CompTIA · linux

CompTIA A+ Core 1 & 2

Hardware, networking, mobile devices, OS troubleshooting, and operational procedures. The foundational IT support certification.

14Modules
45 hoursDuration
beginnerLevel
⚡ Practice the exam 🗺️ Open Cert Quest path ← All courses

Course Modules

📱
Module 1 — Core 1
Mobile Devices
2 lessons
Laptops and phones are where every IT support shift begins. The exam tests what's field-replaceable inside a laptop (M.2 modules, SO-DIMM, ribbon-cabled keyboards/displays) versus what's soldered, then jumps to connectivity: USB-C for everything modern, Lightning as the Apple legacy, NFC/Bluetooth/IR for short-range pairing and contactless. Know what each connector can actually carry and what the range looks like in centimeters versus meters.
1.1 Laptop Hardware Components

Key Concepts

  • Laptop displays use LCD (TN, IPS, VA panels) or OLED technology with LED backlighting. Resolution ranges from 1366x768 (HD) to 3840x2160 (4K UHD). Digitizers enable touchscreen input, and replacements require careful ribbon cable disconnection.
  • Batteries and power in laptops are typically lithium-ion (Li-ion) or lithium-polymer (LiPo). Battery calibration, cycle count monitoring, and proper charging practices extend lifespan. Swollen batteries are a safety hazard and must be replaced immediately.
  • Keyboards and input devices connect via ribbon cables to the motherboard. Laptop keyboards are typically membrane-style and can be replaced individually. Trackpads use capacitive touch and may include gesture support for multi-finger input.
  • Wireless cards and expansion include Wi-Fi and Bluetooth adapters using M.2 (Key A/E) or Mini PCIe form factors. Antenna wires route through the display bezel for optimal signal. Cellular cards (WWAN) enable mobile broadband connectivity via SIM slots.
  • Memory and storage upgrades in laptops use SO-DIMM (DDR4/DDR5) modules and 2.5-inch SATA or M.2 NVMe drives. Access panels on the bottom of the laptop provide upgrade access, though some ultrabooks have soldered components that cannot be replaced.
Exam Tip: Know the difference between M.2 key types — Key B is for SATA SSDs, Key M is for NVMe SSDs, and Key A/E is for wireless cards. The exam frequently tests which components can be field-replaced in laptops versus which are soldered.
1.2 Mobile Device Connectivity & Accessories

Key Concepts

  • USB-C and Lightning connectors are the primary wired interfaces for modern mobile devices. USB-C supports USB 3.2/4.0, Thunderbolt 3/4, DisplayPort Alt Mode, and Power Delivery (up to 240W). Lightning is Apple-proprietary and limited to USB 2.0 speeds.
  • Bluetooth technology enables short-range wireless communication for peripherals (headphones, keyboards, speakers). Bluetooth 5.0+ offers improved range (up to 240m), speed (2 Mbps), and low-energy (BLE) operation for IoT devices. Pairing requires discovery mode and PIN verification.
  • NFC (Near Field Communication) operates at 13.56 MHz within a range of about 4 cm. Used for contactless payments (Apple Pay, Google Pay), quick Bluetooth pairing, and access badge systems. NFC is a passive technology that does not require battery power on the tag side.
  • Infrared (IR) blasters provide line-of-sight control of TVs, projectors, and media devices. IR communication is unidirectional and requires direct line of sight with no obstructions between sender and receiver.
  • Mobile accessories include docking stations (USB-C hubs with HDMI, Ethernet, USB-A ports), portable hotspots, styluses with pressure sensitivity, and protective cases with integrated battery packs. Wireless charging uses the Qi standard at 5W–15W.
Exam Tip: Memorize USB-C capabilities — it can carry data, video, and power simultaneously. The exam also tests NFC range (~4 cm) and Bluetooth classes (Class 1 = 100m, Class 2 = 10m). Know that IR requires line of sight while Bluetooth and NFC do not.
Key takeaways
  • M.2 key codes: Key B = SATA SSD, Key M = NVMe SSD, Key A/E = wireless card. The wrong key won't physically seat — exam scenario answer for "won't fit".
  • USB-C carries data (USB 3.2 / USB 4 / Thunderbolt), video (DisplayPort Alt Mode), and power (PD up to 240 W) on one connector. Lightning is Apple-only and capped at USB 2.0 speeds.
  • Range cheat-sheet: NFC ≈ 4 cm (contactless), Bluetooth Class 2 ≈ 10 m, IR needs line-of-sight, Wi-Fi passes through walls. Match the technology to the failure mode.
⚡ Mini-quiz — Drill M.2 key types, USB-C capabilities, and the NFC/IR/Bluetooth range cheat sheet.
Quick quiz →
🌐
Module 2 — Core 1
Networking Fundamentals
3 lessons
TCP/IP is the operating system of every IT job. The exam pins specific ports (HTTP 80, HTTPS 443, SSH 22, RDP 3389, DNS 53, SMB 445…), demands you place each device at the correct OSI layer (hub = L1, switch = L2, router = L3), and tests the private IPv4 ranges plus the IPv6 link-local prefix fe80::. The same questions show up again as troubleshooting scenarios — DHCP failure looks like APIPA, DNS failure looks like "name not resolved".
2.1 TCP/IP, Ports & Protocols

Key Concepts

  • TCP vs UDP are the two primary transport-layer protocols. TCP (Transmission Control Protocol) is connection-oriented with three-way handshake (SYN, SYN-ACK, ACK), guaranteeing reliable, ordered delivery. UDP (User Datagram Protocol) is connectionless with no delivery guarantee, used for speed-sensitive applications like DNS queries, VoIP, and video streaming.
  • Well-known ports must be memorized: HTTP (80), HTTPS (443), SSH (22), Telnet (23), DNS (53), DHCP (67/68), SMTP (25), POP3 (110), IMAP (143), FTP (20/21), SFTP (22), RDP (3389), SMB (445), SNMP (161/162), LDAP (389), LDAPS (636).
  • IPv4 addressing uses 32-bit addresses in dotted-decimal notation (e.g., 192.168.1.1). Private address ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Subnet masks define network and host portions. CIDR notation (/24 = 255.255.255.0) simplifies subnet representation.
  • IPv6 addressing uses 128-bit hexadecimal addresses (e.g., 2001:0db8::1). Link-local addresses start with fe80::, and the loopback address is ::1. IPv6 eliminates the need for NAT and uses SLAAC (Stateless Address Autoconfiguration) or DHCPv6 for address assignment.
  • The OSI model has seven layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). The TCP/IP model simplifies this into four layers: Network Access, Internet, Transport, and Application. Understanding which protocols and devices operate at each layer is critical.
Exam Tip: Port numbers are heavily tested. Create flashcards for all well-known ports. Remember that HTTPS (443), SSH (22), and SFTP (22) are encrypted, while HTTP (80), Telnet (23), and FTP (21) send data in plaintext. The exam expects you to identify which protocol to use based on the scenario.
2.2 Network Hardware

Key Concepts

  • Routers operate at Layer 3 (Network) and forward packets between different networks using IP addresses and routing tables. They perform NAT (Network Address Translation) to allow private IP addresses to communicate on the internet, and can implement ACLs (Access Control Lists) for basic traffic filtering.
  • Switches operate at Layer 2 (Data Link) and forward frames within a local network using MAC addresses and a CAM (Content Addressable Memory) table. Managed switches support VLANs, port security, spanning tree protocol (STP), and link aggregation. Unmanaged switches are plug-and-play with no configuration options.
  • Wireless access points (APs) extend the wired network to wireless clients using Wi-Fi standards: 802.11a (5 GHz, 54 Mbps), 802.11n/Wi-Fi 4 (2.4/5 GHz, 600 Mbps), 802.11ac/Wi-Fi 5 (5 GHz, 6.9 Gbps), 802.11ax/Wi-Fi 6 (2.4/5/6 GHz, 9.6 Gbps). Antenna types include omnidirectional and directional.
  • Firewalls inspect and filter traffic based on rules. Hardware firewalls sit at the network perimeter, while software firewalls run on individual hosts. Next-generation firewalls (NGFWs) add deep packet inspection, application-layer filtering, and intrusion prevention capabilities.
  • Patch panels and structured cabling organize network connections in a server room or wiring closet. Patch panels terminate horizontal cable runs and connect to switches via short patch cables. Cable types include Cat 5e (1 Gbps, 100m), Cat 6 (10 Gbps at 55m), and Cat 6a (10 Gbps at 100m).
Exam Tip: Know the OSI layer at which each device operates — hubs at Layer 1, switches at Layer 2, routers at Layer 3. The exam will test you on cable categories and their maximum speeds and distances. Remember that Cat 6 supports 10 Gbps only up to 55 meters, while Cat 6a extends this to the full 100 meters.
2.3 Network Configurations

Key Concepts

  • DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to clients via the DORA process: Discover, Offer, Request, Acknowledge. DHCP leases have configurable durations, and DHCP reservations bind a specific IP address to a MAC address for devices that need consistent addressing.
  • DNS (Domain Name System) translates domain names to IP addresses using a hierarchical system of root servers, TLD servers, and authoritative name servers. Common record types include A (IPv4), AAAA (IPv6), MX (mail), CNAME (alias), PTR (reverse lookup), TXT (SPF/DKIM), and NS (name server).
  • VLANs (Virtual Local Area Networks) logically segment a physical network into separate broadcast domains at Layer 2. VLAN tagging uses IEEE 802.1Q to identify VLAN membership on trunk ports. VLANs improve security by isolating traffic (e.g., separating guest Wi-Fi from corporate network) and reduce broadcast traffic.
  • VPN (Virtual Private Network) creates an encrypted tunnel over a public network. Site-to-site VPNs connect two networks (using IPSec), while client-to-site VPNs allow remote users to access corporate resources. Split tunneling sends only corporate-bound traffic through the VPN, while full tunneling routes all traffic through it.
Exam Tip: Memorize the DHCP DORA process and common DNS record types. The exam often presents scenarios where you must troubleshoot IP address conflicts (duplicate DHCP assignments) or DNS resolution failures. Know that APIPA addresses (169.254.x.x) indicate DHCP failure.

🖥 Field call — APIPA address, no internet

Ticket: "My computer says 'No internet access' since this morning. I haven't changed anything." Your first move is ipconfig /all: the IPv4 address shows 169.254.x.x — APIPA, meaning the DHCP handshake failed.

Walk: 1) ping 192.168.1.1 (the gateway) — times out. The client can't reach the router so routing isn't the only issue. 2) Log into the router admin → Status → DHCP client table — the device isn't listed because the pool is exhausted (50 leases, all taken by stale guest devices). 3) Free two stale leases on the router, then on the client run ipconfig /release followed by ipconfig /renew — the client immediately picks up a valid 192.168.1.x address.

Verify: ipconfig /all now shows a real IP with gateway and DNS. ping 8.8.8.8 succeeds. Document: "DHCP pool exhaustion — reduced guest lease time to 2 hours and set stale-lease threshold."

Key takeaways
  • Memorize the well-known ports cold: 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3389 RDP. Plaintext vs encrypted drives the "what should we replace" question (Telnet/23 → SSH/22).
  • APIPA 169.254.0.0/16 = DHCP failure. If a client shows that range, the DHCP server or path is broken, not the IP stack on the workstation.
  • Cable spec: Cat 6 hits 10 Gbps only to 55 m; Cat 6a extends 10 Gbps to the full 100 m. The exam loves to pin this to a "long server-room run" scenario.
⚡ Mini-quiz — Drill well-known ports, OSI-layer-to-device mapping, and APIPA-as-DHCP-failure diagnostics.
Quick quiz →
🖥
Module 3 — Core 1
Hardware
3 lessons
Inside the box: motherboard form factors (ATX / mATX / mini-ITX), Intel LGA vs AMD AM4/AM5 sockets, DDR4 vs DDR5 (different notches — not interchangeable), and PCIe lane allocation. RAID levels and the SATA-vs-NVMe split each generate their own exam cluster, and the PSU 80-Plus rating ladder plus connector inventory shows up under power.
3.1 Motherboards, CPUs & RAM

Key Concepts

  • Motherboard form factors determine the physical layout and expansion capabilities. ATX (305x244mm) is the standard full-size board with 7 expansion slots. Micro-ATX (mATX, 244x244mm) is smaller with 4 slots. Mini-ITX (170x170mm) is compact with 1 slot, ideal for small form factor builds. The form factor dictates case compatibility, power connector placement, and I/O panel layout.
  • CPU socket types must match the motherboard. Intel uses LGA (Land Grid Array) sockets such as LGA 1700 (12th–14th Gen) and LGA 1200 (10th–11th Gen). AMD uses PGA (Pin Grid Array) with AM4 and the newer LGA-based AM5 socket. Multi-core processors, hyper-threading (Intel) and SMT (AMD) allow simultaneous processing of multiple threads.
  • RAM specifications include DDR4 (1.2V, speeds 2133–3200+ MHz) and DDR5 (1.1V, speeds 4800–6400+ MHz). DIMMs are used in desktops and SO-DIMMs in laptops. Dual-channel configurations require matching pairs installed in the correct slots (typically alternating colors). ECC (Error-Correcting Code) RAM detects and corrects single-bit errors, used in servers and workstations.
  • PCIe expansion slots come in x1, x4, x8, and x16 sizes. PCIe 4.0 x16 provides approximately 32 GB/s bandwidth, while PCIe 5.0 doubles that. Graphics cards use x16 slots, NVMe SSDs use x4 (via M.2), and network cards typically use x1 or x4. PCIe is backward and forward compatible — a smaller card works in a larger slot.
  • BIOS/UEFI firmware initializes hardware during POST (Power-On Self-Test) and hands off to the operating system boot loader. UEFI replaces legacy BIOS with a graphical interface, support for drives larger than 2.2 TB (GPT), Secure Boot to prevent unauthorized OS loading, and faster boot times. Firmware updates (flashing) should be performed carefully to avoid bricking the board.
Exam Tip: Know that DDR4 and DDR5 are not interchangeable due to different notch positions. The exam tests UEFI features like Secure Boot and TPM integration. Remember that ATX uses a 24-pin main power connector and an 8-pin CPU power connector.
3.2 Storage Devices

Key Concepts

  • Hard disk drives (HDDs) use spinning magnetic platters and read/write heads. They come in 3.5-inch (desktop) and 2.5-inch (laptop) form factors, with speeds of 5400 RPM (low power) or 7200 RPM (standard performance). HDDs connect via SATA III (6 Gbps) and remain cost-effective for bulk storage but are vulnerable to mechanical failure from drops or vibration.
  • Solid-state drives (SSDs) use NAND flash memory with no moving parts, offering dramatically faster read/write speeds and greater durability. SATA SSDs connect via the same SATA III interface (limited to ~550 MB/s). NVMe SSDs use the M.2 form factor with PCIe lanes, achieving sequential reads of 3500+ MB/s (PCIe 3.0) or 7000+ MB/s (PCIe 4.0).
  • RAID configurations combine multiple drives for redundancy or performance. RAID 0 (striping) splits data across drives for speed but offers no redundancy. RAID 1 (mirroring) duplicates data on two drives. RAID 5 (striping with parity) requires 3+ drives and can survive one drive failure. RAID 10 (1+0) combines mirroring and striping, requiring 4+ drives, providing both speed and redundancy.
  • Drive interfaces and installation vary by type. SATA uses a 7-pin data cable and 15-pin power connector. M.2 slots accept different key types (B key for SATA, M key for NVMe). Hot-swapping is supported by SATA and SAS in server environments. Drive partitioning uses MBR (up to 4 primary partitions, 2 TB max) or GPT (128+ partitions, 9.4 ZB max, requires UEFI).
Exam Tip: RAID is a top exam topic. Remember: RAID 0 = no redundancy, RAID 1 = mirroring (50% usable capacity), RAID 5 = parity (one drive can fail), RAID 10 = mirror + stripe (minimum 4 drives). Know that NVMe SSDs are significantly faster than SATA SSDs because they bypass the AHCI protocol bottleneck.
3.3 Power Supplies & Peripherals

Key Concepts

  • Power supply unit (PSU) ratings follow the 80 Plus certification system: 80 Plus (80% efficiency), Bronze (82%), Silver (85%), Gold (87%), Platinum (89%), Titanium (92%). Higher efficiency means less wasted energy as heat, lower electricity costs, and quieter operation due to reduced cooling demands.
  • Modular vs non-modular PSUs affect cable management and airflow. Fully modular PSUs allow you to connect only the cables you need, improving airflow and aesthetics. Semi-modular PSUs have fixed essential cables (24-pin, CPU) with optional peripheral cables. Non-modular PSUs have all cables permanently attached.
  • Wattage calculation requires adding the power draw of all components (CPU TDP, GPU TDP, RAM, drives, fans) and adding a 20–30% headroom margin. An online PSU calculator can estimate requirements. A typical gaming PC needs 550–750W, while a high-end workstation may require 850W+. Insufficient wattage causes random shutdowns, instability, or failure to POST.
  • Peripheral connectivity includes USB (Type-A, Type-C, Micro-B), video outputs (HDMI 2.1, DisplayPort 1.4, DVI, VGA), and audio (3.5mm jack, S/PDIF optical). Printers connect via USB, Ethernet, or Wi-Fi and require appropriate drivers. Multi-function devices combine printing, scanning, copying, and faxing in one unit.
Exam Tip: Be prepared for questions about PSU connector types: 24-pin ATX motherboard, 4/8-pin CPU, 6/8-pin PCIe (GPU), SATA power (15-pin), and Molex (4-pin legacy). The exam tests your ability to calculate whether a PSU can handle a given component configuration.

🖥 Field call — POST beep loop after RAM upgrade

Ticket: "Tech just upgraded Bob's RAM from 8 GB to 32 GB. Now the PC won't boot — just continuous beeping." Continuous beeps = RAM failure signal on AMI/Phoenix BIOS.

Walk: 1) Power off and unplug. Put on an anti-static wrist strap. 2) Visually confirm: are the new sticks DDR4? Check the board spec — DDR4 and DDR5 have different notch positions and won't seat in the wrong slot. 3) Remove all sticks. Re-seat one stick in Slot 1 (the first channel slot per the motherboard manual — usually the slot furthest from the CPU). 4) Boot — one short beep, POST completes. 5) Add the second stick in its paired dual-channel slot (Slot 3 per the manual). Boot again — success.

Verify: Task Manager → Performance → Memory shows 32 GB at Dual Channel. Document: "RAM mis-seated after upgrade — re-seated both sticks in correct dual-channel slots per motherboard manual."

Key takeaways
  • RAID cheat-sheet: 0 stripe (no redundancy), 1 mirror (50% usable), 5 stripe + parity (3+ drives, one can fail), 10 mirror + stripe (4+ drives, fast and safe).
  • NVMe via PCIe 4.0 ≈ 7000 MB/s — roughly 10× a SATA SSD because it bypasses the AHCI bottleneck. Use NVMe when boot or asset-load time matters.
  • UEFI gives you Secure Boot, GPT partitioning (drives > 2.2 TB), and faster POST than legacy BIOS — the exam tests these features by name and pairs them with TPM 2.0 for BitLocker.
⚡ Mini-quiz — Drill RAID levels, NVMe vs SATA throughput, and UEFI's Secure Boot + GPT advantages.
Quick quiz →
☁️
Module 4 — Core 1
Virtualization & Cloud
2 lessons
Type 1 hypervisors (ESXi, Hyper-V, KVM) run on bare metal — production. Type 2 (VirtualBox, VMware Workstation) run on top of a host OS — labs and dev. Cloud splits into three letters: IaaS (you manage OS + apps), PaaS (you manage apps only), SaaS (you just use it), each on a public / private / hybrid / community deployment. The exam reads as "responsibility shift" pop quizzes.
4.1 Hypervisors & Virtual Machines

Key Concepts

  • Type 1 (bare-metal) hypervisors run directly on hardware without a host OS, providing superior performance and security. Examples include VMware ESXi, Microsoft Hyper-V (as a server role), and Citrix XenServer. Type 1 hypervisors are the standard in enterprise data centers and require hardware virtualization support (Intel VT-x or AMD-V).
  • Type 2 (hosted) hypervisors run as applications on top of a host operating system. Examples include VMware Workstation, Oracle VirtualBox, and Parallels Desktop. Type 2 hypervisors are ideal for development, testing, and training environments but add overhead from the host OS layer, resulting in lower performance compared to Type 1.
  • Virtual machine resource allocation involves assigning vCPUs, RAM, virtual disk space, and virtual network adapters to each VM. Over-provisioning (allocating more total resources than physically available) is possible because not all VMs peak simultaneously, but requires careful monitoring to prevent contention and performance degradation.
  • VM snapshots and clones capture the state of a VM at a specific point in time, enabling quick rollback after failed updates or testing. Snapshots should not be used as long-term backups because they grow over time and degrade performance. Cloning creates an independent copy of a VM for rapid deployment of identical environments.
Exam Tip: The key distinction is that Type 1 runs ON the hardware (better for production) and Type 2 runs ON an OS (better for testing). Know that virtualization requires CPU support (VT-x/AMD-V) enabled in BIOS/UEFI. Expect scenario questions about when to use snapshots vs full backups.
4.2 Cloud Models & Services

Key Concepts

  • Cloud service models define the level of management responsibility. IaaS (Infrastructure as a Service) provides virtual machines, storage, and networking — you manage the OS and applications (e.g., AWS EC2, Azure VMs). PaaS (Platform as a Service) adds runtime and middleware management (e.g., Heroku, Azure App Service). SaaS (Software as a Service) delivers fully managed applications (e.g., Microsoft 365, Google Workspace).
  • Cloud deployment models determine who can access the infrastructure. Public cloud is shared among multiple tenants and managed by the provider (AWS, Azure, GCP). Private cloud is dedicated to a single organization, on-premises or hosted. Hybrid cloud combines public and private, allowing workloads to move between them. Community cloud is shared among organizations with common requirements (e.g., healthcare, government).
  • Cloud characteristics include on-demand self-service, broad network access, resource pooling, rapid elasticity (auto-scaling), and measured service (pay-per-use). These characteristics, defined by NIST, distinguish true cloud computing from traditional hosting and enable organizations to scale resources up or down in response to demand.
  • Shared responsibility model divides security duties between the cloud provider and customer. The provider is responsible for security OF the cloud (physical data centers, hypervisor, network infrastructure), while the customer handles security IN the cloud (data, access controls, OS patching in IaaS, application configuration in PaaS).
Exam Tip: Be able to classify services into IaaS, PaaS, or SaaS based on descriptions. The exam tests the shared responsibility model — know that in SaaS the provider handles almost everything, while in IaaS the customer handles more. Remember the four deployment models: public, private, hybrid, community.
Key takeaways
  • Type 1 hypervisors are for production (no host-OS overhead, hardware virtualization required); Type 2 are for labs and developer machines.
  • Responsibility ladder: IaaS = you patch the OS; PaaS = the provider patches OS and runtime; SaaS = the provider runs everything. The exam asks "who is responsible for X" — pick by service tier.
  • Snapshots ≠ backups: they live on the same storage as the VM, grow over time, and disappear with the host. Real backups land off-host (3-2-1).
⚡ Mini-quiz — Drill Type 1 vs Type 2 hypervisors, the IaaS/PaaS/SaaS responsibility split, and the snapshot-isn't-a-backup pitfall.
Quick quiz →
🔧
Module 5 — Core 1
Troubleshooting Hardware & Networking
2 lessons
CompTIA bakes its 7-step troubleshooting methodology into 15-20% of the exam: identify → theorize → test → plan → implement → verify → document. Hardware symptoms (POST beep codes, overheat throttling, S.M.A.R.T. warnings) and network symptoms (no link, APIPA, DNS-resolution failure) each have signature patterns the exam pins to a specific next-step answer.
5.1 CompTIA Troubleshooting Methodology

Key Concepts

  • Step 1: Identify the problem by gathering information from the user, questioning them about recent changes, reviewing logs, and reproducing the issue if possible. Determine the scope (single user, department, or entire network) and identify any environmental or infrastructure changes that may have occurred.
  • Step 2: Establish a theory of probable cause by starting with the most common or simplest explanation first (Occam’s Razor). Consider multiple possibilities, research symptoms online or in knowledge bases, and question the obvious before jumping to complex theories.
  • Step 3: Test the theory to determine the cause. If the theory is confirmed, determine the next steps to resolve. If the theory is not confirmed, establish a new theory or escalate to a senior technician. Testing may involve substituting components, disabling services, or checking configurations.
  • Steps 4–6: Plan, implement, verify — establish a plan of action to resolve the problem and implement the solution (with a rollback plan). Verify full system functionality and, if applicable, implement preventive measures such as updated drivers, firmware patches, or configuration hardening.
  • Step 7: Document findings including the problem description, steps taken, root cause, resolution, and preventive measures. Documentation builds a knowledge base for future troubleshooting and is essential for change management, compliance auditing, and training new technicians.
Exam Tip: CompTIA loves this methodology and tests it frequently. Memorize all seven steps in order: Identify, Theory, Test, Plan, Implement, Verify, Document. Scenario-based questions will ask what you should do FIRST, NEXT, or LAST in a troubleshooting situation.
5.2 Common Hardware & Network Issues

Key Concepts

  • POST failures and beep codes indicate hardware problems during startup. Continuous beeps typically signal a RAM issue, one long beep with two or three short beeps indicates a video card problem. No video output can mean a dead GPU, unseated RAM, or a failed power supply. Check the motherboard manual for manufacturer-specific beep code meanings.
  • Overheating symptoms include unexpected shutdowns, blue screens (BSOD), system instability, and throttled performance. Causes include failed fans, dried thermal paste, blocked vents, and dust accumulation. Use temperature monitoring software to verify. Reapplying thermal paste and cleaning heatsinks are common resolutions.
  • Network connectivity issues manifest as no internet, slow speeds, or intermittent drops. Troubleshoot methodically: check physical connections and link lights, verify IP configuration (ipconfig/ifconfig), test local connectivity (ping gateway), test DNS resolution (nslookup), test external connectivity (ping 8.8.8.8). An APIPA address (169.254.x.x) indicates DHCP failure.
  • Storage drive failures present as clicking noises (HDD mechanical failure), boot errors ("No boot device found"), corrupted files, or S.M.A.R.T. warnings. SSDs may fail silently with read-only mode as end-of-life behavior. Regular S.M.A.R.T. monitoring, proper backups, and RAID configurations mitigate data loss risks.
Exam Tip: The exam frequently asks about diagnosing no-boot scenarios. Work through the troubleshooting methodology: check power first (fans spinning, lights on), then POST (beep codes), then boot device (BIOS boot order). For network issues, always start with the physical layer and work up the OSI model.

🖥 Applying the 7-step method — floor printer suddenly offline

Ticket: "All 12 people on the marketing floor can't print since 9 AM." Scope = entire floor = not a single-user issue.

Walk: 1) Identify — ask what changed: "IT ran DHCP renewals last night." 2) Theorize — printer lost its old lease and picked up a new IP. 3) Test — ping printer-mktg fails; nslookup printer-mktg returns the old IP; check the DHCP client table on the router — the printer's current address is 10.0.1.52 (was 10.0.1.20). 4) Plan — assign a static IP and update DNS to prevent recurrence; notify marketing of a 2-minute outage window. 5) Implement — log into the printer web UI, assign 10.0.1.20/24 static, set gateway and DNS. 6) Verify — test print from three different workstations. 7) Document — "Printer lost DHCP lease after nightly renewal; converted to static with DHCP reservation."

Key takeaways
  • The methodology IS the answer: identify → theorize → test → plan → implement → verify → document. "Document" is always the last step in scenario questions — never skip it.
  • Network "no internet" tree: link light → IP via ipconfig/ip a → ping the gateway → nslookup a known name. Stop at the first failure — that's where the root cause sits.
  • Hardware POST: one beep ≈ OK on most BIOSes; repeating beeps = RAM or video. Re-seat RAM and try a known-good monitor before blaming the motherboard.
⚡ Mini-quiz — Drill the 7-step troubleshooting flow, the ipconfig → ping → nslookup tree, and POST-beep diagnostics.
Quick quiz →
💻
Module 6 — Core 2
Operating Systems
3 lessons
Windows editions (Home / Pro / Pro for Workstations / Enterprise) split by feature, not version number — BitLocker, Group Policy, RDP host, and domain join all live above Home. The CLI portion is non-negotiable: ipconfig, ping, tracert, sfc /scannow, chkdsk, gpupdate. macOS Time Machine, FileVault, and APFS plus Linux package managers (apt vs dnf) round out cross-platform questions.
6.1 Windows Editions & Features

Key Concepts

  • Windows editions differ in feature sets. Home is for consumers and lacks Group Policy, BitLocker, Remote Desktop host, and domain join. Pro adds Group Policy, BitLocker, Remote Desktop, Hyper-V, and domain join. Enterprise adds advanced security (AppLocker, Credential Guard, DirectAccess) and volume licensing features. Education mirrors Enterprise with academic licensing.
  • Workgroups vs domains are two network models. Workgroups are decentralized peer-to-peer networks where each computer maintains its own local user accounts — suitable for small networks (under 10 devices). Domains use Active Directory (AD) with a centralized domain controller for authentication, group policy, and resource management, scaling to thousands of users.
  • Windows installation methods include USB boot media (created with Media Creation Tool), PXE (Preboot Execution Environment) network boot for mass deployment, and Windows Deployment Services (WDS). Unattended installations use answer files (unattend.xml) for automated configuration. In-place upgrades preserve user data and applications, while clean installs provide a fresh start.
  • Windows features and tools include Task Manager (performance monitoring, process management), Device Manager (hardware drivers), Disk Management (partition creation, volume extension), and msconfig (boot configuration, startup services). The Control Panel and Settings app manage system configuration, network settings, user accounts, and Windows Update.
Exam Tip: Know which features are exclusive to Pro/Enterprise: BitLocker, Group Policy (gpedit.msc), Remote Desktop host, domain join, and Hyper-V. The exam often asks which Windows edition supports a specific feature. Home edition is the most limited.
6.2 Windows Command-Line Tools

Key Concepts

  • Network commands are essential for troubleshooting. ipconfig /all displays full TCP/IP configuration, ipconfig /release and /renew reset DHCP leases, ipconfig /flushdns clears the DNS resolver cache. ping tests connectivity, tracert traces the route packets take, nslookup queries DNS servers, and netstat -an shows all active connections and listening ports.
  • System maintenance commands keep Windows healthy. sfc /scannow scans and repairs protected system files. DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows component store. chkdsk /f fixes file system errors, chkdsk /r locates bad sectors and recovers readable data. These commands often require administrator privileges.
  • Group Policy commands manage domain and local policies. gpupdate /force immediately refreshes all Group Policy settings. gpresult /r displays the Resultant Set of Policy (RSoP) for the current user and computer, showing which GPOs are applied. These are critical for troubleshooting policy deployment issues in domain environments.
  • PowerShell extends command-line capabilities with cmdlets following a Verb-Noun syntax (Get-Process, Set-ExecutionPolicy, New-Item). PowerShell supports piping, scripting, and remote management (Enter-PSSession, Invoke-Command). Key cmdlets include Get-EventLog, Get-Service, Test-NetConnection, and Get-WmiObject for system administration tasks.
Exam Tip: Command-line questions are very common. Know the exact syntax: sfc /scannow (not sfc /scan), ipconfig /flushdns, chkdsk /f /r, gpupdate /force. The exam tests what each command does and when to use it. Remember that DISM must be run before sfc if the component store is corrupted.
6.3 macOS & Linux Basics

Key Concepts

  • macOS fundamentals include Finder (file manager), System Preferences/Settings, Spotlight (search), Time Machine (automated backups), FileVault (full disk encryption), and Keychain Access (password management). macOS uses the APFS (Apple File System) for SSDs, supporting snapshots, encryption, and space sharing across volumes.
  • Linux terminal essentials include navigation commands (ls, cd, pwd, mkdir, rmdir), file operations (cp, mv, rm, cat, nano/vi), and permission management (chmod, chown). The Linux file system hierarchy starts at / (root) with /home (user directories), /etc (configuration), /var (logs), /tmp (temporary), and /bin (essential binaries).
  • Package management varies by distribution. Debian/Ubuntu uses apt (apt update, apt upgrade, apt install package-name) with .deb packages. Red Hat/CentOS/Fedora uses yum or dnf with .rpm packages. Package managers handle dependency resolution, updates, and removal automatically from configured repositories.
  • File systems across platforms differ significantly. Windows uses NTFS (permissions, encryption, compression, journaling) and FAT32 (legacy, 4 GB file size limit). macOS uses APFS (SSD-optimized) and HFS+ (legacy). Linux commonly uses ext4 (journaling, up to 1 EB volume size) and XFS (high-performance, scalable). exFAT is the cross-platform choice for USB drives (no file size limit like FAT32).
Exam Tip: Know the default file systems for each OS: Windows = NTFS, macOS = APFS, Linux = ext4. The exam tests basic Linux commands (ls, cd, chmod, grep, sudo) and the difference between apt and yum. Remember that FAT32 has a 4 GB file size limit, making exFAT better for large files on removable media.

🖥 Windows repair chain — SFC fails after a botched update

Ticket: "Windows Update failed at 45% last night. Some apps won't open. I ran SFC but it said it couldn't fix all errors."

Why SFC failed: SFC draws from the Windows Component Store. If the store itself is corrupt (which a failed update can cause), SFC can't self-heal. Fix order is DISM first, then SFC.

Walk: 1) Open an elevated command prompt (right-click → Run as Administrator). 2) DISM /Online /Cleanup-Image /RestoreHealth — downloads a clean copy of the component store from Windows Update (5–15 min). 3) Once DISM finishes at 100.0%, run sfc /scannow — now it can access a valid store and actually repair protected files. 4) Reboot. If drive errors are suspected, schedule chkdsk C: /f /r at the next boot (type Y when prompted). 5) Reboot and verify that the previously broken apps launch.

Verify: Second sfc /scannow run reports no integrity violations. Document: "Component store corrupt after failed update; repaired via DISM → SFC → CHKDSK sequence."

Key takeaways
  • BitLocker + Group Policy + RDP-host = Pro and up. Windows Home can't join a domain or run BitLocker — the exam answer is "upgrade to Pro" for any AD-joined or encrypted-disk scenario.
  • Repair stack order: DISM /Online /Cleanup-Image /RestoreHealth → sfc /scannow → chkdsk /f /r. DISM repairs the component store that sfc depends on; running them out of order is the trap answer.
  • Default filesystems: Windows = NTFS, macOS = APFS, Linux = ext4. FAT32 caps single files at 4 GB — use exFAT for cross-platform USB drives that need to hold a movie file.
⚡ Mini-quiz — Drill Windows-edition features, the DISM → SFC → CHKDSK repair order, and macOS/Linux filesystem equivalents.
Quick quiz →
🔒
Module 7 — Core 2
Security Concepts
2 lessons
Physical security (bollards, mantraps, badge readers, biometrics, CCTV) gates the building; logical security (firewalls, IDS/IPS, ACLs, MFA, least privilege) gates the data. The exam pairs a threat with the matching control — vehicle ramming → bollards, tailgating → mantrap, lateral movement → segmentation + least privilege.
7.1 Physical Security

Key Concepts

  • Bollards are short, sturdy posts installed around building perimeters to prevent vehicle-borne attacks. They can be fixed (permanent), removable, or retractable (hydraulic). Bollards are the first line of physical defense for high-value facilities, data centers, and government buildings where vehicle ramming is a threat.
  • Badges and access control systems use proximity cards, smart cards, or biometric readers to restrict facility access. Badge readers log entry and exit times, creating an audit trail. Tailgating (following an authorized person through a secured door) is countered by security awareness training, mantrap/airlock systems, and anti-passback features that require both entry and exit badge scans.
  • Mantraps (airlocks) are small rooms with two interlocking doors where the second door does not open until the first is closed and locked. This ensures only one authenticated person enters at a time, effectively preventing tailgating and piggybacking. Modern access vestibules may include weight sensors and camera verification.
  • Video surveillance and locks provide detection and deterrence. CCTV cameras (IP-based or analog) monitor entrances, server rooms, and parking areas with motion detection and night vision capabilities. Locks range from traditional key locks (easily defeated by lock picking) to electronic cipher locks (PIN-based), biometric locks (fingerprint, retinal scan), and cable locks for laptops (Kensington lock slots).
Exam Tip: Physical security questions often involve identifying the correct control for a given scenario. Know that mantraps prevent tailgating, bollards prevent vehicle attacks, and cable locks secure laptops. The exam distinguishes between deterrent controls (cameras, signs) and preventive controls (locks, bollards, mantraps).
7.2 Logical Security

Key Concepts

  • Firewalls filter traffic based on source/destination IP, port numbers, and protocols. Host-based firewalls (Windows Defender Firewall, iptables) protect individual machines, while network-based firewalls protect entire network segments. Stateful firewalls track connection states and only allow return traffic for established sessions, providing stronger security than stateless packet filters.
  • IDS/IPS (Intrusion Detection/Prevention Systems) monitor network traffic for malicious patterns. IDS is passive and generates alerts without blocking traffic, while IPS is inline and actively blocks detected threats. Both use signature-based detection (matching known patterns) and anomaly-based detection (flagging deviations from normal baselines). UTM (Unified Threat Management) appliances combine firewall, IDS/IPS, antivirus, and content filtering in one device.
  • Access Control Lists (ACLs) define rules that permit or deny traffic based on criteria like source/destination IP, protocol, and port number. ACLs are applied to router interfaces and firewall rules, processed top-down (first match wins), and should always end with an implicit deny rule to block any traffic not explicitly permitted.
  • Principle of least privilege dictates that users, applications, and services should be granted only the minimum permissions required to perform their functions. This limits the blast radius of compromised accounts, reduces accidental data exposure, and is enforced through proper group membership, file permissions (NTFS ACLs), and application-level role-based access.
Exam Tip: Know the difference between IDS (detects and alerts) and IPS (detects and blocks). The exam tests firewall concepts including stateful vs stateless inspection. Remember that ACLs are processed top-down and that the principle of least privilege should guide all access control decisions.
Key takeaways
  • Mantraps stop tailgating (interlocked doors, one person at a time). Bollards stop vehicle ramming. Cable locks (Kensington) tether laptops. Match the control to the threat.
  • IDS = detect + alert (passive); IPS = detect + block (inline). UTM bundles firewall + IDS/IPS + AV + content filter into one appliance.
  • Principle of least privilege: grant exactly the permissions needed, no more. The exam frames over-privileged service accounts as a top-tier vulnerability.
⚡ Mini-quiz — Drill mantrap/bollard/cable-lock mapping, IDS vs IPS, and least-privilege framing.
Quick quiz →
⚠️
Module 8 — Core 2
Malware & Social Engineering
2 lessons
Malware categories each have a tell: viruses need a host file, worms self-spread across networks, trojans hide inside legit software, ransomware encrypts data, rootkits persist in the kernel, cryptominers burn CPU/GPU. Social-engineering attacks target people, not systems — the vector (email / phone / SMS / physical) defines the term.
8.1 Malware Types & Removal

Key Concepts

  • Viruses require user action to execute and attach themselves to legitimate files or programs, replicating when the host file is run. Worms are self-replicating and spread across networks without user interaction by exploiting vulnerabilities in services. Trojans disguise themselves as legitimate software but perform malicious actions like creating backdoors once executed.
  • Ransomware encrypts the victim's files and demands payment (typically cryptocurrency) for the decryption key. Modern ransomware uses double extortion — encrypting data AND threatening to publish stolen data. Rootkits hide deep in the OS (kernel-level or firmware-level), making them extremely difficult to detect and requiring specialized removal tools or complete OS reinstallation.
  • Spyware and keyloggers covertly monitor user activity. Spyware tracks browsing habits and collects personal data for advertising or theft. Keyloggers record every keystroke to capture passwords, credit card numbers, and messages. Cryptominers hijack system resources (CPU/GPU) to mine cryptocurrency, causing degraded performance, high CPU usage, and increased electricity consumption.
  • Malware removal process follows a specific order: (1) Identify and research malware symptoms, (2) Quarantine the infected system by disconnecting from the network, (3) Disable System Restore to prevent reinfection from restore points, (4) Remediate using updated anti-malware tools in Safe Mode, (5) Schedule full scans and delete infected files, (6) Re-enable System Restore and create a new restore point, (7) Educate the user on safe practices.
Exam Tip: The malware removal steps are tested in order. Remember to quarantine FIRST (disconnect from network), then remediate in Safe Mode. Know the differences between each malware type — the exam gives symptoms and expects you to identify the malware. Rootkits may require boot-level scanning or OS reinstallation to remove.
8.2 Social Engineering Attacks

Key Concepts

  • Phishing uses fraudulent emails that impersonate trusted organizations to trick users into clicking malicious links or providing credentials. Spear phishing targets specific individuals using personal information for credibility. Whaling targets executives and high-value individuals. All phishing attacks exploit urgency, authority, and trust to bypass rational decision-making.
  • Vishing and smishing extend phishing beyond email. Vishing (voice phishing) uses phone calls with spoofed caller IDs, often impersonating banks, tech support, or government agencies. Smishing (SMS phishing) sends text messages with malicious links, often claiming package delivery issues, account suspensions, or prize winnings to trick recipients into responding.
  • Tailgating and shoulder surfing are physical social engineering attacks. Tailgating (piggybacking) means following an authorized person through a secured door without badging in. Shoulder surfing involves observing someone entering passwords, PINs, or sensitive data by looking over their shoulder, using binoculars, or positioning cameras. Privacy screens on monitors and awareness training are key defenses.
  • Dumpster diving involves searching through an organization's trash for sensitive documents, hardware with data, or information useful for social engineering (org charts, phone lists, account numbers). Countermeasures include shredding (cross-cut preferred over strip-cut), secure disposal bins, and clear-desk policies. Proper e-waste disposal includes wiping or physically destroying storage media.
Exam Tip: Be able to identify the type of social engineering based on the scenario description. Key indicators: email = phishing, phone call = vishing, text message = smishing, following someone through a door = tailgating, watching someone type = shoulder surfing, searching trash = dumpster diving.

🖥 Field call — browser hijacker + adware

Ticket: "My search engine changed to 'SearchPulse', new toolbars appeared, and there are pop-ups every few minutes."

Walk: 1) Identify — symptoms match a browser hijacker / adware bundle, likely installed via a freeware "custom install" that was clicked through. 2) Quarantine — disconnect from the network immediately (pull Ethernet cable, disable Wi-Fi) to stop any C2 callbacks or lateral spread. 3) Disable System Restore (Control Panel → System → System Protection) — malware can hide in restore points and reinfect after removal. 4) Remediate in Safe Mode — reboot to Safe Mode with Networking; update Malwarebytes definitions; run a full scan; quarantine and delete all detections. 5) Clean the browser — remove all unfamiliar extensions; reset homepage and default search engine. 6) Re-enable System Restore and create a fresh, clean restore point. 7) Educate — show the user the "custom install" option and where to uncheck bundled extras.

Verify: Browser opens to the correct homepage with no toolbars; CPU usage is normal; no ads. Document malware names found and all steps taken.

Key takeaways
  • Removal order: identify → quarantine (disconnect from the network) → disable System Restore → remediate in Safe Mode → re-enable Restore → educate the user. Skipping "disconnect" is the exam's favorite wrong answer.
  • Phishing taxonomy: phishing = mass email, spear-phishing = targeted, whaling = exec-targeted, vishing = voice/phone, smishing = SMS. The vector names the term.
  • Ransomware is defeated by tested, offline backups; paying the ransom is never the exam-correct answer because it funds the attacker and doesn't guarantee a decryption key.
⚡ Mini-quiz — Drill malware categories, the disconnect-first removal flow, and phishing/vishing/smishing terminology.
Quick quiz →
🛡️
Module 9 — Core 2
Windows Security
2 lessons
Windows accounts split into Administrator / Standard / Guest, with NTFS permission inheritance, UAC for elevation prompts, and Group Policy / Local Security Policy for password complexity and lockout. The built-in defense stack is Defender + Firewall + BitLocker — all free, all on by default, and all tested by name on the exam.
9.1 User Account Management

Key Concepts

  • User Account Control (UAC) is a Windows security feature that prevents unauthorized changes to the system by prompting for administrator approval when an action requires elevated privileges. UAC levels range from "Always Notify" (most secure) to "Never Notify" (least secure). UAC protects against malware that attempts to silently install or modify system settings.
  • Local vs domain accounts serve different purposes. Local accounts are stored in the SAM (Security Account Manager) database on the individual machine and provide access only to that computer. Domain accounts are stored in Active Directory, authenticated by the domain controller, and provide single sign-on access to network resources across the entire domain.
  • Password policies enforce security requirements for credentials. Key settings include minimum length (12+ characters recommended), complexity requirements (uppercase, lowercase, numbers, symbols), maximum age (requiring periodic changes), password history (preventing reuse of recent passwords), and account lockout threshold (locking after N failed attempts to prevent brute-force attacks).
  • Account types and groups control privilege levels. The built-in Administrator account has full system access and should be renamed and disabled when not in use. Standard user accounts operate with limited privileges. Groups (Administrators, Users, Power Users, Remote Desktop Users) simplify permission management by assigning rights to groups rather than individual users.
Exam Tip: UAC prompts are different for admin vs standard users — admins see a consent prompt, standard users see a credential prompt. Know that domain accounts use Active Directory (centralized) while local accounts use the SAM database (per machine). The exam tests password policy settings configurable through Group Policy or Local Security Policy (secpol.msc).
9.2 Windows Security Tools

Key Concepts

  • BitLocker provides full-disk encryption for Windows Pro and Enterprise editions. It uses AES encryption (128-bit or 256-bit) and requires a TPM (Trusted Platform Module) chip to store the encryption key securely, or can use a USB startup key as an alternative. BitLocker To Go encrypts removable USB drives. Recovery keys must be saved to Active Directory, Microsoft Account, or printed for emergency access.
  • EFS (Encrypting File System) provides file-level encryption on NTFS volumes, protecting individual files and folders rather than entire drives. EFS is tied to the user's Windows account — only the user who encrypted the files (and designated recovery agents) can decrypt them. EFS and BitLocker can be used together for layered protection.
  • Windows Defender is the built-in antivirus and antimalware solution that provides real-time protection, cloud-delivered protection, and automatic sample submission. Windows Defender Firewall controls inbound and outbound network traffic with rules configurable per network profile (Domain, Private, Public). Windows Security Center provides a unified dashboard for virus protection, firewall, device security, and family options.
  • Windows Update and security patches are critical for closing vulnerabilities. Windows Update delivers security patches, feature updates, and driver updates. Group Policy controls update behavior in enterprise environments. WSUS (Windows Server Update Services) provides centralized patch management, allowing IT to approve, test, and deploy updates across the organization before rollout.
Exam Tip: BitLocker requires TPM + Windows Pro/Enterprise — it is NOT available on Home edition. Know that EFS is file-level (NTFS only) while BitLocker is volume-level. The exam tests Windows Defender Firewall profiles: Domain (joined to domain), Private (trusted home/work), Public (coffee shop, airport — most restrictive).
Key takeaways
  • NTFS permissions are cumulative across group memberships, but Deny overrides Allow. A user inheriting "Allow Read" from one group and "Deny Read" from another loses access.
  • UAC isn't optional in production — disabling it kills the privilege boundary every modern Windows defense leans on. The exam answer is "leave UAC on".
  • BitLocker = volume-level (Pro+, TPM-backed); EFS = file-level on NTFS (per-user keys). Defender Firewall profiles: Domain / Private / Public (Public is the most restrictive).
⚡ Mini-quiz — Drill NTFS Allow/Deny precedence, the UAC privilege boundary, and BitLocker vs EFS scope.
Quick quiz →
📡
Module 10 — Core 2
Mobile & Embedded Device Security
2 lessons
Phones and tablets are governed by MDM (whole-device control: passcode, remote wipe, encryption, app allow-list) and MAM (app-level control for BYOD containers). IoT and embedded systems (cameras, thermostats, SCADA controllers) usually can't run modern AV — so the standard control is network segmentation plus default-credential change plus firmware updates.
10.1 Mobile Device Management

Key Concepts

  • MDM (Mobile Device Management) allows organizations to centrally manage, configure, and secure mobile devices. MDM solutions (Microsoft Intune, VMware Workspace ONE, Jamf) enforce security policies including password requirements, encryption, app restrictions, and network configurations. Devices can be enrolled manually or automatically through zero-touch enrollment programs.
  • MAM (Mobile Application Management) focuses on securing and managing specific applications rather than the entire device. MAM is particularly useful for BYOD (Bring Your Own Device) scenarios where the organization needs to protect corporate data within apps without controlling the employee's personal device. App wrapping and containerization isolate corporate data from personal data.
  • BYOD vs COPE deployment models define device ownership. BYOD allows employees to use personal devices for work, reducing hardware costs but increasing security challenges. COPE (Corporate-Owned, Personally Enabled) provides company-owned devices that employees can also use for personal tasks, giving IT more control. CYOD (Choose Your Own Device) lets employees select from approved company-purchased devices.
  • Remote wipe and screen locks are critical security features. Remote wipe erases all data on a lost or stolen device to prevent unauthorized access. Screen lock methods include PIN (4–6 digits), pattern, password, fingerprint, facial recognition, and iris scanning. Failed login attempt policies can trigger device lockout or automatic wipe after a configurable number of failures.
Exam Tip: Know the difference between MDM (manages the whole device) and MAM (manages apps only). BYOD scenarios almost always require MAM or containerization to separate personal and corporate data. The exam tests remote wipe as the appropriate response to a lost/stolen device containing sensitive corporate data.
10.2 IoT & Embedded Systems

Key Concepts

  • IoT (Internet of Things) devices include smart home devices (thermostats, cameras, doorbells, speakers), wearable technology (smartwatches, fitness trackers), and industrial sensors. IoT devices often have limited computing resources, making traditional security software impractical. They frequently use default credentials, lack update mechanisms, and communicate over insecure protocols, making them attractive targets.
  • SCADA (Supervisory Control and Data Acquisition) systems monitor and control industrial processes in power plants, water treatment facilities, manufacturing, and oil/gas pipelines. SCADA systems were originally designed for isolated networks (air-gapped) but increasing connectivity exposes them to cyber threats. Securing SCADA requires network segmentation, strict access controls, and specialized industrial firewalls.
  • SoC (System on a Chip) integrates CPU, GPU, memory controller, and I/O interfaces on a single chip, used in smartphones, tablets, and embedded systems (Qualcomm Snapdragon, Apple M-series, Raspberry Pi). RTOS (Real-Time Operating System) provides deterministic response times for time-critical applications like automotive systems, medical devices, and industrial controllers.
  • Smart device security best practices include changing default usernames and passwords immediately, segmenting IoT devices on a separate VLAN or network, regularly updating firmware, disabling unnecessary services and ports, and monitoring network traffic for anomalous behavior from IoT devices. Network-level controls compensate for the limited built-in security of most IoT devices.
Exam Tip: IoT security is increasingly tested. The first step to securing any IoT device is changing default credentials. Network segmentation (placing IoT on a separate VLAN) is the most commonly recommended mitigation. Know that SCADA systems control critical infrastructure and that RTOS is used where precise timing is essential.
Key takeaways
  • MDM = whole device (passcode policy, remote wipe, encryption-at-rest, Wi-Fi/VPN profiles). MAM = just the corporate apps (used in BYOD to contain work data without touching personal data).
  • BYOD adds containerization (personal + work side-by-side); COPE keeps the device fully under MDM; CYOD lets the user pick from an approved company catalog.
  • IoT defense = change default credentials + segment to a separate VLAN + update firmware. The exam's "what did the admin do wrong" trope is "put the cameras on the production VLAN".
⚡ Mini-quiz — Drill MDM vs MAM scope, BYOD/COPE/CYOD differences, and the IoT segmentation playbook.
Quick quiz →
📐
Module 11 — Core 2
Networking Security & Troubleshooting
2 lessons
Wi-Fi security has one right answer in 2026: WPA3-Personal (SAE handshake, forward secrecy) or WPA2/WPA3-Enterprise with 802.1X + RADIUS. WEP and WPS are exam-trap "wrong" answers. On the troubleshooting side, the CLI quartet (ping, tracert/traceroute, nslookup, netstat) is what the exam expects you to reach for first.
11.1 Wireless Security

Key Concepts

  • WPA2 (Wi-Fi Protected Access 2) is the current minimum standard for wireless security. WPA2-Personal uses a pre-shared key (PSK) for authentication, suitable for home and small office networks. WPA2-Enterprise uses 802.1X authentication with a RADIUS server, providing individual user credentials and certificate-based authentication for stronger security in corporate environments.
  • WPA3 improves on WPA2 with Simultaneous Authentication of Equals (SAE), replacing the PSK four-way handshake to protect against offline dictionary attacks. WPA3-Personal provides stronger protection even with simple passwords, while WPA3-Enterprise offers 192-bit cryptographic strength. WPA3 also introduces Enhanced Open (OWE) for encrypted public Wi-Fi without passwords.
  • Encryption protocols have evolved from WEP (broken, never use) to TKIP (WPA, legacy) to AES-CCMP (WPA2, current standard) to AES-GCMP (WPA3). AES (Advanced Encryption Standard) provides strong 128-bit or 256-bit encryption. TKIP was a temporary fix for WEP's weaknesses but is now deprecated. All modern deployments should use AES encryption exclusively.
  • RADIUS (Remote Authentication Dial-In User Service) is the authentication server used in WPA2/WPA3 Enterprise deployments. RADIUS centralizes authentication, authorization, and accounting (AAA) for wireless and wired network access. Users authenticate with individual credentials (username/password, certificates) rather than a shared key, enabling per-user access policies, logging, and revocation.
Exam Tip: Know the wireless security hierarchy: WEP (broken) < WPA/TKIP (legacy) < WPA2/AES (current standard) < WPA3/SAE (latest). Personal mode uses a PSK (pre-shared key), Enterprise mode uses RADIUS. The exam expects you to recommend WPA2-Enterprise with AES minimum for corporate networks.
11.2 Network Troubleshooting Tools

Key Concepts

  • ping sends ICMP echo request packets to test basic connectivity between two hosts. A successful ping confirms that the network path is functional, DNS resolution works (if using a hostname), and the target host is reachable. Common results include "Request timed out" (host unreachable or firewall blocking), "Destination host unreachable" (routing issue), and TTL expired (too many hops).
  • tracert (Windows) / traceroute (Linux/macOS) displays the path packets take to reach a destination, showing each router hop along the way with round-trip times. This identifies where packets are being delayed or dropped. High latency at a specific hop indicates congestion at that router. Asterisks (*) indicate a hop that did not respond, often due to ICMP being blocked by a firewall.
  • nslookup queries DNS servers to resolve domain names to IP addresses and vice versa. It can specify a particular DNS server to query (nslookup domain.com 8.8.8.8), check different record types (set type=MX), and identify DNS configuration problems. If nslookup fails but ping to an IP works, the issue is DNS resolution rather than network connectivity.
  • netstat and pathping provide detailed network analysis. netstat -an shows all active connections and listening ports with numeric addresses (useful for identifying rogue connections or verifying services are running). pathping combines the functionality of ping and tracert, sending packets to each hop over a period of time and computing statistics on packet loss and latency at each router along the path.
Exam Tip: Troubleshooting tool selection is frequently tested. Use ping for basic connectivity, tracert to find where the path breaks, nslookup to diagnose DNS issues, and netstat to check open ports and connections. If you can ping an IP but not a hostname, the problem is DNS. If you cannot ping anything, check physical connectivity first.

🖥 Wi-Fi security audit — legacy WEP on branch office AP

Ticket: "Security audit found WEP encryption on the Westfield branch office AP. Fix it before Friday."

Walk: 1) Log into the AP admin web UI (default gateway address, check DHCP table if unknown). 2) Navigate to Wireless → Security — current setting shows WEP. Change to WPA2-Personal, AES encryption (not TKIP — TKIP is also deprecated and should never be selected). Set a passphrase of 16+ mixed characters. 3) Disable WPS (Wi-Fi Protected Setup) — it has a known brute-force vulnerability that can recover the PSK in hours regardless of passphrase strength. 4) Save and apply. 5) Reconnect all branch devices with the new passphrase; verify each connects successfully.

Verify: A wireless scan from a laptop should show the SSID advertising WPA2 security. Document: "Westfield branch AP migrated from WEP → WPA2-AES; WPS disabled per security policy."

Key takeaways
  • Wi-Fi rank: WPA3 > WPA2 > WPA > WEP. WEP and WPS are never the right exam answer — corporate networks should run WPA2/WPA3-Enterprise with RADIUS.
  • Ping IP works but ping name fails = DNS; ping nothing works = link/IP layer. tracert with `*` asterisks usually means ICMP blocked, not a real outage.
  • netstat -ano on Windows shows listening ports + the PID owning them — perfect for finding rogue listeners or stuck services during triage.
⚡ Mini-quiz — Drill WPA3/WPA2-Enterprise vs deprecated options, the "IP works, name doesn't = DNS" rule, and netstat for triage.
Quick quiz →
📋
Module 12 — Core 2
Operational Procedures
2 lessons
Change management gatekeeps every production touch — RFC + risk assessment + rollback plan + CAB approval + documented outcome. Backups follow the 3-2-1 rule (3 copies, 2 media types, 1 off-site). DR distinguishes RTO (how long can we be down?) from RPO (how much data can we lose?), and hot / warm / cold sites trade cost against recovery speed.
12.1 Documentation & Change Management

Key Concepts

  • Network diagrams and documentation provide visual representations of the network topology, including physical layouts (cable runs, rack locations, device placement) and logical layouts (IP addressing schemes, VLANs, subnets). Accurate, up-to-date documentation is essential for troubleshooting, onboarding new staff, disaster recovery, and compliance audits. Tools like Visio, Lucidchart, and draw.io are commonly used.
  • Baselines establish normal operating parameters for systems, networks, and applications (CPU usage, memory consumption, network throughput, response times). Comparing current performance against documented baselines helps identify anomalies that may indicate problems or security incidents. Baselines should be updated periodically as infrastructure changes.
  • Knowledge bases are centralized repositories of technical solutions, troubleshooting guides, and documented procedures. They reduce resolution times by allowing technicians to reference solutions to previously encountered problems. Effective knowledge bases include searchable articles with problem descriptions, root causes, resolution steps, and related resources.
  • Change management process ensures that modifications to IT systems are planned, approved, tested, and documented to minimize disruption. The process includes: (1) submit a change request, (2) assess risk and impact, (3) obtain approval from the Change Advisory Board (CAB), (4) plan the implementation with a rollback plan, (5) implement during a maintenance window, (6) verify and document results. Emergency changes follow an expedited process.
Exam Tip: Change management is heavily tested. Know the complete process from request through documentation. The exam will ask what should happen BEFORE making a change (get approval, create a rollback plan) and AFTER (verify functionality, document). A maintenance window minimizes impact on users.
12.2 Disaster Recovery & Backup

Key Concepts

  • Backup types serve different purposes. A full backup copies all selected data (longest time, easiest restore). An incremental backup copies only data changed since the last backup of any type (fastest backup, slowest restore — requires all incrementals plus the last full). A differential backup copies all data changed since the last full backup (moderate speed, requires only the last full plus the latest differential).
  • The 3-2-1 backup rule is the industry standard: maintain 3 copies of your data, on 2 different types of media (e.g., local disk + cloud, or NAS + tape), with 1 copy stored offsite (cloud storage, remote facility). This strategy protects against hardware failure, ransomware, natural disasters, and theft. Test backup restorations regularly to verify data integrity and recovery procedures.
  • RTO and RPO define recovery objectives. Recovery Time Objective (RTO) is the maximum acceptable time to restore operations after a disaster — a 4-hour RTO means systems must be back online within 4 hours. Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time — a 1-hour RPO means backups must occur at least every hour. Lower RTO/RPO values require more expensive infrastructure.
  • Disaster recovery sites vary in readiness and cost. A hot site is a fully operational duplicate of the production environment, ready to take over immediately (most expensive, lowest RTO). A warm site has hardware and connectivity but requires data restoration and configuration (moderate cost and RTO). A cold site is an empty facility with power and network connections that must be fully built out (cheapest, highest RTO).
Exam Tip: Backup types are always tested. Remember: Full (everything), Incremental (since last any backup), Differential (since last full backup). Restoring from incrementals requires the full backup plus every incremental in sequence. The 3-2-1 rule and the definitions of RTO/RPO are frequently tested concepts.

🖥 Disaster recovery — ransomware encryption at 2 AM

Ticket: "File server is showing ransom notes. All shared documents are .locked files. Marketing can't work."

Walk: 1) Do NOT pay — payment funds the attacker and guarantees nothing. 2) Isolate immediately: pull the server's network cable to stop lateral spread to other shares and backup paths. 3) Check the backup log: per the 3-2-1 policy there is a full backup on the NAS from Friday night and an incremental from Sunday night (RPO target = 8 hours). 4) Spin up an alternate file server; restore the Friday full, then apply the Sunday incremental on top — data is back within 4 hours (RTO target). 5) Validate: have three managers spot-check their own folders for integrity. 6) Wipe and rebuild the infected server from a known-good image — do not restore it in-place. 7) Document the full incident timeline, RPO and RTO achieved, attack vector, and preventive measures added (additional email filtering, patch schedule, AP segmentation).

Outcome: RPO (data age at recovery) ≈ 8 hours. RTO (time to restore operations) = 3.5 hours. Both within policy. Submit incident report to CAB post-mortem.

Key takeaways
  • 3-2-1 backup: 3 copies, 2 different media types (disk + tape or disk + cloud), 1 stored off-site. Single-site backups die with the building during a real disaster.
  • RTO = Recovery Time Objective (how fast back up); RPO = Recovery Point Objective (how much data loss is tolerable). Lower numbers = more expensive infrastructure.
  • DR site tier: hot (live mirror, lowest RTO, highest $$) → warm (hardware ready, restore needed) → cold (empty room, cheapest, longest RTO). Pick by what you can afford to lose.
⚡ Mini-quiz — Drill 3-2-1 backups, RTO vs RPO framing, and hot/warm/cold DR site trade-offs.
Quick quiz →
🖨
Module 13 — Core 2
Scripting & Remote Access
2 lessons
Scripting languages cluster by environment: PowerShell + batch on Windows, Bash on Linux/macOS, Python when the script must run anywhere. Remote-access tools split into encrypted (SSH 22, RDP 3389, MSP tools over HTTPS) versus deprecated cleartext (Telnet 23, raw VNC). You won't write code on the exam — but you must identify script extensions and pick the right remote-access port for the OS.
13.1 Basic Scripting

Key Concepts

  • PowerShell scripts (.ps1) are the primary automation tool for Windows administration. PowerShell uses Verb-Noun cmdlets and supports variables, loops, conditionals, functions, and piping. Execution policies (Restricted, AllSigned, RemoteSigned, Unrestricted) control which scripts can run. Common automation tasks include user account creation, system inventory collection, log analysis, and configuration management.
  • Bash shell scripts (.sh) automate tasks on Linux and macOS. Scripts begin with a shebang line (#!/bin/bash), use chmod +x to make them executable, and support variables, loops (for, while), conditionals (if/then/else), and functions. Common uses include automated backups, log rotation, system monitoring, and batch file processing. Bash is the default shell on most Linux distributions.
  • Python scripts (.py) are cross-platform and widely used for IT automation, network management, and data processing. Python's readable syntax and extensive standard library make it ideal for tasks like API interactions, file manipulation, web scraping, and system administration. Batch files (.bat) are legacy Windows scripts using cmd.exe commands for simple task automation.
  • JavaScript (.js) and VBScript (.vbs) serve different scripting needs. JavaScript runs in web browsers and Node.js for server-side automation. VBScript is a legacy Windows scripting language that runs via Windows Script Host (wscript/cscript), used in older login scripts and administrative tasks. Understanding script file extensions helps identify potential malicious scripts — unexpected .ps1, .vbs, .bat, or .js files may indicate an attack.
Exam Tip: You do not need to write scripts for the exam, but you must identify script types by their file extensions: .ps1 (PowerShell), .sh (Bash), .py (Python), .bat (Batch), .js (JavaScript), .vbs (VBScript). Know that PowerShell execution policies control script execution and that malicious scripts are a common attack vector.
13.2 Remote Access Technologies

Key Concepts

  • RDP (Remote Desktop Protocol) uses port 3389 and provides full graphical remote access to Windows systems. RDP supports encryption, Network Level Authentication (NLA), and multi-monitor configurations. It should be protected with strong passwords, MFA, and VPN tunneling — exposing RDP directly to the internet is a major security risk due to brute-force and exploit attacks.
  • VNC (Virtual Network Computing) uses port 5900 and provides platform-independent remote desktop access. Unlike RDP, VNC shares the existing desktop session (not a separate session), so both local and remote users see the same screen. VNC is useful for cross-platform support but typically lacks the encryption and performance optimization of RDP, requiring SSH tunneling for secure access.
  • SSH (Secure Shell) uses port 22 and provides encrypted command-line remote access to Linux, macOS, and network devices. SSH replaces the insecure Telnet protocol (port 23, unencrypted). SSH supports key-based authentication (more secure than passwords), port forwarding/tunneling (encrypting other protocols through SSH), and secure file transfer via SCP and SFTP.
  • VPN and screen-sharing solutions provide additional remote access methods. VPNs create encrypted tunnels to access entire networks remotely (IPSec for site-to-site, SSL/TLS for client-to-site). MSRA (Microsoft Remote Assistance) allows a technician to view or control a user's screen with the user's permission. Third-party tools like TeamViewer, AnyDesk, and Zoom screen sharing enable ad-hoc remote support sessions.
Exam Tip: Memorize the port numbers: RDP = 3389, VNC = 5900, SSH = 22, Telnet = 23. Know that SSH is encrypted while Telnet is not. RDP creates a new session while VNC shares the existing session. The exam tests when to use each remote access method based on the scenario (OS, security needs, user involvement).
Key takeaways
  • Script-extension cheat sheet: .ps1 PowerShell, .sh Bash, .py Python, .bat Batch, .vbs VBScript, .js JavaScript. Unexpected files with these extensions in email attachments are the malware-attachment scenario.
  • Remote-access ports: SSH 22 (encrypted, Linux/network gear), RDP 3389 (encrypted, Windows graphical), VNC 5900 (cross-platform but needs SSH tunneling), Telnet 23 = exam trap.
  • RDP creates a new session; VNC shares the existing session (both users see the same screen — useful for assist-style support but bad for privacy).
⚡ Mini-quiz — Drill script-extension recognition, SSH vs RDP vs VNC ports, and the new-session vs shared-session distinction.
Quick quiz →
🌱
Module 14 — Core 2
Environmental & Professionalism
2 lessons
ESD (electrostatic discharge) damages components silently — anti-static wrist straps and mats are non-optional bench gear. Fire-suppression class matters (Class C for electrical fires). MSDS / SDS sheets cover chemical handling; e-waste goes to certified recyclers. Professional conduct (active listening, expectation-setting, confidentiality) is its own exam domain — the polite answer almost always wins.
14.1 Safety Procedures

Key Concepts

  • ESD (Electrostatic Discharge) prevention is critical when handling computer components. ESD can damage sensitive electronics (RAM, CPUs, motherboards) with as little as 30 volts, well below the human perception threshold of ~3,000 volts. Prevention methods include wearing an anti-static wrist strap connected to a grounded surface, using anti-static mats, touching the metal chassis before handling components, and storing parts in anti-static bags.
  • Proper component handling requires holding circuit boards by the edges to avoid touching connectors or traces. CPUs must be aligned with the socket indicator (arrow or notch) and never forced. RAM modules click into place when properly seated. Hard drives should be handled gently to avoid shock damage to platters. Always power off and unplug equipment before servicing internal components.
  • Electrical safety involves understanding the dangers of high-voltage components. CRT monitors and power supplies contain capacitors that retain dangerous charges even when unplugged — never open a power supply. Use surge protectors and UPS (Uninterruptible Power Supply) units to protect equipment. Follow proper grounding practices and never bypass the ground prong on a power cord.
  • MSDS/SDS and proper disposal documents (Material Safety Data Sheets / Safety Data Sheets) contain information about chemical hazards, handling procedures, and emergency response for materials like printer toner, cleaning solvents, and battery electrolytes. E-waste disposal must follow local regulations — batteries, CRT monitors, toner cartridges, and circuit boards contain hazardous materials and should be recycled through certified e-waste facilities, never placed in regular trash.
Exam Tip: ESD prevention appears on every A+ exam. Always use an anti-static wrist strap when handling components. Know that power supplies and CRT monitors are dangerous even when unplugged due to stored charge. MSDS/SDS sheets tell you how to handle hazardous materials safely. Batteries must be recycled, not thrown in the trash.
14.2 Communication & Professionalism

Key Concepts

  • Professional appearance and behavior set the tone for customer interactions. IT technicians should maintain a neat, appropriate appearance, arrive on time, and be prepared with the necessary tools and documentation. Avoid using personal devices during service calls, refrain from eating or drinking near customer equipment, and always treat the customer's workspace and data with respect.
  • Active listening is the foundation of effective technical support. Let the user fully describe the problem without interrupting, ask clarifying questions, and repeat back the issue in your own words to confirm understanding. Avoid using jargon — explain technical concepts in plain language that the end user can understand. Never dismiss the user's concerns or make them feel unintelligent.
  • Setting and managing expectations builds trust with users and management. Provide realistic timelines for repairs and communicate proactively if delays occur. If you need to escalate an issue, explain why and provide an estimated timeline for resolution. Document all actions taken, keep the customer informed of progress, and follow up after resolution to confirm the issue is fully resolved.
  • Cultural sensitivity and confidentiality are essential in diverse workplaces. Be respectful of different communication styles, personal space preferences, and cultural norms. Maintain strict confidentiality — never access, read, or share a user's personal files, emails, or browsing history beyond what is necessary to resolve the reported issue. Handle sensitive data according to organizational privacy policies and applicable regulations.
Exam Tip: Professionalism questions test soft skills. The correct answer almost always involves active listening, clear communication, setting expectations, and respecting confidentiality. Never argue with users, never access data beyond what is needed, and always document your work. These questions are straightforward — choose the most professional, respectful option.
Key takeaways
  • Anti-static wrist strap + ESD mat before opening any device. Discharge can kill RAM, CPU, or a motherboard at voltages humans can't even feel.
  • Power supplies and CRTs hold dangerous charges even when unplugged — never open them. Surge protector + UPS protects the gear that's running.
  • Customer-facing soft skills: listen actively, set expectations, avoid jargon, document everything, and respect confidentiality. The polite-and-thorough option is always the exam-correct answer.
⚡ Mini-quiz — Drill ESD prevention, residual-charge hazards (PSU/CRT), and the polite-and-thorough soft-skill answer pattern.
Quick quiz →
Start practicing →