromise symptoms, then contain and remediate safely.

  • Troubleshoot access and security-control issues involving permissions, account lockout, denied access, credential prompts, UAC behavior, firewall or endpoint-protection blocks, certificate warnings, and encryption or BitLocker-related access problems.
  • Diagnose symptoms that may indicate malware or compromise, such as browser redirects, fake alerts, disabled security tools, excessive pop-ups, unexplained resource usage, unauthorized changes, or suspicious processes and services.
  • Apply appropriate containment and remediation steps, including isolating the system, disabling autoruns when necessary, updating security tools, scanning and removing threats, and using safe or recovery environments when normal operation is not trusted.
  • Differentiate between a misconfiguration and a security incident by evaluating logs, alerts, user reports, and system behavior before changing protections or removing controls.
  • Verify that security controls function correctly after remediation, that access is restored only to authorized users, and that the system is updated, monitored, and documented according to procedure.

• Troubleshoot mobile OS, email and application issues

  ≈ 2%1 h 15 min

  Addresses support problems on mobile devices involving the operating system, email, connectivity, and apps. The exam usually presents common smartphone or tablet symptoms and asks for the most likely cause or best next step.

  • Troubleshoot mobile operating-system issues such as failed boot, frozen interface, poor performance, storage exhaustion, battery drain, update failures, and sync problems using platform-appropriate settings and support steps.
  • Diagnose mobile email problems including incorrect server settings, authentication failures, send or receive errors, attachment issues, sync delays, certificate prompts, and network-dependent mail behavior.
  • Troubleshoot mobile application issues such as failed installation, forced closure, permissions problems, excessive battery or data use, notification failures, and incompatibility after an update.
  • Apply corrective actions including force stop, clear cache or app data where appropriate, update or reinstall the app, restart the device, remove and recreate accounts, reset network settings, or perform backup-aware reset procedures.
  • Verify normal mobile operation after remediation, including connectivity, account sync, application behavior, notifications, and preservation or restoration of user data where applicable.

About 11 h 30 min of study, lessons and core practice

• Use documentation, ticketing, inventory control and escalation procedures

  ≈ 3%1 h 15 min

  Covers the operational records and support workflows technicians use to track assets, users, incidents and handoffs. The exam tests whether candidates can choose appropriate documentation, maintain accurate tickets and inventory, and escalate issues through the correct channels with sufficient detail.

  • Maintain accurate ticket records by documenting the problem description, environment, impact, troubleshooting steps, resolution status and closure details.
  • Use support documentation and knowledge bases to record findings, reference known issues and preserve repeatable solutions for future incidents.
  • Track devices and components with inventory-control information such as asset tags, assigned user, location, warranties, software licenses and configuration details.
  • Differentiate incident severity, priority and impact to determine when and how to escalate through functional, hierarchical or vendor channels.
  • Apply appropriate escalation procedures by transferring complete notes, evidence and customer communications to the next support tier.
  • Interpret acceptable-use and administrative documentation requirements when handling user requests, changes and service interruptions.

• Apply change-management, rollback and release practices

  ≈ 3%1 h 15 min

  Focuses on controlled change in production environments, including approvals, testing, implementation and backout planning. The exam tests whether candidates can recognize correct change-management steps and reduce risk through staged release and rollback practices.

  • Explain the purpose of change management in reducing operational risk and preserving service availability.
  • Document a change request with business justification, scope, affected systems, risk assessment, testing results, implementation steps and approval status.
  • Apply scheduling practices such as maintenance windows, user notification and blackout periods when planning changes.
  • Validate prerequisites for implementation by confirming backups, dependencies, resource requirements and stakeholder approvals.
  • Differentiate rollback, backout and recovery planning, and choose appropriate procedures if a change fails or produces unintended results.
  • Compare release practices such as pilot, phased, maintenance-window and emergency changes, and evaluate when each is appropriate.

• Use backup, restore, recovery and business continuity practices

  ≈ 4%1 h 45 min

  Covers data-protection and resilience practices used to preserve operations and recover from failure or disruption. The exam tests whether candidates can select suitable backup methods, verify recovery readiness and distinguish continuity and disaster-recovery concepts.

  • Compare backup methods, including full, incremental, differential and synthetic approaches, and select an appropriate method for a given requirement.
  • Differentiate backup targets and storage options such as local, network, off-site and cloud-based repositories, including retention considerations.
  • Verify backup integrity and recovery readiness by checking job results, testing restores and confirming that recovery objectives can be met.
  • Perform or validate restore procedures for files, applications, system states or full systems according to documented recovery processes.
  • Explain business continuity and disaster recovery concepts, including continuity of operations, redundancy and alternate-site planning.
  • Interpret recovery requirements using official terminology such as recovery time objective (RTO) and recovery point objective (RPO).

• Follow safety procedures for ESD, electrical hazards and hazardous materials

  ≈ 3%1 h 15 min

  Addresses technician safety when working with electronic equipment, power sources and regulated materials. The exam tests whether candidates can identify hazards, use correct protective measures and follow safe handling procedures in repair and support scenarios.

  • Apply electrostatic discharge (ESD) precautions by using grounding methods, antistatic equipment and correct handling practices for sensitive components.
  • Identify electrical hazards such as power supplies, high-voltage devices, damaged cables and charged capacitors, and follow safe shutdown and isolation procedures.
  • Use personal safety practices when lifting, moving or servicing equipment to avoid injury and environmental damage.
  • Recognize hazardous materials and components, including batteries, toner, CRTs and chemical supplies, and handle them according to safety guidance.
  • Interpret common workplace safety controls such as signage, incident reporting, material safety information and emergency-response procedures.
  • Evaluate when not to proceed with a repair because of unsafe conditions, and escalate to qualified personnel when required.

• Manage environmental controls, sustainability requirements and secure disposal

  ≈ 2%1 h

  Covers the environmental and end-of-life practices that protect equipment, facilities, data and regulatory compliance. The exam tests whether candidates can maintain suitable operating conditions, support sustainability goals and dispose of devices and media securely.

  • Identify environmental controls needed for IT equipment, including temperature, humidity, airflow, dust control and power-quality considerations.
  • Explain sustainability practices such as power conservation, recycling, e-waste reduction and environmentally responsible consumption of supplies.
  • Differentiate standard recycling, refurbishment, reuse and certified disposal paths for hardware, batteries, toner and other IT materials.
  • Apply secure-disposal methods for storage media and devices, including sanitization, destruction and chain-of-custody requirements.
  • Recognize organizational and regulatory requirements that affect environmental handling and disposal procedures.
  • Evaluate disposal scenarios to ensure both environmental compliance and protection of confidential data.

• Protect privacy and licensing compliance while communicating professionally with users

  ≈ 4%1 h 30 min

  Focuses on legal, ethical and interpersonal expectations for support work, including privacy protection, software licensing and professional conduct. The exam tests whether candidates can protect sensitive information, stay compliant and communicate clearly with users and stakeholders.

  • Protect personally identifiable information (PII), credentials and other sensitive data by applying privacy, confidentiality and need-to-know principles during support activities.
  • Differentiate software-licensing concepts such as seat, device, user, OEM, retail, subscription and volume licensing, and recognize noncompliant use.
  • Apply professionalism standards including respectful conduct, punctuality, clear ownership, proper appearance and adherence to organizational policy.
  • Use effective communication techniques when interacting with users, including active listening, setting expectations, avoiding jargon and confirming understanding.
  • Adapt communication and documentation to the audience, such as end users, management, peers, vendors or escalated support teams.
  • Handle difficult interactions appropriately by de-escalating conflict, preserving privacy and documenting commitments and outcomes accurately.

• Use remote-support tools, basic scripting logic and routine automation

  ≈ 3%1 h 30 min

  Covers the support tools and lightweight automation knowledge expected of an entry-level technician. The exam tests whether candidates can choose appropriate remote-support methods and interpret or use basic scripting concepts for common administrative tasks.

  • Compare remote-support methods and tools, including attended and unattended access, screen sharing, secure remote shells and remote assistance platforms.
  • Apply secure remote-support practices by verifying identity, obtaining consent, protecting sessions and documenting actions taken on the endpoint.
  • Interpret basic scripting and programming logic, including variables, comments, branches, loops and simple input/output operations.
  • Recognize common use cases for routine automation, such as user management, software deployment, system checks and scheduled maintenance tasks.
  • Differentiate script execution considerations such as permissions, execution policy, paths and the risks of running untrusted code.
  • Evaluate when automation is appropriate versus when a manual support step, escalation or change-control review is required.

• AI use cases and safe adoption in IT support

  ≈ <1%45 min

  A+ V15 Core 2 only

  Explain common, exam-relevant uses of AI in end-user support and operations, including productivity scenarios, validation of generated output, privacy and policy limits, and when human judgment must override tool suggestions.

  • Identify common IT support tasks where AI tools can assist with drafting, summarising, searching or automating work.
  • Differentiate suitable AI-assisted workflows from situations that still require direct technician analysis or escalation.
  • Validate AI-generated answers, documentation and scripts for accuracy, completeness and policy compliance before use.
  • Protect sensitive data by limiting what is shared with AI tools and following organisational privacy and security rules.
  • Apply AI output responsibly when creating ticket notes, user communications, knowledge articles or starter automation.

About 10 h 15 min of study, lessons and core practice