CompTIA A+ Core 2 Guide: Software, Windows & Security (220-1102)

Cedric: Cheers for joining me, Kate. I was just thinking about how most people, when they think about working in IT, they picture someone with a screwdriver, maybe swapping out a hard drive or plugging in a monitor. But you know as well as I do that the hardware—that Core 1 stuff—is only half the battle. If you can't actually make the software run, protect the data, or fix a weird Windows glitch, you're essentially just looking at a very expensive paperweight.

Kate: That’s such a perfect way to put it. I mean, think about your own day. When was the last time your keyboard actually physically broke? Probably never. But how many times has a program frozen, or you’ve gotten a weird security alert, or your Wi-Fi just… vanished? That is the world of CompTIA A+ Core 2. It’s the "what do I actually do on the job" part of the certification.

Cedric: Right, and for someone just starting a college course in this, it can feel like a massive mountain to climb. You’ve got the 220-1102—or the newer 220-1202—staring you in the face. It’s 90 questions in 90 minutes, and you need a 700 out of 900 to pass. It sounds clinical when you say it like that, but it’s actually really practical. It's about becoming that person who knows exactly what to do when a computer starts acting possessed.

Kate: Exactly! And what’s fascinating is that while Core 1 is about recognition—like, "Hey, that’s a power supply"—Core 2 is all about process. It’s about the seven steps of removing malware or the six steps of the troubleshooting methodology. You aren't just identifying things; you’re following a recipe to fix them. And if you miss a step in the recipe, the whole thing falls apart.

Cedric: It’s interesting how the exam weights reflect that. Operating systems and security are the big hitters—each taking up about 28% of the exam. So, over half the test is just those two pillars. If you master how Windows works and how to keep it safe, you’re already halfway to that certification.

Kate: And that’s what we’re going to untangle today. We're moving past the "bits and bobs" of the hardware and looking at the soul of the machine—the operating system—and how you, as a technician, become its guardian and its doctor. It’s about building that foundation so that when you step into your first help desk role, you aren’t just guessing; you’re operating with a plan. So, where should we start? Maybe with the fact that even if you're a "Mac person" or a "Linux person," you’re about to become very, very close friends with Windows.

Cedric: So, if we’re talking about day one on the job, you’re almost certainly going to be staring at a Windows screen. It’s the dominant force in the business world, and the A+ exam really leans into that. You’ve got to know the differences between Home, Pro, and Enterprise editions like the back of your hand. For example, did you know that if you’re using Windows Home, you can’t even host a Remote Desktop session?

Kate: It’s those little distinctions that trip people up! Or things like BitLocker—that full-disk encryption we all rely on—it usually requires a Pro or Enterprise edition. If you’re a technician and a user asks why they can’t encrypt their drive on a Home machine, you need to have that answer ready. It’s not a bug; it’s a feature limitation.

Cedric: And it’s not just about knowing which version has which shiny button. It’s about how you get the OS on the machine in the first place. You’ve got clean installs, which wipe everything and start fresh—great for a mess of a computer—and then you have in-place upgrades that try to keep your files and apps. But then there’s this cool concept called "zero-touch deployment" that's showing up in the newer exam versions.

Kate: Oh, zero-touch is like magic for IT departments. Imagine having to set up a hundred laptops manually. You’d be there all year! With zero-touch, you use tools like Windows Autopilot or the Microsoft Deployment Toolkit to push the OS and all the settings out over the network. The user just opens the box, logs in, and the machine configures itself. As a technician, you’re the one behind the curtain making sure that automation actually works.

Cedric: That sounds a lot more sophisticated than just sticking in a USB drive and hitting "Next" ten times. But even with all that automation, you still have to understand the "under the hood" stuff, like file systems. We’ve all heard of NTFS for Windows, but the exam is starting to ask about newer things like ReFS—the Resilient File System—which is built to handle massive amounts of data and fix its own errors.

Kate: And don't forget the non-Windows world! You might be a Windows expert, but someone is going to walk in with a MacBook running macOS Monterey or Ventura, or a Linux machine using a file system like XFS or ext4. You don't have to be a developer, but you need to know how to navigate their file structures—like the /Users folder in macOS or the /etc configuration files in Linux.

Cedric: It’s about being a polyglot, right? You need to speak the language of whatever device is in front of you. And a big part of that language is the command line. I know, I know—it looks like something out of a 90s hacker movie—but tools like ipconfig to check your network or sfc to fix corrupted system files are absolute lifesavers. If the graphical interface is frozen, the command line is often your only way to talk to the computer.

Kate: It’s your direct line to the brain of the machine. And honestly, once you learn the commands, it’s often faster than clicking through five different menus in the Control Panel. But speaking of the brain, a healthy brain needs a secure environment. We've talked about how the OS lives, but now we need to talk about how we keep people—and malware—from breaking into it.

Cedric: This is where things get really serious. Security is now tied with Operating Systems for the biggest chunk of the exam—28% of your score. And it makes sense, doesn't it? In 2026, the threats aren't just annoying pop-ups anymore. We’re talking about ransomware that can lock down a whole hospital or "stalkerware" that tracks every move a user makes.

Kate: It's a scary landscape, which is why the exam has shifted toward something called the "Zero Trust" model. It basically means: "don't trust anyone or anything by default." Even if you're already logged into the network, the system should keep verifying who you are. It’s like having a security guard who asks for your ID every time you move to a different room, not just at the front door.

Cedric: I like that analogy. And how we verify that identity has changed too. We're moving way beyond just passwords. Now we’re looking at things like TOTP—Time-based One-Time Passwords—those codes on your phone that expire in 30 seconds. Or FIDO2, which lets you use a physical security key or your fingerprint to log in without a password at all.

Kate: And it's not just the fancy tech; it's the basics that often save the day. Like the "Principle of Least Privilege." This is a big one for the exam. It means you only give a user the bare minimum access they need to do their job. If you’re the accountant, you don’t need the keys to the server room or the ability to install new software.

Cedric: Right, because if the accountant’s account gets compromised and they have admin rights, the attacker now has admin rights to everything. It’s all about limiting the "blast radius." And that extends to physical security too. The exam will ask you about things like "tailgating"—where someone follows an employee through a secure door—or "dumpster diving," which is exactly what it sounds like. People literally looking through your trash for sensitive info.

Kate: It's wild that we still have to worry about people digging through trash in the age of AI! But it’s all part of the same puzzle. As a technician, you're the "security steward." You're the one setting up BitLocker to encrypt the hard drives so that if a laptop is stolen, the data is useless. You're the one configuring the Windows Defender Firewall to block suspicious traffic.

Cedric: And you’re the one who has to know exactly what to do when the worst happens and a machine gets infected. The A+ exam is famous for its seven-step malware removal procedure. You can't just wing it; you have to know the order. First, you identify the symptoms, then you quarantine the system—pull that network cable!—and only then do you start the actual cleaning.

Kate: That quarantine step is so crucial. If you try to fix it while it’s still connected to the Wi-Fi, the malware might be sending your data to a server in another country as you're trying to delete it. It’s about being methodical. And that leads us perfectly into the third pillar of the Core 2: Troubleshooting. Because once you've secured the fortress, you've got to be the one who knows how to fix the plumbing when it breaks.

Cedric: Troubleshooting is where you really earn your keep as a technician. It’s 22% of the exam, but it’s 100% of the job when things are going sideways. And CompTIA has a very specific "Troubleshooting Methodology" they want you to use. It’s six steps, and they test it like a recipe. You start by identifying the problem—asking the user "what exactly happened?" and "what changed recently?"

Kate: That "what changed?" question is the secret weapon of every great tech. Did they just install a new update? Did they download a weird "free" PDF editor? Once you have that, you establish a theory of what’s wrong, test it, and then—this is the part people forget—you create a plan of action and implement the fix.

Cedric: And you can't just walk away once it's fixed! Step five is verifying full system functionality. There’s nothing worse than telling a user "it's fixed," only for them to find out five minutes later that now their printer doesn't work. You have to check the whole system. And then, finally, you document everything.

Kate: Documentation is the unsung hero of IT. If you fix a weird "Blue Screen of Death" and don't write down how you did it, the next tech who sees it has to start from scratch. Speaking of the Blue Screen, the exam expects you to know how to handle those big, scary errors. Are you going into Safe Mode to roll back a bad driver? Are you using "System Restore" to go back to a time before the computer went haywire?

Cedric: It’s about knowing which tool to pull out of the belt. If the computer won't even boot, you might be looking at the Recovery Environment using bootrec to fix the boot files. If it’s just one app crashing, maybe you’re looking at the Event Viewer to see the error logs. It’s a lot of detective work, tracing symptoms back to their root cause.

Kate: And the "detective work" is getting more complex because so much of what we do now is in the cloud. The newer exam versions are asking about SaaS—Software as a Service. So, if a user can’t access their email, is it their computer? Is it the Wi-Fi? Or is there a synchronization issue with their Microsoft 365 account? You have to be able to "peel back the layers" across different platforms.

Cedric: It’s not just "turn it off and on again" anymore—though that’s still a valid step! It’s about understanding the whole "trust chain." Like, if a mobile device isn’t syncing, it could be a network issue, but it could also be a policy conflict from the company’s MDM—Mobile Device Management—system. You have to think globally.

Kate: Exactly. And while you're doing all this high-level detective work, you also have to follow the "rules of the road"—the operational procedures. Because how you do the work is just as important as the fix itself. You have to be professional, you have to follow safety protocols, and you have to handle data ethically.

Cedric: Operational Procedures might only be 22% of the exam, but they’re the "don't get fired or sued" portion of the test. It covers everything from how you talk to an upset user to how you dispose of an old battery. For a college student starting out, this might seem like the "boring" part, but it’s what separates a hobbyist from a professional.

Kate: It’s the "how to be an adult in a professional environment" section. Like change management. You can’t just decide to update the company’s main server at 2:00 PM on a Tuesday without telling anyone. You have to go through the process: define the change, analyze the impact, get approval, and—this is key—have a rollback plan in case everything blows up.

Cedric: I love that "rollback plan" concept. It’s basically saying, "I think this will work, but I have a way to undo it if I’m wrong." It’s about risk management. And that extends to how we handle data. The exam covers privacy regulations like GDPR and HIPAA. If you’re working on a computer in a doctor’s office, you’re handling PHI—Protected Health Information. You can’t just leave that screen open for everyone to see.

Kate: And then there’s the physical stuff. ESD—Electrostatic Discharge. One little spark from your finger can fry a thousand-dollar motherboard. So you’ve got to know about antistatic mats and wrist straps. And basic safety—like not opening a power supply because the capacitors can hold a lethal charge even when it's unplugged.

Cedric: It’s also about the "soft skills." How do you explain a complex technical issue to someone who isn't "tech-savvy" without being condescending? The exam will literally give you scenarios where a user is angry or confused, and you have to pick the most professional response. It’s about empathy as much as it is about expertise.

Kate: It really is. And it’s about being prepared for the future, too. The latest version of the exam, the 1202, has added a whole section on AI governance. It’s asking about things like "hallucinations"—where an AI gives you a wrong answer that sounds right—and the ethical risks of putting company data into a public AI tool.

Cedric: That’s such a 2026 problem, isn’t it? As a technician, you might be the one setting the policy for how your company uses these tools. It’s about staying ahead of the curve. And speaking of staying ahead, let’s talk about the practical reality of this exam. What does it actually cost? How long should you study? What’s the "playbook" for someone who’s just starting their course?

Cedric: Alright, let’s get down to brass tacks. If you’re listening to this and you’re starting your college course, what does the road ahead actually look like? First, the cost. Each exam—Core 1 and Core 2—is about $253 to $265 USD. So, you’re looking at over $500 for the full certification. It’s not pocket change, so you want to make sure you’re ready before you hit "schedule."

Kate: Definitely. And the big mistake people make with Core 2 is thinking it’s "easier" because they already use Windows every day. But the exam doesn't care if you've been using Windows since you were five; it cares if you know the exact seven steps of malware removal in the right order. It's about procedural precision.

Cedric: So, how long should you study? If you’re a complete beginner, most people recommend about 8 to 10 weeks of dedicated study for Core 2 alone. You want to be getting at least 85% on your practice exams before you go for the real thing. And don't just watch videos! You need hands-on time. Install Windows in a Virtual Machine, break it, and then try to fix it.

Kate: That hands-on experience is huge for the PBQs—the Performance-Based Questions. These include multiple-choice, drag-and-drop, and performance-based items; they drop you into a simulated environment and say, "Configure this firewall rule" or "Fix this boot error using the command line." If you’ve never actually typed sfc /scannow into a prompt, you’re going to freeze up.

Cedric: And remember the "overlap period." Right now, you can choose between the older 1102 exam and the newer 1202 version. If you've already started studying for the 1102, you have until September 25, 2025, to pass it. After that, it’s all 1202. The newer version is a bit tougher—it adds things like AI and more cloud stuff—but it’s also more relevant to the jobs you’ll be applying for in 2026.

Kate: It’s about choosing the path that fits your timeline. If you’re starting from scratch right now, the 1202 is probably the way to go. It’ll keep your certification fresh until 2028. And once you have it, the doors really start to open. We're talking entry-level help desk roles that can pay anywhere from $40,000 to $60,000.

Cedric: And that’s just the starting line! Once you add Network+ or Security+ on top of that, your value in the market just skyrockets. But it all starts with this foundation. It’s about building that "troubleshooting mindset" where you don't just panic when things break; you follow the process.

Kate: I love that—a "troubleshooting mindset." It's about being the person who can stay calm in the middle of a digital storm. But before we wrap up, let's talk about why this actually matters beyond just passing a test. What does it look like to be an "Optimized" technician?

Cedric: We talked earlier about this "Maintenance Maturity Ladder," and I think it’s such a powerful way to look at your career. Level 1 is "Ad-hoc"—you’re just putting out fires as they happen. That’s where most people start. But as you learn these Core 2 skills, you’re moving up.

Kate: Level 2 and 3 are where you start building systems. You’re not just fixing one computer; you’re setting up automated patching for the whole company. You’re not just hoping the data is safe; you’re verifying the backups every single week. You’re moving from being "the person who fixes things" to "the person who prevents things from breaking."

Cedric: And Level 4 is "Optimized." This is where you’re using proactive monitoring and alerting with trend analysis. You’re aligned with the business goals, making sure that the technology isn't just "working," but actually helping the company grow.

Kate: That’s the goal! And the A+ Core 2 is your first big step on that ladder. It gives you the language, the tools, and the procedures to be a professional. It’s about moving beyond "I’m good with computers" to "I am a certified IT professional."

Cedric: It’s a transition, isn't it? From a hobbyist to someone who can be trusted with a company’s most valuable assets. And it's a journey that doesn't end with the A+. You'll keep learning, keep adding certifications, but you'll always come back to these core principles of OS, security, and troubleshooting.

Kate: It’s the "trifecta" that will follow you throughout your whole career. Whether you end up in cybersecurity, cloud architecture, or management, you'll still need to know how the system works and how to fix it when it doesn't. So, let's bring it all home. What’s the one thing you want our listener to take away from this?

Cedric: If there’s one thing I’ve learned from looking at all these materials, it’s that IT isn’t about being a genius who knows everything—it’s about being a professional who follows a process. The A+ Core 2 isn't just an exam; it's a blueprint for how to do the job right. It’s about being methodical, being secure, and being professional.

Kate: I couldn't agree more. It’s about building that foundation so you can handle whatever the future throws at you—whether it's a new Windows version, a weird malware strain, or a brand-new AI tool. You're learning how to learn, and that's the most valuable skill you can have in this industry.

Cedric: So, as we wrap things up, I want to ask you—the person listening to this—where are you on that Maturity Ladder right now? Are you still in the "Ad-hoc" phase, just trying to figure out which end of the screwdriver to hold? Or are you ready to start building those systems and procedures that make a real professional?

Kate: It’s an exciting place to be, at the start of this journey. The mountain might look big, but you take it one step at a time. Master the Windows editions, learn the malware removal steps, get comfortable in the command line. Before you know it, you'll be looking back from the top.

Cedric: Absolutely. And remember, the A+ is the door, not the destination. It gets you in the room, but what you do after that is up to you. Whether you move into networking with Network+ or jump into the high-stakes world of Security+, everything you do will be built on what you're learning right now.

Kate: Well said. It’s been a blast untangling this with you today. To everyone out there starting their course—you’ve got this. Stick to the process, get your hands on the tech, and don't be afraid to break things in a test environment. That’s how the best technicians are made.

Cedric: Cheers for that, Kate. And a huge thanks to you for listening. It's a lot to take in, so maybe take a moment to reflect on which of these four domains—OS, Security, Troubleshooting, and Operational Procedures—feels like your strongest suit right now, and which one you need to spend a little more time with. It's all part of the process. Good luck with the studies!