CompTIA A+ Core 2 (220-1202): The New Exam Is Security-Heavy

If you open your Core 2 notes expecting a Windows exam with a little security sprinkled on top, you will study the wrong exam. The 220-1202 still tests operating systems and troubleshooting, but security is no longer a chapter you can leave until the end. It is the lens the whole exam looks through: a malware infection is a troubleshooting problem, a shared folder is an access-control problem, and a phishing email is an incident-response problem. The candidates who struggle are usually not short on Windows knowledge. They are short on security judgment — the habit of asking, before touching anything, "what is at risk here, and what should I not break while I fix it?"

This post does not walk the exam domain by domain. It works through three desk scenarios — the kind of situations the exam actually describes — and pulls out the three skills the plan for this exam keeps coming back to: malware removal, access controls, and incident response. Learn the moves in context and they transfer to questions you have never seen. Memorize definitions in isolation and they will not.

Scenario 1: the workstation that suddenly runs hot

A user reports that her machine has slowed to a crawl, pop-ups keep appearing, and a program she does not recognize is asking for permission to run. The instinct most new technicians have is to fix it fast: delete the suspicious program, run a scan, hand the machine back. On the exam, that instinct is the trap.

The right first move is not remediation. It is investigation and containment. What changed recently — a download, an email attachment, a USB drive? Which processes are running, and what is using the disk and network? Is anything else on the network showing the same symptoms? You gather that picture before you change anything, because the moment you start deleting files you start destroying evidence about what happened and how far it spread.

Only then do you quarantine: disconnect the machine from the network so the infection cannot spread or phone home, while leaving it powered on if evidence matters. The exam tests this distinction repeatedly — isolating a machine is not the same as switching it off, and wiping a drive is not a first step, it is a last resort after you know a clean recovery is possible. Then comes removal, in a controlled way: boot into a clean environment where the malware cannot defend itself, run reputable anti-malware tools, and remove what they find. Then recovery: restore from a known-good backup where needed, verify the machine actually works — updates applied, applications opening, network behaving — and only then return it.

The step candidates skip, and the exam never does, is documentation. What was found, what was removed, what was restored, and what the user should do differently next time. A technician who fixes a machine and writes nothing down has left the next technician — often themselves, a week later — with no record of what happened. In the exam's logic, documentation is not paperwork after the job. It is part of the job.

The lesson to carry: malware removal has an order, and the order is the point. Investigate, contain, remove, recover, document. Any answer choice that jumps straight to wiping or reinstalling has skipped the work that makes the fix safe.

Scenario 2: the shared folder everyone can open

A small office shares a folder of client records. Anyone on the network can open it, and nobody remembers who set the permissions. The manager asks you to "lock it down" — and the exam version of this question asks which change actually achieves that.

This is where access control stops being theory. Two permission systems are acting on that folder at once: the share permissions on the network share, and the NTFS permissions on the folder itself. When a user reaches the folder over the network, the effective permission is the most restrictive of the two combined. Granting someone full control in one place and read-only in the other does not average out — it leaves them with read-only. Technicians who only check one layer will confidently misdiagnose the problem, and the exam knows it. Before changing anything, check both layers and work out what the user can actually do, not what one dialog box suggests.

The fix follows the principle of least privilege: give each person only the access their job actually needs, and no more. The receptionist who reads client contact details does not need to edit or delete them. The manager who approves changes does not need to be a local administrator on every machine to do it. Permissions should follow roles, not individuals, so that when someone changes jobs the access changes with the role instead of lingering behind them.

The same thinking covers the rest of the scenario. Default credentials on the office router and the shared printer are an open door, not a convenience — change them. A single password protecting a shared account is not a control at all, because you can never tell who used it; individual accounts with multi-factor authentication are. And when someone leaves, their access should be revoked as part of the same process as returning their keys, not discovered months later during an audit.

The lesson to carry: access control questions are rarely about one setting. They are about the combination — share plus NTFS, role plus authentication — and the answer is the most restrictive result of that combination, applied to the smallest privilege that still lets the person work.

Scenario 3: the phishing email that got clicked

An employee clicks a link in an email that looked like it came from IT, enters credentials on a convincing fake login page, and realizes the mistake a minute later. This is the scenario the exam uses to test incident response, and the scoring logic is the same as in the malware case: contain first, investigate second, fix third.

Containment here is about the account, not just the machine. The password must be changed from a clean device, active sessions revoked, and multi-factor authentication confirmed or re-established — because changing a password while the attacker still holds a live session does not actually lock them out. Then scope: did the same email reach anyone else, did anyone else click, were the stolen credentials used anywhere? A response that fixes one user and never asks those questions has treated an incident as a help-desk ticket.

Only after containment and scoping does remediation make sense: scan the machine, remove anything dropped by the link, and check for persistence — scheduled tasks, new startup entries, forwarding rules quietly added to the mailbox. Then recovery and the part that turns an incident into prevention: tell the team what the email looked like, in plain language, so the next person recognizes it. Report the message through the proper channel so the sender can be blocked for everyone, not just deleted from one inbox. And document the timeline: when the email arrived, when it was clicked, what was done, and in what order.

Notice what did not happen in any of these steps: nobody blamed the employee in a way that would make the next person hide their mistake. The exam's operational-procedures questions reward the same professionalism — clear communication, no jargon dumped on a stressed user, and privacy respected while you work on their machine. A fast response that makes users afraid to report the next incident is not a good response.

The lesson to carry: incident response is a sequence, not a single heroic action. Contain the account and the machine, scope the blast radius, remediate, recover, communicate, document. Answers that skip to "reset the password and move on" have missed most of the job.

A study week that respects the shift

If security is the thread running through this exam, study it that way instead of treating it as a separate block to cram last:

• Day 1–2: malware removal order. Drill the sequence until it is automatic: investigate, quarantine, remediate, recover, document. Practice it as ordering exercises — put jumbled steps back in order — because that is how the exam most often tests it.
• Day 3–4: access-control combinations. Work permission scenarios on paper: a user with one share permission and a different NTFS permission, a role change, a departing employee. For each, state the effective access before you look at the answer. The "most restrictive wins" rule only becomes reflex through repetition.
• Day 5: incident walkthroughs. Take one phishing scenario and one malware scenario and write out every step you would take, in order, including who you would tell and what you would document. If your plan has only technical steps and no communication or documentation, it is incomplete by the exam's standards.
• Day 6–7: timed mixed practice. Mix operating-system and troubleshooting questions back in, under a clock, and review every wrong answer by asking which of the three skills it actually tested. Most of your misses will turn out to be security judgment wearing a troubleshooting costume.

That is the real shift in the 220-1202. It does not ask you to become a security specialist. It asks you to think like a technician who understands that every fix has a security consequence, every permission has a blast radius, and every incident is a sequence with an order that matters. Study the order, practice the combinations, and the exam stops feeling like a trivia test and starts feeling like the job itself.

Try the free 220-1202 practice test — no signup, instant feedback — at https://study4pass.com/study-material/comptia/220-1202, and see whether your security judgment holds up under timed conditions before exam day does the testing for you.