17 min read4 domains coveredFree practice, no sign-up
CompTIA A+ Core 2 (220-1102) is the second of the two exams you pass to earn the A+ certification, the entry credential for a career in IT support. Where Core 1 is hardware and networking, Core 2 is the software and procedural side of the technician's job: operating systems, security, software troubleshooting, and the operational procedures that keep the work safe, documented, and professional. It is procedure-heavy and tool-heavy, so it rewards knowing the correct tool, the correct setting, and the correct next step in a defined order rather than general familiarity.
It suits people moving into desktop support, help desk, and field service, as well as career changers who already passed or are studying for Core 1. No formal prerequisites exist, though CompTIA suggests some hands-on exposure to Windows, macOS, Linux, and mobile devices. If you have removed malware, set NTFS permissions, or written a simple script, parts of this will feel familiar; if not, the material is concrete and closable with focused, hands-on practice.
The real exam mixes multiple-choice questions with performance-based items. This bank deliberately covers the multiple-choice core: single-best-answer scenarios where several options are plausible and only one respects the published order of operations or is the single most appropriate tool. That is where most of the marks and most of the traps live, so practise reading a technician scenario and choosing the correct first action, the right utility, or the correct procedure step, then reading why each wrong option is wrong.
Core 2 tests the correct tool and the correct step in order, not general familiarity: the right utility for the symptom, the right permission model, and the published sequence for malware removal, change management, and troubleshooting.
Difficulty
Foundational
Best for
Aspiring IT support technicians, help-desk and field-service staff, and career changers who already hold or are studying for Core 1 and want the recognised entry credential for hands-on IT work.
Prerequisites
None required. CompTIA suggests some hands-on experience with Windows, macOS, Linux, and mobile devices; passing or studying Core 1 first is common but not assumed.
Maximum of 90 questions
Questions
90 min
Time allowed
700 / 900
Pass mark
$265
Exam cost (USD)
300
Practice questions
How this exam thinks
Core 2 questions reward the correct procedure and the correct tool, and three habits separate a pass from a fail.
First, when a scenario describes a problem, the exam almost always wants the BEST or FIRST action, not any action that would eventually help. Two options are often both technically valid, but one is the correct next step given the published order: you quarantine an infected machine and disable System Restore before you remediate, you get change approval before you implement, you establish a theory before you test it. A correct action performed at the wrong time is a wrong answer, and the single-best trap is exactly that - a real step out of sequence.
Second, the exam wants the right tool for the symptom, not a tool that is merely related. A corrupt system file wants sfc /scannow, a disk with bad sectors wants chkdsk, a broken component store wants DISM, a hung process wants Task Manager or taskkill. The distractors are built from adjacent utilities that a prepared-but-imperfect candidate could reach for, so read each option as a specific claim about what the tool does and match it to what the stem actually describes.
Third, several topics have a fixed model you must know cold: the seven-step malware-removal procedure in order, the most-restrictive rule where NTFS and share permissions combine, the WPA and encryption pairings, and what full, incremental, and differential backups each restore. A distractor that reorders the malware steps, swaps incremental with differential, pairs WPA3 with TKIP, or claims share permissions always win is the classic Core 2 plant. Learn these as reflexes so a wrong version jumps out.
What each domain tests and how to study it
The 220-1102 blueprint is split across 4 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.
What you must be able to do. Choose the correct operating system feature, command-line tool, or configuration setting for a stated requirement across Windows, macOS, and Linux, and match a file system or install method to a scenario.
In one sentenceThe largest domain: Windows editions and tools, the command line, macOS and Linux features, and the file systems and install choices a technician configures day to day.
Recall check: answer these from memory first
Name the file system to format a removable drive that must hold files larger than 4 GB and work on both Windows and macOS, and say why.
State the partition and disk limits that separate MBR from GPT.
Match sfc /scannow, chkdsk, DISM, and gpupdate each to the single symptom or task it is the correct tool for.
What it tests. Operating system administration in breadth: Windows editions and their features, the Control Panel and Settings applets, Windows command-line tools, and the file systems (NTFS, FAT32, exFAT, ext4, APFS) with their limits. It also covers macOS features such as Time Machine and Disk Utility and Linux basics such as chmod and common shell commands, plus install and upgrade methods and the GPT-versus-MBR and partition choices that go with them.
How to study it. Learn each Windows utility by the one symptom or task it owns, because the exam gives you a scenario and wants the tool: sfc for corrupt system files, chkdsk for disk errors, gpupdate for policy, Task Manager for a hung process. Get the file systems exact - exFAT for large files on removable media across operating systems, NTFS for permissions and journaling, FAT32 for its 4 GB file cap - and lock GPT versus MBR partition and disk limits. Add the macOS and Linux equivalents so a cross-platform stem does not catch you out.
Easy to confuse
exFAT versus FAT32 versus NTFS for a removable drive. FAT32 is widely compatible but caps a single file at 4 GB; NTFS supports large files and permissions but macOS mounts it read-only by default; exFAT supports files well above 4 GB and is natively read and write on both Windows and macOS, so it is the answer for large cross-platform files. The exam pairs the constraint in the stem with the one file system that meets it.
GPT versus MBR partitioning. MBR supports up to four primary partitions and a 2 TB disk limit and uses BIOS; GPT supports many partitions and disks larger than 2 TB and pairs with UEFI. A stem that claims MBR handles a 4 TB disk, or that GPT is limited to four partitions, is keyed wrong.
sfc /scannow versus chkdsk versus DISM. sfc /scannow repairs corrupt protected system files, chkdsk finds and fixes file-system and bad-sector errors on a disk, and DISM repairs the underlying component store that sfc draws from. Matching the utility to whether the fault is a system file, the disk, or the image store is exactly what the exam tests.
Worked example from the 220-1102 bank
lock_openFree sampleOperating Systemsmedium
Priya needs to move several 6 GB video files back and forth on a single USB flash drive that must be readable and writable on both Windows 11 and macOS without installing extra software. Which file system should she format the drive with?
AexFAT, because it supports files well above 4 GB and is natively read/write on both Windows and macOScheck_circle Correct
BFAT32, because it is the most widely supported removable-media format across desktop operating systems
CNTFS, because it journals writes and both operating systems fully support reading and writing it
Dext4, because it is a modern journaling file system that stores large media files reliably
Select exFAT for removable media that must carry files larger than 4 GB with native read/write access on both Windows and macOS. The two hard constraints are files over 4 GB and native read/write on Windows and macOS. FAT32 fails the size limit, NTFS is read-only on macOS by default, and ext4 is not natively mounted by either, so exFAT is the only format that satisfies all of them.
Why A is correct: exFAT was designed for flash media, removes the 4 GB per-file limit, and is natively read/write on modern Windows and macOS, meeting every constraint.
Why B is wrong: FAT32 is broadly compatible, which makes it tempting, but it caps individual files at 4 GB, so a 6 GB video will not fit.
Why C is wrong: NTFS handles large files, but macOS mounts NTFS volumes read-only by default, so Priya could not write to the drive without third-party drivers.
Why D is wrong: ext4 is a capable Linux file system, but neither Windows nor macOS mounts it natively, so it fails the cross-platform requirement.
What you must be able to do. Select the correct security control, permission model, wireless configuration, or data-destruction method for a stated requirement, and identify the malware or social-engineering attack a scenario describes.
In one sentenceThe security core: malware and social engineering, Windows and workstation hardening, NTFS and share permissions, wireless security, and data destruction and disposal.
Recall check: answer these from memory first
State the effective permission when NTFS and share permissions both apply to a network access, and what applies for local access.
Pair each of WPA2 and WPA3 with the encryption it should use, and name the legacy protocol that must not be paired with them.
Match a highest-assurance-destruction requirement and a drive-will-be-reused requirement each to the correct data-handling method.
What it tests. Applied workstation security: recognising malware types and social-engineering attacks, hardening Windows with UAC, strong password policy, account and permission restrictions, and encryption; the NTFS-versus-share permission model and effective permissions; wireless security with the WPA generations and their encryption; and choosing the correct data-destruction or sanitisation method for a stated assurance or reuse requirement, citing the media-sanitisation guidance where relevant.
How to study it. Drill the models that have one right answer under a constraint. Learn that combined NTFS and share permissions resolve to the most restrictive, while local access uses NTFS alone. Fix the wireless pairings - WPA3 current, WPA2 with AES/CCMP, TKIP and WEP legacy and weak - so a WPA3-with-TKIP option reads as wrong on sight. Map each data-destruction method to its requirement: physical destruction for highest assurance or dead drives, sanitisation such as secure or cryptographic erase when the drive will be reused, and outsourced disposal with a certificate for chain-of-custody.
Easy to confuse
NTFS versus share permissions. When a user reaches a resource over the network, the effective permission is the most restrictive of the combined NTFS and share permissions; local access ignores share permissions and uses NTFS only. A distractor that says share permissions always win, or that the least restrictive applies, is the trap.
WPA2 with AES versus WPA3, and the TKIP trap. WPA3 is current best practice and WPA2 should use AES (CCMP); TKIP and WEP are legacy and weak. The exam offers WPA2-or-WPA3 paired with TKIP, or WEP where WPA2/WPA3-AES is correct, so the encryption paired with the standard is the discriminator.
Physical destruction versus sanitisation for reuse. Physical destruction (shred, incinerate, degauss) gives the highest assurance and is for dead drives or top-secret media; sanitisation such as secure erase or cryptographic erase removes data while keeping the drive usable. Choosing destruction where the drive must be redeployed, or erase where the requirement was unrecoverable destruction, is the plant.
Disabling UAC versus fixing the privilege model. UAC prompts for elevation so standard users run with least privilege; the fix for repeated unwanted prompts is usually correcting the account or permission model, not turning UAC off. An option that disables UAC as the best answer trades security for convenience and is the wrong choice.
Worked example from the 220-1102 bank
lock_openFree sampleSecuritymedium
Priya is redeploying a working laptop SSD to another employee. Company policy requires that the previous user's data be unrecoverable, but the drive itself must stay functional for reuse. Which method should she use?
ADegauss the SSD using a magnetic degausser rated for the drive's capacity before reassigning it.
BDelete the existing partitions and perform a quick format of the volume before handing it over.
CShred the SSD in an approved media shredder and provision a brand-new drive instead.
DRun the drive's built-in ATA Secure Erase so the flash cells are reset while the SSD stays usable.check_circle Correct
When media must be reused, choose a sanitisation method such as Secure Erase rather than a destructive method or a superficial format. Reuse rules out physical destruction, and SSDs are immune to degaussing because they use non-magnetic flash storage, so a controller-level Secure Erase is the correct sanitisation that preserves the drive.
Why A is wrong: Degaussing is tempting because it works on magnetic media, but an SSD stores data in flash cells that a magnetic field cannot erase, so the data survives.
Why B is wrong: A quick format only clears the file table, so the underlying data remains and is trivially recovered with forensic tools, failing the unrecoverable requirement.
Why C is wrong: Shredding does make data unrecoverable, but it destroys the drive and defeats the stated requirement to reuse the same SSD.
Why D is correct: Secure Erase issued to the SSD controller sanitises every cell, including spare blocks, and leaves a fully working drive that can be reissued.
What you must be able to do. Apply the troubleshooting methodology and the seven-step malware-removal procedure in their published order, and choose the single best next action for a Windows, mobile, or mobile-security symptom.
In one sentenceThe applied domain: diagnosing Windows OS problems, removing malware in the correct order, and resolving mobile OS, application, and mobile-security issues.
Recall check: answer these from memory first
List the seven malware-removal steps in their published order, marking where System Restore is disabled and where it is re-enabled.
State where educating the end user falls in the malware-removal procedure and why it is not earlier.
Give a mobile symptom that signals a security issue rather than an ordinary application fault, and the correct first response.
What it tests. Software fault diagnosis under order-of-operations pressure: common Windows OS problems and the correct tool or repair, the CompTIA seven-step best-practice malware-removal procedure and its fixed sequence, and mobile OS and application issues including the security-specific ones such as data leaks, over-permissioned apps, and rooted or jailbroken devices. Nearly every item is a scenario asking for the most likely cause or the correct next action, so judgement about order and priority is the skill.
How to study it. Learn the seven malware-removal steps as a reflex and practise placing a described action at the right step, because reordering is the most common trap: quarantine and disable System Restore before you remediate, re-enable System Restore and create a restore point after, and educate the user last. Do the same for the six-step troubleshooting methodology applied to software. For mobile, separate an ordinary application issue from a security issue - a data leak or rooted device is security - and choose the cheapest correct fix before a factory reset.
Easy to confuse
Remediate-first versus quarantine-and-disable-System-Restore-first. The published order quarantines the infected system and disables System Restore in Windows before remediation, so a saved restore point cannot reinfect the machine. An option that scans and removes malware before quarantining, or that re-enables System Restore before the system is clean, reverses the sequence the exam tests.
A mobile application issue versus a mobile security issue. An application that crashes or drains battery is an ordinary mobile OS or application issue; leaked data, unexpected permissions, or a rooted or jailbroken device is a mobile security issue with a different response. The exam keys the security scenarios to security actions such as reviewing permissions or MDM controls, not just reinstalling the app.
Factory reset versus a cheaper mobile fix first. A factory reset is the last resort once confirmation and cheaper fixes are exhausted; clearing cache, checking permissions, updating the OS, or uninstalling a suspect app usually comes first. An option that jumps to a factory reset before the cheaper correct step is the over-reaction trap.
Priya updated a banking app on her Android phone and now it force-closes the instant she taps its icon, while every other app runs normally. She does not want to lose her saved logins or in-app data. Which action should the technician try FIRST?
AClear the app's storage and data from Settings so the app starts from a completely fresh state on next launch.
BUninstall the app and reinstall the current version from the official app store to replace any damaged program files.
CForce stop the app, then clear only its cache from Settings, leaving saved data and logins intact before relaunching.check_circle Correct
DPerform a factory reset of the phone to clear any system-wide corruption that may be affecting the application at launch.
When an app crashes after an update, clear its cache first because it is the least-destructive fix that preserves user data. An app update can leave incompatible cached temporary files that make the app fail at launch. Clearing the cache forces those files to be rebuilt while leaving accounts and saved data untouched, so it is the correct first step before the more destructive clear-data or reinstall options.
Why A is wrong: Clearing storage does often fix a corrupt-state crash, but it also wipes saved logins and in-app data, so it is not the first, least-destructive step when that data must be kept.
Why B is wrong: Reinstalling can resolve the crash, but it is more disruptive than clearing the cache and can remove locally stored data, so it is tried after the lighter step fails.
Why C is correct: Clearing the cache removes stale temporary files left by the update that commonly cause launch crashes, and it preserves accounts and saved data, so it is the correct least-destructive first step.
Why D is wrong: A factory reset is far too drastic for a single misbehaving app and erases all user data, so it is a last resort and never the first action here.
What you must be able to do. Apply documentation, change-management, backup, safety, environmental, privacy, and professionalism procedures in the correct order, and choose the right backup type, script use, or remote-access method for a scenario.
In one sentenceThe procedural domain: documentation and ticketing, change management, backup and recovery, safety and environment, privacy and licensing, communication, scripting basics, and remote access.
Recall check: answer these from memory first
State what a restore requires for a full, an incremental, and a differential backup, and which types clear the archive bit.
Put the change-management steps in order from request to implementation, naming what must happen before any change is made.
Give one remote-access or scripting scenario where the secure option is preferred over the more convenient one, and why.
What it tests. The non-technical-but-tested procedures a technician follows: documentation and ticketing systems, the change-management flow with approval before implementation, backup and recovery including the full, incremental, and differential types and what each restores, safety and environmental handling, privacy, licensing, and regulated-data policy, professional communication, basic scripting use cases and risks, and remote-access methods and their security.
How to study it. Fix the backup types by what a restore needs: full restores from one set, incremental needs the full plus every incremental since and clears the archive bit, differential needs the full plus only the latest differential and does not clear the archive bit. Learn the change-management order so approval and a change request always precede implementation, with a rollback plan documented. For remote access and scripting, weigh security and risk - an unattended remote tool or a script run with too much privilege is the wrong choice when a safer option is offered.
Easy to confuse
Incremental versus differential backup. An incremental backs up changes since the last backup of any type and clears the archive bit, so a restore needs the full plus every incremental in order; a differential backs up changes since the last full and does not clear the archive bit, so a restore needs only the full plus the latest differential. Swapping their definitions or restore requirements is the classic backup trap.
Change approval before versus after implementation. A change request and its approval, with a documented rollback plan, come BEFORE any change is implemented; end-user acceptance and verification follow. An option that implements the change first and documents or seeks approval afterwards reverses the change-management order the exam expects.
A documented backout plan versus an undocumented rollback. A backout or rollback plan is written into the change request before work starts so the change can be reversed safely; relying on an ad-hoc undo during implementation is not change management. The exam rewards the option that plans the reversal in advance rather than improvising it.
Worked example from the 220-1102 bank
lock_openFree sampleOperational Procedureseasy
A user phones the service desk because a shared office printer keeps jamming. So the ticket can be tracked and reassigned to another technician if needed, which detail is most important to capture when first logging the ticket?
AThe technician's own mobile number so the user can bypass the queue and call back directly later
BThe affected user's name and contact details together with a clear description of the reported problemcheck_circle Correct
CA guess at the most likely root cause, entered before any diagnosis has actually been carried out
DThe final resolution steps, which the technician writes in full before starting any troubleshooting
A ticket must first capture who is affected and a clear problem description so any technician can track, contact, and resolve it. A ticketing system tracks work through its lifecycle; without the requester's identity and a clear symptom description, the ticket cannot be triaged, reassigned, or matched to the caller, which is exactly what tracking depends on.
Why A is wrong: It feels helpful and personal, but routing calls around the ticketing system leaves the issue untracked and impossible to reassign.
Why B is correct: Correct: identifying the user and the symptom is the core of a ticket, letting any technician pick it up, contact the user, and track it to closure.
Why C is wrong: Recording a theory looks proactive, but an unverified guess logged as fact can mislead the next technician and is not the priority at intake.
Why D is wrong: Resolution notes matter, but they cannot be known at logging time; writing them before diagnosis records a fix that has not happened.
A study plan that works
Map the blueprint and set a date
Day 1
Read the official Core 2 exam objectives and the four domains with their weights. Book a provisional exam date now: a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting the exam.
Master the ordered procedures early
Week 1
The highest-value habit in Core 2 is knowing the fixed sequences cold. Learn the seven malware-removal steps, the change-management approval-before-implementation flow, and the six-step troubleshooting methodology until a reordered list looks wrong on sight. Use the recall prompts in this guide: cover the answer, retrieve from memory, then reveal.
Drill the security models (Security domain)
Weeks 1-2
Lock the models that have one right answer under a constraint: the most-restrictive rule for combined NTFS and share permissions, the WPA and encryption pairings, and matching each data-destruction method to its assurance-or-reuse requirement. Practise WPA-with-TKIP and destruction-versus-sanitisation distractors until they read as wrong instantly.
Cover Operating Systems breadth
Weeks 2-3
This is the largest domain. Learn each Windows command-line tool by the symptom it owns, the file systems and their limits including the exFAT and FAT32 4 GB distinction, GPT versus MBR, and the macOS and Linux equivalents. Drill scenario questions that hand you a symptom and ask for the correct utility.
Practise on scenarios with worked explanations
Week 3
Move to full practice sets across Software Troubleshooting and Operational Procedures and read the explanation for every question, including the ones you got right. The exam rewards choosing the best action among plausible options, so understanding why each distractor is wrong is where the marks are.
Find and close your weak domains
Week 4
Use your per-domain accuracy to drill the areas dragging you down rather than re-reading what you already know. Malware-removal ordering, incremental-versus-differential backups, and NTFS-versus-share permissions are common weak spots; repeat until every domain clears the pass line with margin.
Sit a timed mock and review it
Week 5
Take at least one full timed mock to rehearse pacing and flag-and-return. Treat the score as a per-domain readiness signal, then review every missed question before booking or sitting.
Know when you're ready
Readiness for Core 2 is a score on questions you have not seen before, not a feeling that the material is familiar. Those are different things, and the gap between them is where people fail. Re-reading the malware-removal steps builds fluency, and fluency feels like knowledge, so confidence rises while real recall does not. The fix is to test yourself: if you can produce the correct next step, the right tool, or the effective permission from memory and explain why the wrong options are wrong, you know it; if you can only recognise the right answer when you see it, you do not yet.
Because Core 2 is procedure-heavy, weak recall hides well behind familiarity. A first pass over the material feels like mastery until a scenario asks for the correct FIRST action in the seven-step malware procedure or which backup type restores from a single set, and the specific step is not there. Trust your measured per-domain accuracy over your gut, and set the bar at clearing every domain comfortably on unseen questions across more than one session, not scraping the pass mark once.
This guide gives you the map. The practice bank is where you find out whether you can navigate it, with a worked explanation and a reason every distractor is wrong on every question. Readiness scoring tells you when you are there. Not before.
Ready to put this into practice?
Free 220-1102 questions with worked explanations. No sign-up.
For a problem scenario, choose the BEST or FIRST action, not any action that helps. Two options are often both valid; the exam wants the correct next step in the published order given the constraint in the stem.
Match the tool to the symptom. A corrupt system file is sfc /scannow, disk errors are chkdsk, a broken component store is DISM, a hung process is Task Manager or taskkill; read each option as a claim about what the tool does.
Know the seven malware-removal steps in order cold. Quarantine and disable System Restore before you remediate, re-enable and create a restore point after, and educate the user last; a reordered list is the classic trap.
For combined permissions, apply the most-restrictive rule. Effective network permission is the most restrictive of NTFS and share; local access uses NTFS only, and an option that says share always wins is wrong.
Do not pair WPA with TKIP. WPA3 is current and WPA2 uses AES; TKIP and WEP are legacy, so a WPA2-or-WPA3-with-TKIP option is keyed wrong on sight.
Separate incremental from differential by the restore. Incremental needs the full plus every incremental and clears the archive bit; differential needs the full plus only the latest and does not, so check what a restore would require.
Frequently asked questions
Is CompTIA A+ Core 2 hard?
It is a foundational exam with no formal prerequisites, but it is procedure-heavy and tool-heavy. The difficulty is in knowing the correct tool and the correct step in a defined order, which is why scenario practice with worked explanations matters more than reading definitions.
How long should I study for 220-1102?
Most candidates with some hands-on exposure are ready in four to six weeks of focused study. Less experience means more time on Operating Systems, which is the largest domain, and on the ordered procedures for malware removal, change management, and troubleshooting.
Do I need both Core 1 and Core 2 to get A+ certified?
Yes. The A+ certification requires passing both 220-1101 (Core 1) and 220-1102 (Core 2). Core 2 covers operating systems, security, software troubleshooting, and operational procedures; Core 1 covers hardware, networking, mobile, virtualization, and hardware troubleshooting.
What is the pass mark for 220-1102?
The exam is scored on a scaled range and the published pass mark is in the facts panel above. Scoring is scaled, so your raw percentage and the scaled score are not the same thing; aim to clear every domain comfortably in practice rather than scraping a target.
Which domains should I focus on?
Operating Systems is the largest single domain and Security is close behind, so together they carry most of the marks. Software Troubleshooting and Operational Procedures are procedure-heavy, and the ordered sequences in them are high-yield because the exam tests the order directly.
Does this bank cover the performance-based questions?
This bank focuses on the multiple-choice core, where most marks and traps live, with a worked explanation and a per-distractor rationale on every question. The live exam also includes performance-based items; the concepts you drill here are exactly what those item types test in a different format.
How many practice questions should I do before booking?
Enough that every domain clears the pass line with margin on questions you have not seen before, and that a full timed mock feels comfortable on pacing. Quality of review matters more than raw volume: read the explanation on every question, including the ones you answered correctly.
Related certifications
Other It-support certifications with a study guide.
Examworthy is not affiliated with or endorsed by CompTIA. This guide is original study material based on the public exam blueprint. We never reproduce live exam items. 220-1102 and related marks belong to their respective owners.
