CompTIA · linux

CompTIA A+ Core 1 & 2

Hardware, networking, mobile devices, OS troubleshooting, and operational procedures. The foundational IT support certification.

14Modules
45 hoursDuration
beginnerLevel
⚡ Practice the exam ← All courses

Course Modules

📱
Module 1 — Core 1
Mobile Devices
2 lessons
1.1 Laptop Hardware Components

Key Concepts

  • Laptop displays use LCD (TN, IPS, VA panels) or OLED technology with LED backlighting. Resolution ranges from 1366x768 (HD) to 3840x2160 (4K UHD). Digitizers enable touchscreen input, and replacements require careful ribbon cable disconnection.
  • Batteries and power in laptops are typically lithium-ion (Li-ion) or lithium-polymer (LiPo). Battery calibration, cycle count monitoring, and proper charging practices extend lifespan. Swollen batteries are a safety hazard and must be replaced immediately.
  • Keyboards and input devices connect via ribbon cables to the motherboard. Laptop keyboards are typically membrane-style and can be replaced individually. Trackpads use capacitive touch and may include gesture support for multi-finger input.
  • Wireless cards and expansion include Wi-Fi and Bluetooth adapters using M.2 (Key A/E) or Mini PCIe form factors. Antenna wires route through the display bezel for optimal signal. Cellular cards (WWAN) enable mobile broadband connectivity via SIM slots.
  • Memory and storage upgrades in laptops use SO-DIMM (DDR4/DDR5) modules and 2.5-inch SATA or M.2 NVMe drives. Access panels on the bottom of the laptop provide upgrade access, though some ultrabooks have soldered components that cannot be replaced.
Exam Tip: Know the difference between M.2 key types — Key B is for SATA SSDs, Key M is for NVMe SSDs, and Key A/E is for wireless cards. The exam frequently tests which components can be field-replaced in laptops versus which are soldered.
1.2 Mobile Device Connectivity & Accessories

Key Concepts

  • USB-C and Lightning connectors are the primary wired interfaces for modern mobile devices. USB-C supports USB 3.2/4.0, Thunderbolt 3/4, DisplayPort Alt Mode, and Power Delivery (up to 240W). Lightning is Apple-proprietary and limited to USB 2.0 speeds.
  • Bluetooth technology enables short-range wireless communication for peripherals (headphones, keyboards, speakers). Bluetooth 5.0+ offers improved range (up to 240m), speed (2 Mbps), and low-energy (BLE) operation for IoT devices. Pairing requires discovery mode and PIN verification.
  • NFC (Near Field Communication) operates at 13.56 MHz within a range of about 4 cm. Used for contactless payments (Apple Pay, Google Pay), quick Bluetooth pairing, and access badge systems. NFC is a passive technology that does not require battery power on the tag side.
  • Infrared (IR) blasters provide line-of-sight control of TVs, projectors, and media devices. IR communication is unidirectional and requires direct line of sight with no obstructions between sender and receiver.
  • Mobile accessories include docking stations (USB-C hubs with HDMI, Ethernet, USB-A ports), portable hotspots, styluses with pressure sensitivity, and protective cases with integrated battery packs. Wireless charging uses the Qi standard at 5W–15W.
Exam Tip: Memorize USB-C capabilities — it can carry data, video, and power simultaneously. The exam also tests NFC range (~4 cm) and Bluetooth classes (Class 1 = 100m, Class 2 = 10m). Know that IR requires line of sight while Bluetooth and NFC do not.
🌐
Module 2 — Core 1
Networking Fundamentals
3 lessons
2.1 TCP/IP, Ports & Protocols

Key Concepts

  • TCP vs UDP are the two primary transport-layer protocols. TCP (Transmission Control Protocol) is connection-oriented with three-way handshake (SYN, SYN-ACK, ACK), guaranteeing reliable, ordered delivery. UDP (User Datagram Protocol) is connectionless with no delivery guarantee, used for speed-sensitive applications like DNS queries, VoIP, and video streaming.
  • Well-known ports must be memorized: HTTP (80), HTTPS (443), SSH (22), Telnet (23), DNS (53), DHCP (67/68), SMTP (25), POP3 (110), IMAP (143), FTP (20/21), SFTP (22), RDP (3389), SMB (445), SNMP (161/162), LDAP (389), LDAPS (636).
  • IPv4 addressing uses 32-bit addresses in dotted-decimal notation (e.g., 192.168.1.1). Private address ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Subnet masks define network and host portions. CIDR notation (/24 = 255.255.255.0) simplifies subnet representation.
  • IPv6 addressing uses 128-bit hexadecimal addresses (e.g., 2001:0db8::1). Link-local addresses start with fe80::, and the loopback address is ::1. IPv6 eliminates the need for NAT and uses SLAAC (Stateless Address Autoconfiguration) or DHCPv6 for address assignment.
  • The OSI model has seven layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). The TCP/IP model simplifies this into four layers: Network Access, Internet, Transport, and Application. Understanding which protocols and devices operate at each layer is critical.
Exam Tip: Port numbers are heavily tested. Create flashcards for all well-known ports. Remember that HTTPS (443), SSH (22), and SFTP (22) are encrypted, while HTTP (80), Telnet (23), and FTP (21) send data in plaintext. The exam expects you to identify which protocol to use based on the scenario.
2.2 Network Hardware

Key Concepts

  • Routers operate at Layer 3 (Network) and forward packets between different networks using IP addresses and routing tables. They perform NAT (Network Address Translation) to allow private IP addresses to communicate on the internet, and can implement ACLs (Access Control Lists) for basic traffic filtering.
  • Switches operate at Layer 2 (Data Link) and forward frames within a local network using MAC addresses and a CAM (Content Addressable Memory) table. Managed switches support VLANs, port security, spanning tree protocol (STP), and link aggregation. Unmanaged switches are plug-and-play with no configuration options.
  • Wireless access points (APs) extend the wired network to wireless clients using Wi-Fi standards: 802.11a (5 GHz, 54 Mbps), 802.11n/Wi-Fi 4 (2.4/5 GHz, 600 Mbps), 802.11ac/Wi-Fi 5 (5 GHz, 6.9 Gbps), 802.11ax/Wi-Fi 6 (2.4/5/6 GHz, 9.6 Gbps). Antenna types include omnidirectional and directional.
  • Firewalls inspect and filter traffic based on rules. Hardware firewalls sit at the network perimeter, while software firewalls run on individual hosts. Next-generation firewalls (NGFWs) add deep packet inspection, application-layer filtering, and intrusion prevention capabilities.
  • Patch panels and structured cabling organize network connections in a server room or wiring closet. Patch panels terminate horizontal cable runs and connect to switches via short patch cables. Cable types include Cat 5e (1 Gbps, 100m), Cat 6 (10 Gbps at 55m), and Cat 6a (10 Gbps at 100m).
Exam Tip: Know the OSI layer at which each device operates — hubs at Layer 1, switches at Layer 2, routers at Layer 3. The exam will test you on cable categories and their maximum speeds and distances. Remember that Cat 6 supports 10 Gbps only up to 55 meters, while Cat 6a extends this to the full 100 meters.
2.3 Network Configurations

Key Concepts

  • DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to clients via the DORA process: Discover, Offer, Request, Acknowledge. DHCP leases have configurable durations, and DHCP reservations bind a specific IP address to a MAC address for devices that need consistent addressing.
  • DNS (Domain Name System) translates domain names to IP addresses using a hierarchical system of root servers, TLD servers, and authoritative name servers. Common record types include A (IPv4), AAAA (IPv6), MX (mail), CNAME (alias), PTR (reverse lookup), TXT (SPF/DKIM), and NS (name server).
  • VLANs (Virtual Local Area Networks) logically segment a physical network into separate broadcast domains at Layer 2. VLAN tagging uses IEEE 802.1Q to identify VLAN membership on trunk ports. VLANs improve security by isolating traffic (e.g., separating guest Wi-Fi from corporate network) and reduce broadcast traffic.
  • VPN (Virtual Private Network) creates an encrypted tunnel over a public network. Site-to-site VPNs connect two networks (using IPSec), while client-to-site VPNs allow remote users to access corporate resources. Split tunneling sends only corporate-bound traffic through the VPN, while full tunneling routes all traffic through it.
Exam Tip: Memorize the DHCP DORA process and common DNS record types. The exam often presents scenarios where you must troubleshoot IP address conflicts (duplicate DHCP assignments) or DNS resolution failures. Know that APIPA addresses (169.254.x.x) indicate DHCP failure.
🖥
Module 3 — Core 1
Hardware
3 lessons
3.1 Motherboards, CPUs & RAM

Key Concepts

  • Motherboard form factors determine the physical layout and expansion capabilities. ATX (305x244mm) is the standard full-size board with 7 expansion slots. Micro-ATX (mATX, 244x244mm) is smaller with 4 slots. Mini-ITX (170x170mm) is compact with 1 slot, ideal for small form factor builds. The form factor dictates case compatibility, power connector placement, and I/O panel layout.
  • CPU socket types must match the motherboard. Intel uses LGA (Land Grid Array) sockets such as LGA 1700 (12th–14th Gen) and LGA 1200 (10th–11th Gen). AMD uses PGA (Pin Grid Array) with AM4 and the newer LGA-based AM5 socket. Multi-core processors, hyper-threading (Intel) and SMT (AMD) allow simultaneous processing of multiple threads.
  • RAM specifications include DDR4 (1.2V, speeds 2133–3200+ MHz) and DDR5 (1.1V, speeds 4800–6400+ MHz). DIMMs are used in desktops and SO-DIMMs in laptops. Dual-channel configurations require matching pairs installed in the correct slots (typically alternating colors). ECC (Error-Correcting Code) RAM detects and corrects single-bit errors, used in servers and workstations.
  • PCIe expansion slots come in x1, x4, x8, and x16 sizes. PCIe 4.0 x16 provides approximately 32 GB/s bandwidth, while PCIe 5.0 doubles that. Graphics cards use x16 slots, NVMe SSDs use x4 (via M.2), and network cards typically use x1 or x4. PCIe is backward and forward compatible — a smaller card works in a larger slot.
  • BIOS/UEFI firmware initializes hardware during POST (Power-On Self-Test) and hands off to the operating system boot loader. UEFI replaces legacy BIOS with a graphical interface, support for drives larger than 2.2 TB (GPT), Secure Boot to prevent unauthorized OS loading, and faster boot times. Firmware updates (flashing) should be performed carefully to avoid bricking the board.
Exam Tip: Know that DDR4 and DDR5 are not interchangeable due to different notch positions. The exam tests UEFI features like Secure Boot and TPM integration. Remember that ATX uses a 24-pin main power connector and an 8-pin CPU power connector.
3.2 Storage Devices

Key Concepts

  • Hard disk drives (HDDs) use spinning magnetic platters and read/write heads. They come in 3.5-inch (desktop) and 2.5-inch (laptop) form factors, with speeds of 5400 RPM (low power) or 7200 RPM (standard performance). HDDs connect via SATA III (6 Gbps) and remain cost-effective for bulk storage but are vulnerable to mechanical failure from drops or vibration.
  • Solid-state drives (SSDs) use NAND flash memory with no moving parts, offering dramatically faster read/write speeds and greater durability. SATA SSDs connect via the same SATA III interface (limited to ~550 MB/s). NVMe SSDs use the M.2 form factor with PCIe lanes, achieving sequential reads of 3500+ MB/s (PCIe 3.0) or 7000+ MB/s (PCIe 4.0).
  • RAID configurations combine multiple drives for redundancy or performance. RAID 0 (striping) splits data across drives for speed but offers no redundancy. RAID 1 (mirroring) duplicates data on two drives. RAID 5 (striping with parity) requires 3+ drives and can survive one drive failure. RAID 10 (1+0) combines mirroring and striping, requiring 4+ drives, providing both speed and redundancy.
  • Drive interfaces and installation vary by type. SATA uses a 7-pin data cable and 15-pin power connector. M.2 slots accept different key types (B key for SATA, M key for NVMe). Hot-swapping is supported by SATA and SAS in server environments. Drive partitioning uses MBR (up to 4 primary partitions, 2 TB max) or GPT (128+ partitions, 9.4 ZB max, requires UEFI).
Exam Tip: RAID is a top exam topic. Remember: RAID 0 = no redundancy, RAID 1 = mirroring (50% usable capacity), RAID 5 = parity (one drive can fail), RAID 10 = mirror + stripe (minimum 4 drives). Know that NVMe SSDs are significantly faster than SATA SSDs because they bypass the AHCI protocol bottleneck.
3.3 Power Supplies & Peripherals

Key Concepts

  • Power supply unit (PSU) ratings follow the 80 Plus certification system: 80 Plus (80% efficiency), Bronze (82%), Silver (85%), Gold (87%), Platinum (89%), Titanium (92%). Higher efficiency means less wasted energy as heat, lower electricity costs, and quieter operation due to reduced cooling demands.
  • Modular vs non-modular PSUs affect cable management and airflow. Fully modular PSUs allow you to connect only the cables you need, improving airflow and aesthetics. Semi-modular PSUs have fixed essential cables (24-pin, CPU) with optional peripheral cables. Non-modular PSUs have all cables permanently attached.
  • Wattage calculation requires adding the power draw of all components (CPU TDP, GPU TDP, RAM, drives, fans) and adding a 20–30% headroom margin. An online PSU calculator can estimate requirements. A typical gaming PC needs 550–750W, while a high-end workstation may require 850W+. Insufficient wattage causes random shutdowns, instability, or failure to POST.
  • Peripheral connectivity includes USB (Type-A, Type-C, Micro-B), video outputs (HDMI 2.1, DisplayPort 1.4, DVI, VGA), and audio (3.5mm jack, S/PDIF optical). Printers connect via USB, Ethernet, or Wi-Fi and require appropriate drivers. Multi-function devices combine printing, scanning, copying, and faxing in one unit.
Exam Tip: Be prepared for questions about PSU connector types: 24-pin ATX motherboard, 4/8-pin CPU, 6/8-pin PCIe (GPU), SATA power (15-pin), and Molex (4-pin legacy). The exam tests your ability to calculate whether a PSU can handle a given component configuration.
☁️
Module 4 — Core 1
Virtualization & Cloud
2 lessons
4.1 Hypervisors & Virtual Machines

Key Concepts

  • Type 1 (bare-metal) hypervisors run directly on hardware without a host OS, providing superior performance and security. Examples include VMware ESXi, Microsoft Hyper-V (as a server role), and Citrix XenServer. Type 1 hypervisors are the standard in enterprise data centers and require hardware virtualization support (Intel VT-x or AMD-V).
  • Type 2 (hosted) hypervisors run as applications on top of a host operating system. Examples include VMware Workstation, Oracle VirtualBox, and Parallels Desktop. Type 2 hypervisors are ideal for development, testing, and training environments but add overhead from the host OS layer, resulting in lower performance compared to Type 1.
  • Virtual machine resource allocation involves assigning vCPUs, RAM, virtual disk space, and virtual network adapters to each VM. Over-provisioning (allocating more total resources than physically available) is possible because not all VMs peak simultaneously, but requires careful monitoring to prevent contention and performance degradation.
  • VM snapshots and clones capture the state of a VM at a specific point in time, enabling quick rollback after failed updates or testing. Snapshots should not be used as long-term backups because they grow over time and degrade performance. Cloning creates an independent copy of a VM for rapid deployment of identical environments.
Exam Tip: The key distinction is that Type 1 runs ON the hardware (better for production) and Type 2 runs ON an OS (better for testing). Know that virtualization requires CPU support (VT-x/AMD-V) enabled in BIOS/UEFI. Expect scenario questions about when to use snapshots vs full backups.
4.2 Cloud Models & Services

Key Concepts

  • Cloud service models define the level of management responsibility. IaaS (Infrastructure as a Service) provides virtual machines, storage, and networking — you manage the OS and applications (e.g., AWS EC2, Azure VMs). PaaS (Platform as a Service) adds runtime and middleware management (e.g., Heroku, Azure App Service). SaaS (Software as a Service) delivers fully managed applications (e.g., Microsoft 365, Google Workspace).
  • Cloud deployment models determine who can access the infrastructure. Public cloud is shared among multiple tenants and managed by the provider (AWS, Azure, GCP). Private cloud is dedicated to a single organization, on-premises or hosted. Hybrid cloud combines public and private, allowing workloads to move between them. Community cloud is shared among organizations with common requirements (e.g., healthcare, government).
  • Cloud characteristics include on-demand self-service, broad network access, resource pooling, rapid elasticity (auto-scaling), and measured service (pay-per-use). These characteristics, defined by NIST, distinguish true cloud computing from traditional hosting and enable organizations to scale resources up or down in response to demand.
  • Shared responsibility model divides security duties between the cloud provider and customer. The provider is responsible for security OF the cloud (physical data centers, hypervisor, network infrastructure), while the customer handles security IN the cloud (data, access controls, OS patching in IaaS, application configuration in PaaS).
Exam Tip: Be able to classify services into IaaS, PaaS, or SaaS based on descriptions. The exam tests the shared responsibility model — know that in SaaS the provider handles almost everything, while in IaaS the customer handles more. Remember the four deployment models: public, private, hybrid, community.
🔧
Module 5 — Core 1
Troubleshooting Hardware & Networking
2 lessons
5.1 CompTIA Troubleshooting Methodology

Key Concepts

  • Step 1: Identify the problem by gathering information from the user, questioning them about recent changes, reviewing logs, and reproducing the issue if possible. Determine the scope (single user, department, or entire network) and identify any environmental or infrastructure changes that may have occurred.
  • Step 2: Establish a theory of probable cause by starting with the most common or simplest explanation first (Occam’s Razor). Consider multiple possibilities, research symptoms online or in knowledge bases, and question the obvious before jumping to complex theories.
  • Step 3: Test the theory to determine the cause. If the theory is confirmed, determine the next steps to resolve. If the theory is not confirmed, establish a new theory or escalate to a senior technician. Testing may involve substituting components, disabling services, or checking configurations.
  • Steps 4–6: Plan, implement, verify — establish a plan of action to resolve the problem and implement the solution (with a rollback plan). Verify full system functionality and, if applicable, implement preventive measures such as updated drivers, firmware patches, or configuration hardening.
  • Step 7: Document findings including the problem description, steps taken, root cause, resolution, and preventive measures. Documentation builds a knowledge base for future troubleshooting and is essential for change management, compliance auditing, and training new technicians.
Exam Tip: CompTIA loves this methodology and tests it frequently. Memorize all seven steps in order: Identify, Theory, Test, Plan, Implement, Verify, Document. Scenario-based questions will ask what you should do FIRST, NEXT, or LAST in a troubleshooting situation.
5.2 Common Hardware & Network Issues

Key Concepts

  • POST failures and beep codes indicate hardware problems during startup. Continuous beeps typically signal a RAM issue, one long beep with two or three short beeps indicates a video card problem. No video output can mean a dead GPU, unseated RAM, or a failed power supply. Check the motherboard manual for manufacturer-specific beep code meanings.
  • Overheating symptoms include unexpected shutdowns, blue screens (BSOD), system instability, and throttled performance. Causes include failed fans, dried thermal paste, blocked vents, and dust accumulation. Use temperature monitoring software to verify. Reapplying thermal paste and cleaning heatsinks are common resolutions.
  • Network connectivity issues manifest as no internet, slow speeds, or intermittent drops. Troubleshoot methodically: check physical connections and link lights, verify IP configuration (ipconfig/ifconfig), test local connectivity (ping gateway), test DNS resolution (nslookup), test external connectivity (ping 8.8.8.8). An APIPA address (169.254.x.x) indicates DHCP failure.
  • Storage drive failures present as clicking noises (HDD mechanical failure), boot errors ("No boot device found"), corrupted files, or S.M.A.R.T. warnings. SSDs may fail silently with read-only mode as end-of-life behavior. Regular S.M.A.R.T. monitoring, proper backups, and RAID configurations mitigate data loss risks.
Exam Tip: The exam frequently asks about diagnosing no-boot scenarios. Work through the troubleshooting methodology: check power first (fans spinning, lights on), then POST (beep codes), then boot device (BIOS boot order). For network issues, always start with the physical layer and work up the OSI model.
💻
Module 6 — Core 2
Operating Systems
3 lessons
6.1 Windows Editions & Features

Key Concepts

  • Windows editions differ in feature sets. Home is for consumers and lacks Group Policy, BitLocker, Remote Desktop host, and domain join. Pro adds Group Policy, BitLocker, Remote Desktop, Hyper-V, and domain join. Enterprise adds advanced security (AppLocker, Credential Guard, DirectAccess) and volume licensing features. Education mirrors Enterprise with academic licensing.
  • Workgroups vs domains are two network models. Workgroups are decentralized peer-to-peer networks where each computer maintains its own local user accounts — suitable for small networks (under 10 devices). Domains use Active Directory (AD) with a centralized domain controller for authentication, group policy, and resource management, scaling to thousands of users.
  • Windows installation methods include USB boot media (created with Media Creation Tool), PXE (Preboot Execution Environment) network boot for mass deployment, and Windows Deployment Services (WDS). Unattended installations use answer files (unattend.xml) for automated configuration. In-place upgrades preserve user data and applications, while clean installs provide a fresh start.
  • Windows features and tools include Task Manager (performance monitoring, process management), Device Manager (hardware drivers), Disk Management (partition creation, volume extension), and msconfig (boot configuration, startup services). The Control Panel and Settings app manage system configuration, network settings, user accounts, and Windows Update.
Exam Tip: Know which features are exclusive to Pro/Enterprise: BitLocker, Group Policy (gpedit.msc), Remote Desktop host, domain join, and Hyper-V. The exam often asks which Windows edition supports a specific feature. Home edition is the most limited.
6.2 Windows Command-Line Tools

Key Concepts

  • Network commands are essential for troubleshooting. ipconfig /all displays full TCP/IP configuration, ipconfig /release and /renew reset DHCP leases, ipconfig /flushdns clears the DNS resolver cache. ping tests connectivity, tracert traces the route packets take, nslookup queries DNS servers, and netstat -an shows all active connections and listening ports.
  • System maintenance commands keep Windows healthy. sfc /scannow scans and repairs protected system files. DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows component store. chkdsk /f fixes file system errors, chkdsk /r locates bad sectors and recovers readable data. These commands often require administrator privileges.
  • Group Policy commands manage domain and local policies. gpupdate /force immediately refreshes all Group Policy settings. gpresult /r displays the Resultant Set of Policy (RSoP) for the current user and computer, showing which GPOs are applied. These are critical for troubleshooting policy deployment issues in domain environments.
  • PowerShell extends command-line capabilities with cmdlets following a Verb-Noun syntax (Get-Process, Set-ExecutionPolicy, New-Item). PowerShell supports piping, scripting, and remote management (Enter-PSSession, Invoke-Command). Key cmdlets include Get-EventLog, Get-Service, Test-NetConnection, and Get-WmiObject for system administration tasks.
Exam Tip: Command-line questions are very common. Know the exact syntax: sfc /scannow (not sfc /scan), ipconfig /flushdns, chkdsk /f /r, gpupdate /force. The exam tests what each command does and when to use it. Remember that DISM must be run before sfc if the component store is corrupted.
6.3 macOS & Linux Basics

Key Concepts

  • macOS fundamentals include Finder (file manager), System Preferences/Settings, Spotlight (search), Time Machine (automated backups), FileVault (full disk encryption), and Keychain Access (password management). macOS uses the APFS (Apple File System) for SSDs, supporting snapshots, encryption, and space sharing across volumes.
  • Linux terminal essentials include navigation commands (ls, cd, pwd, mkdir, rmdir), file operations (cp, mv, rm, cat, nano/vi), and permission management (chmod, chown). The Linux file system hierarchy starts at / (root) with /home (user directories), /etc (configuration), /var (logs), /tmp (temporary), and /bin (essential binaries).
  • Package management varies by distribution. Debian/Ubuntu uses apt (apt update, apt upgrade, apt install package-name) with .deb packages. Red Hat/CentOS/Fedora uses yum or dnf with .rpm packages. Package managers handle dependency resolution, updates, and removal automatically from configured repositories.
  • File systems across platforms differ significantly. Windows uses NTFS (permissions, encryption, compression, journaling) and FAT32 (legacy, 4 GB file size limit). macOS uses APFS (SSD-optimized) and HFS+ (legacy). Linux commonly uses ext4 (journaling, up to 1 EB volume size) and XFS (high-performance, scalable). exFAT is the cross-platform choice for USB drives (no file size limit like FAT32).
Exam Tip: Know the default file systems for each OS: Windows = NTFS, macOS = APFS, Linux = ext4. The exam tests basic Linux commands (ls, cd, chmod, grep, sudo) and the difference between apt and yum. Remember that FAT32 has a 4 GB file size limit, making exFAT better for large files on removable media.
🔒
Module 7 — Core 2
Security Concepts
2 lessons
7.1 Physical Security

Key Concepts

  • Bollards are short, sturdy posts installed around building perimeters to prevent vehicle-borne attacks. They can be fixed (permanent), removable, or retractable (hydraulic). Bollards are the first line of physical defense for high-value facilities, data centers, and government buildings where vehicle ramming is a threat.
  • Badges and access control systems use proximity cards, smart cards, or biometric readers to restrict facility access. Badge readers log entry and exit times, creating an audit trail. Tailgating (following an authorized person through a secured door) is countered by security awareness training, mantrap/airlock systems, and anti-passback features that require both entry and exit badge scans.
  • Mantraps (airlocks) are small rooms with two interlocking doors where the second door does not open until the first is closed and locked. This ensures only one authenticated person enters at a time, effectively preventing tailgating and piggybacking. Modern access vestibules may include weight sensors and camera verification.
  • Video surveillance and locks provide detection and deterrence. CCTV cameras (IP-based or analog) monitor entrances, server rooms, and parking areas with motion detection and night vision capabilities. Locks range from traditional key locks (easily defeated by lock picking) to electronic cipher locks (PIN-based), biometric locks (fingerprint, retinal scan), and cable locks for laptops (Kensington lock slots).
Exam Tip: Physical security questions often involve identifying the correct control for a given scenario. Know that mantraps prevent tailgating, bollards prevent vehicle attacks, and cable locks secure laptops. The exam distinguishes between deterrent controls (cameras, signs) and preventive controls (locks, bollards, mantraps).
7.2 Logical Security

Key Concepts

  • Firewalls filter traffic based on source/destination IP, port numbers, and protocols. Host-based firewalls (Windows Defender Firewall, iptables) protect individual machines, while network-based firewalls protect entire network segments. Stateful firewalls track connection states and only allow return traffic for established sessions, providing stronger security than stateless packet filters.
  • IDS/IPS (Intrusion Detection/Prevention Systems) monitor network traffic for malicious patterns. IDS is passive and generates alerts without blocking traffic, while IPS is inline and actively blocks detected threats. Both use signature-based detection (matching known patterns) and anomaly-based detection (flagging deviations from normal baselines). UTM (Unified Threat Management) appliances combine firewall, IDS/IPS, antivirus, and content filtering in one device.
  • Access Control Lists (ACLs) define rules that permit or deny traffic based on criteria like source/destination IP, protocol, and port number. ACLs are applied to router interfaces and firewall rules, processed top-down (first match wins), and should always end with an implicit deny rule to block any traffic not explicitly permitted.
  • Principle of least privilege dictates that users, applications, and services should be granted only the minimum permissions required to perform their functions. This limits the blast radius of compromised accounts, reduces accidental data exposure, and is enforced through proper group membership, file permissions (NTFS ACLs), and application-level role-based access.
Exam Tip: Know the difference between IDS (detects and alerts) and IPS (detects and blocks). The exam tests firewall concepts including stateful vs stateless inspection. Remember that ACLs are processed top-down and that the principle of least privilege should guide all access control decisions.
⚠️
Module 8 — Core 2
Malware & Social Engineering
2 lessons
8.1 Malware Types & Removal

Key Concepts

  • Viruses require user action to execute and attach themselves to legitimate files or programs, replicating when the host file is run. Worms are self-replicating and spread across networks without user interaction by exploiting vulnerabilities in services. Trojans disguise themselves as legitimate software but perform malicious actions like creating backdoors once executed.
  • Ransomware encrypts the victim's files and demands payment (typically cryptocurrency) for the decryption key. Modern ransomware uses double extortion — encrypting data AND threatening to publish stolen data. Rootkits hide deep in the OS (kernel-level or firmware-level), making them extremely difficult to detect and requiring specialized removal tools or complete OS reinstallation.
  • Spyware and keyloggers covertly monitor user activity. Spyware tracks browsing habits and collects personal data for advertising or theft. Keyloggers record every keystroke to capture passwords, credit card numbers, and messages. Cryptominers hijack system resources (CPU/GPU) to mine cryptocurrency, causing degraded performance, high CPU usage, and increased electricity consumption.
  • Malware removal process follows a specific order: (1) Identify and research malware symptoms, (2) Quarantine the infected system by disconnecting from the network, (3) Disable System Restore to prevent reinfection from restore points, (4) Remediate using updated anti-malware tools in Safe Mode, (5) Schedule full scans and delete infected files, (6) Re-enable System Restore and create a new restore point, (7) Educate the user on safe practices.
Exam Tip: The malware removal steps are tested in order. Remember to quarantine FIRST (disconnect from network), then remediate in Safe Mode. Know the differences between each malware type — the exam gives symptoms and expects you to identify the malware. Rootkits may require boot-level scanning or OS reinstallation to remove.
8.2 Social Engineering Attacks

Key Concepts

  • Phishing uses fraudulent emails that impersonate trusted organizations to trick users into clicking malicious links or providing credentials. Spear phishing targets specific individuals using personal information for credibility. Whaling targets executives and high-value individuals. All phishing attacks exploit urgency, authority, and trust to bypass rational decision-making.
  • Vishing and smishing extend phishing beyond email. Vishing (voice phishing) uses phone calls with spoofed caller IDs, often impersonating banks, tech support, or government agencies. Smishing (SMS phishing) sends text messages with malicious links, often claiming package delivery issues, account suspensions, or prize winnings to trick recipients into responding.
  • Tailgating and shoulder surfing are physical social engineering attacks. Tailgating (piggybacking) means following an authorized person through a secured door without badging in. Shoulder surfing involves observing someone entering passwords, PINs, or sensitive data by looking over their shoulder, using binoculars, or positioning cameras. Privacy screens on monitors and awareness training are key defenses.
  • Dumpster diving involves searching through an organization's trash for sensitive documents, hardware with data, or information useful for social engineering (org charts, phone lists, account numbers). Countermeasures include shredding (cross-cut preferred over strip-cut), secure disposal bins, and clear-desk policies. Proper e-waste disposal includes wiping or physically destroying storage media.
Exam Tip: Be able to identify the type of social engineering based on the scenario description. Key indicators: email = phishing, phone call = vishing, text message = smishing, following someone through a door = tailgating, watching someone type = shoulder surfing, searching trash = dumpster diving.
🛡️
Module 9 — Core 2
Windows Security
2 lessons
9.1 User Account Management

Key Concepts

  • User Account Control (UAC) is a Windows security feature that prevents unauthorized changes to the system by prompting for administrator approval when an action requires elevated privileges. UAC levels range from "Always Notify" (most secure) to "Never Notify" (least secure). UAC protects against malware that attempts to silently install or modify system settings.
  • Local vs domain accounts serve different purposes. Local accounts are stored in the SAM (Security Account Manager) database on the individual machine and provide access only to that computer. Domain accounts are stored in Active Directory, authenticated by the domain controller, and provide single sign-on access to network resources across the entire domain.
  • Password policies enforce security requirements for credentials. Key settings include minimum length (12+ characters recommended), complexity requirements (uppercase, lowercase, numbers, symbols), maximum age (requiring periodic changes), password history (preventing reuse of recent passwords), and account lockout threshold (locking after N failed attempts to prevent brute-force attacks).
  • Account types and groups control privilege levels. The built-in Administrator account has full system access and should be renamed and disabled when not in use. Standard user accounts operate with limited privileges. Groups (Administrators, Users, Power Users, Remote Desktop Users) simplify permission management by assigning rights to groups rather than individual users.
Exam Tip: UAC prompts are different for admin vs standard users — admins see a consent prompt, standard users see a credential prompt. Know that domain accounts use Active Directory (centralized) while local accounts use the SAM database (per machine). The exam tests password policy settings configurable through Group Policy or Local Security Policy (secpol.msc).
9.2 Windows Security Tools

Key Concepts

  • BitLocker provides full-disk encryption for Windows Pro and Enterprise editions. It uses AES encryption (128-bit or 256-bit) and requires a TPM (Trusted Platform Module) chip to store the encryption key securely, or can use a USB startup key as an alternative. BitLocker To Go encrypts removable USB drives. Recovery keys must be saved to Active Directory, Microsoft Account, or printed for emergency access.
  • EFS (Encrypting File System) provides file-level encryption on NTFS volumes, protecting individual files and folders rather than entire drives. EFS is tied to the user's Windows account — only the user who encrypted the files (and designated recovery agents) can decrypt them. EFS and BitLocker can be used together for layered protection.
  • Windows Defender is the built-in antivirus and antimalware solution that provides real-time protection, cloud-delivered protection, and automatic sample submission. Windows Defender Firewall controls inbound and outbound network traffic with rules configurable per network profile (Domain, Private, Public). Windows Security Center provides a unified dashboard for virus protection, firewall, device security, and family options.
  • Windows Update and security patches are critical for closing vulnerabilities. Windows Update delivers security patches, feature updates, and driver updates. Group Policy controls update behavior in enterprise environments. WSUS (Windows Server Update Services) provides centralized patch management, allowing IT to approve, test, and deploy updates across the organization before rollout.
Exam Tip: BitLocker requires TPM + Windows Pro/Enterprise — it is NOT available on Home edition. Know that EFS is file-level (NTFS only) while BitLocker is volume-level. The exam tests Windows Defender Firewall profiles: Domain (joined to domain), Private (trusted home/work), Public (coffee shop, airport — most restrictive).
📡
Module 10 — Core 2
Mobile & Embedded Device Security
2 lessons
10.1 Mobile Device Management

Key Concepts

  • MDM (Mobile Device Management) allows organizations to centrally manage, configure, and secure mobile devices. MDM solutions (Microsoft Intune, VMware Workspace ONE, Jamf) enforce security policies including password requirements, encryption, app restrictions, and network configurations. Devices can be enrolled manually or automatically through zero-touch enrollment programs.
  • MAM (Mobile Application Management) focuses on securing and managing specific applications rather than the entire device. MAM is particularly useful for BYOD (Bring Your Own Device) scenarios where the organization needs to protect corporate data within apps without controlling the employee's personal device. App wrapping and containerization isolate corporate data from personal data.
  • BYOD vs COPE deployment models define device ownership. BYOD allows employees to use personal devices for work, reducing hardware costs but increasing security challenges. COPE (Corporate-Owned, Personally Enabled) provides company-owned devices that employees can also use for personal tasks, giving IT more control. CYOD (Choose Your Own Device) lets employees select from approved company-purchased devices.
  • Remote wipe and screen locks are critical security features. Remote wipe erases all data on a lost or stolen device to prevent unauthorized access. Screen lock methods include PIN (4–6 digits), pattern, password, fingerprint, facial recognition, and iris scanning. Failed login attempt policies can trigger device lockout or automatic wipe after a configurable number of failures.
Exam Tip: Know the difference between MDM (manages the whole device) and MAM (manages apps only). BYOD scenarios almost always require MAM or containerization to separate personal and corporate data. The exam tests remote wipe as the appropriate response to a lost/stolen device containing sensitive corporate data.
10.2 IoT & Embedded Systems

Key Concepts

  • IoT (Internet of Things) devices include smart home devices (thermostats, cameras, doorbells, speakers), wearable technology (smartwatches, fitness trackers), and industrial sensors. IoT devices often have limited computing resources, making traditional security software impractical. They frequently use default credentials, lack update mechanisms, and communicate over insecure protocols, making them attractive targets.
  • SCADA (Supervisory Control and Data Acquisition) systems monitor and control industrial processes in power plants, water treatment facilities, manufacturing, and oil/gas pipelines. SCADA systems were originally designed for isolated networks (air-gapped) but increasing connectivity exposes them to cyber threats. Securing SCADA requires network segmentation, strict access controls, and specialized industrial firewalls.
  • SoC (System on a Chip) integrates CPU, GPU, memory controller, and I/O interfaces on a single chip, used in smartphones, tablets, and embedded systems (Qualcomm Snapdragon, Apple M-series, Raspberry Pi). RTOS (Real-Time Operating System) provides deterministic response times for time-critical applications like automotive systems, medical devices, and industrial controllers.
  • Smart device security best practices include changing default usernames and passwords immediately, segmenting IoT devices on a separate VLAN or network, regularly updating firmware, disabling unnecessary services and ports, and monitoring network traffic for anomalous behavior from IoT devices. Network-level controls compensate for the limited built-in security of most IoT devices.
Exam Tip: IoT security is increasingly tested. The first step to securing any IoT device is changing default credentials. Network segmentation (placing IoT on a separate VLAN) is the most commonly recommended mitigation. Know that SCADA systems control critical infrastructure and that RTOS is used where precise timing is essential.
📐
Module 11 — Core 2
Networking Security & Troubleshooting
2 lessons
11.1 Wireless Security

Key Concepts

  • WPA2 (Wi-Fi Protected Access 2) is the current minimum standard for wireless security. WPA2-Personal uses a pre-shared key (PSK) for authentication, suitable for home and small office networks. WPA2-Enterprise uses 802.1X authentication with a RADIUS server, providing individual user credentials and certificate-based authentication for stronger security in corporate environments.
  • WPA3 improves on WPA2 with Simultaneous Authentication of Equals (SAE), replacing the PSK four-way handshake to protect against offline dictionary attacks. WPA3-Personal provides stronger protection even with simple passwords, while WPA3-Enterprise offers 192-bit cryptographic strength. WPA3 also introduces Enhanced Open (OWE) for encrypted public Wi-Fi without passwords.
  • Encryption protocols have evolved from WEP (broken, never use) to TKIP (WPA, legacy) to AES-CCMP (WPA2, current standard) to AES-GCMP (WPA3). AES (Advanced Encryption Standard) provides strong 128-bit or 256-bit encryption. TKIP was a temporary fix for WEP's weaknesses but is now deprecated. All modern deployments should use AES encryption exclusively.
  • RADIUS (Remote Authentication Dial-In User Service) is the authentication server used in WPA2/WPA3 Enterprise deployments. RADIUS centralizes authentication, authorization, and accounting (AAA) for wireless and wired network access. Users authenticate with individual credentials (username/password, certificates) rather than a shared key, enabling per-user access policies, logging, and revocation.
Exam Tip: Know the wireless security hierarchy: WEP (broken) < WPA/TKIP (legacy) < WPA2/AES (current standard) < WPA3/SAE (latest). Personal mode uses a PSK (pre-shared key), Enterprise mode uses RADIUS. The exam expects you to recommend WPA2-Enterprise with AES minimum for corporate networks.
11.2 Network Troubleshooting Tools

Key Concepts

  • ping sends ICMP echo request packets to test basic connectivity between two hosts. A successful ping confirms that the network path is functional, DNS resolution works (if using a hostname), and the target host is reachable. Common results include "Request timed out" (host unreachable or firewall blocking), "Destination host unreachable" (routing issue), and TTL expired (too many hops).
  • tracert (Windows) / traceroute (Linux/macOS) displays the path packets take to reach a destination, showing each router hop along the way with round-trip times. This identifies where packets are being delayed or dropped. High latency at a specific hop indicates congestion at that router. Asterisks (*) indicate a hop that did not respond, often due to ICMP being blocked by a firewall.
  • nslookup queries DNS servers to resolve domain names to IP addresses and vice versa. It can specify a particular DNS server to query (nslookup domain.com 8.8.8.8), check different record types (set type=MX), and identify DNS configuration problems. If nslookup fails but ping to an IP works, the issue is DNS resolution rather than network connectivity.
  • netstat and pathping provide detailed network analysis. netstat -an shows all active connections and listening ports with numeric addresses (useful for identifying rogue connections or verifying services are running). pathping combines the functionality of ping and tracert, sending packets to each hop over a period of time and computing statistics on packet loss and latency at each router along the path.
Exam Tip: Troubleshooting tool selection is frequently tested. Use ping for basic connectivity, tracert to find where the path breaks, nslookup to diagnose DNS issues, and netstat to check open ports and connections. If you can ping an IP but not a hostname, the problem is DNS. If you cannot ping anything, check physical connectivity first.
📋
Module 12 — Core 2
Operational Procedures
2 lessons
12.1 Documentation & Change Management

Key Concepts

  • Network diagrams and documentation provide visual representations of the network topology, including physical layouts (cable runs, rack locations, device placement) and logical layouts (IP addressing schemes, VLANs, subnets). Accurate, up-to-date documentation is essential for troubleshooting, onboarding new staff, disaster recovery, and compliance audits. Tools like Visio, Lucidchart, and draw.io are commonly used.
  • Baselines establish normal operating parameters for systems, networks, and applications (CPU usage, memory consumption, network throughput, response times). Comparing current performance against documented baselines helps identify anomalies that may indicate problems or security incidents. Baselines should be updated periodically as infrastructure changes.
  • Knowledge bases are centralized repositories of technical solutions, troubleshooting guides, and documented procedures. They reduce resolution times by allowing technicians to reference solutions to previously encountered problems. Effective knowledge bases include searchable articles with problem descriptions, root causes, resolution steps, and related resources.
  • Change management process ensures that modifications to IT systems are planned, approved, tested, and documented to minimize disruption. The process includes: (1) submit a change request, (2) assess risk and impact, (3) obtain approval from the Change Advisory Board (CAB), (4) plan the implementation with a rollback plan, (5) implement during a maintenance window, (6) verify and document results. Emergency changes follow an expedited process.
Exam Tip: Change management is heavily tested. Know the complete process from request through documentation. The exam will ask what should happen BEFORE making a change (get approval, create a rollback plan) and AFTER (verify functionality, document). A maintenance window minimizes impact on users.
12.2 Disaster Recovery & Backup

Key Concepts

  • Backup types serve different purposes. A full backup copies all selected data (longest time, easiest restore). An incremental backup copies only data changed since the last backup of any type (fastest backup, slowest restore — requires all incrementals plus the last full). A differential backup copies all data changed since the last full backup (moderate speed, requires only the last full plus the latest differential).
  • The 3-2-1 backup rule is the industry standard: maintain 3 copies of your data, on 2 different types of media (e.g., local disk + cloud, or NAS + tape), with 1 copy stored offsite (cloud storage, remote facility). This strategy protects against hardware failure, ransomware, natural disasters, and theft. Test backup restorations regularly to verify data integrity and recovery procedures.
  • RTO and RPO define recovery objectives. Recovery Time Objective (RTO) is the maximum acceptable time to restore operations after a disaster — a 4-hour RTO means systems must be back online within 4 hours. Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time — a 1-hour RPO means backups must occur at least every hour. Lower RTO/RPO values require more expensive infrastructure.
  • Disaster recovery sites vary in readiness and cost. A hot site is a fully operational duplicate of the production environment, ready to take over immediately (most expensive, lowest RTO). A warm site has hardware and connectivity but requires data restoration and configuration (moderate cost and RTO). A cold site is an empty facility with power and network connections that must be fully built out (cheapest, highest RTO).
Exam Tip: Backup types are always tested. Remember: Full (everything), Incremental (since last any backup), Differential (since last full backup). Restoring from incrementals requires the full backup plus every incremental in sequence. The 3-2-1 rule and the definitions of RTO/RPO are frequently tested concepts.
🖨
Module 13 — Core 2
Scripting & Remote Access
2 lessons
13.1 Basic Scripting

Key Concepts

  • PowerShell scripts (.ps1) are the primary automation tool for Windows administration. PowerShell uses Verb-Noun cmdlets and supports variables, loops, conditionals, functions, and piping. Execution policies (Restricted, AllSigned, RemoteSigned, Unrestricted) control which scripts can run. Common automation tasks include user account creation, system inventory collection, log analysis, and configuration management.
  • Bash shell scripts (.sh) automate tasks on Linux and macOS. Scripts begin with a shebang line (#!/bin/bash), use chmod +x to make them executable, and support variables, loops (for, while), conditionals (if/then/else), and functions. Common uses include automated backups, log rotation, system monitoring, and batch file processing. Bash is the default shell on most Linux distributions.
  • Python scripts (.py) are cross-platform and widely used for IT automation, network management, and data processing. Python's readable syntax and extensive standard library make it ideal for tasks like API interactions, file manipulation, web scraping, and system administration. Batch files (.bat) are legacy Windows scripts using cmd.exe commands for simple task automation.
  • JavaScript (.js) and VBScript (.vbs) serve different scripting needs. JavaScript runs in web browsers and Node.js for server-side automation. VBScript is a legacy Windows scripting language that runs via Windows Script Host (wscript/cscript), used in older login scripts and administrative tasks. Understanding script file extensions helps identify potential malicious scripts — unexpected .ps1, .vbs, .bat, or .js files may indicate an attack.
Exam Tip: You do not need to write scripts for the exam, but you must identify script types by their file extensions: .ps1 (PowerShell), .sh (Bash), .py (Python), .bat (Batch), .js (JavaScript), .vbs (VBScript). Know that PowerShell execution policies control script execution and that malicious scripts are a common attack vector.
13.2 Remote Access Technologies

Key Concepts

  • RDP (Remote Desktop Protocol) uses port 3389 and provides full graphical remote access to Windows systems. RDP supports encryption, Network Level Authentication (NLA), and multi-monitor configurations. It should be protected with strong passwords, MFA, and VPN tunneling — exposing RDP directly to the internet is a major security risk due to brute-force and exploit attacks.
  • VNC (Virtual Network Computing) uses port 5900 and provides platform-independent remote desktop access. Unlike RDP, VNC shares the existing desktop session (not a separate session), so both local and remote users see the same screen. VNC is useful for cross-platform support but typically lacks the encryption and performance optimization of RDP, requiring SSH tunneling for secure access.
  • SSH (Secure Shell) uses port 22 and provides encrypted command-line remote access to Linux, macOS, and network devices. SSH replaces the insecure Telnet protocol (port 23, unencrypted). SSH supports key-based authentication (more secure than passwords), port forwarding/tunneling (encrypting other protocols through SSH), and secure file transfer via SCP and SFTP.
  • VPN and screen-sharing solutions provide additional remote access methods. VPNs create encrypted tunnels to access entire networks remotely (IPSec for site-to-site, SSL/TLS for client-to-site). MSRA (Microsoft Remote Assistance) allows a technician to view or control a user's screen with the user's permission. Third-party tools like TeamViewer, AnyDesk, and Zoom screen sharing enable ad-hoc remote support sessions.
Exam Tip: Memorize the port numbers: RDP = 3389, VNC = 5900, SSH = 22, Telnet = 23. Know that SSH is encrypted while Telnet is not. RDP creates a new session while VNC shares the existing session. The exam tests when to use each remote access method based on the scenario (OS, security needs, user involvement).
🌱
Module 14 — Core 2
Environmental & Professionalism
2 lessons
14.1 Safety Procedures

Key Concepts

  • ESD (Electrostatic Discharge) prevention is critical when handling computer components. ESD can damage sensitive electronics (RAM, CPUs, motherboards) with as little as 30 volts, well below the human perception threshold of ~3,000 volts. Prevention methods include wearing an anti-static wrist strap connected to a grounded surface, using anti-static mats, touching the metal chassis before handling components, and storing parts in anti-static bags.
  • Proper component handling requires holding circuit boards by the edges to avoid touching connectors or traces. CPUs must be aligned with the socket indicator (arrow or notch) and never forced. RAM modules click into place when properly seated. Hard drives should be handled gently to avoid shock damage to platters. Always power off and unplug equipment before servicing internal components.
  • Electrical safety involves understanding the dangers of high-voltage components. CRT monitors and power supplies contain capacitors that retain dangerous charges even when unplugged — never open a power supply. Use surge protectors and UPS (Uninterruptible Power Supply) units to protect equipment. Follow proper grounding practices and never bypass the ground prong on a power cord.
  • MSDS/SDS and proper disposal documents (Material Safety Data Sheets / Safety Data Sheets) contain information about chemical hazards, handling procedures, and emergency response for materials like printer toner, cleaning solvents, and battery electrolytes. E-waste disposal must follow local regulations — batteries, CRT monitors, toner cartridges, and circuit boards contain hazardous materials and should be recycled through certified e-waste facilities, never placed in regular trash.
Exam Tip: ESD prevention appears on every A+ exam. Always use an anti-static wrist strap when handling components. Know that power supplies and CRT monitors are dangerous even when unplugged due to stored charge. MSDS/SDS sheets tell you how to handle hazardous materials safely. Batteries must be recycled, not thrown in the trash.
14.2 Communication & Professionalism

Key Concepts

  • Professional appearance and behavior set the tone for customer interactions. IT technicians should maintain a neat, appropriate appearance, arrive on time, and be prepared with the necessary tools and documentation. Avoid using personal devices during service calls, refrain from eating or drinking near customer equipment, and always treat the customer's workspace and data with respect.
  • Active listening is the foundation of effective technical support. Let the user fully describe the problem without interrupting, ask clarifying questions, and repeat back the issue in your own words to confirm understanding. Avoid using jargon — explain technical concepts in plain language that the end user can understand. Never dismiss the user's concerns or make them feel unintelligent.
  • Setting and managing expectations builds trust with users and management. Provide realistic timelines for repairs and communicate proactively if delays occur. If you need to escalate an issue, explain why and provide an estimated timeline for resolution. Document all actions taken, keep the customer informed of progress, and follow up after resolution to confirm the issue is fully resolved.
  • Cultural sensitivity and confidentiality are essential in diverse workplaces. Be respectful of different communication styles, personal space preferences, and cultural norms. Maintain strict confidentiality — never access, read, or share a user's personal files, emails, or browsing history beyond what is necessary to resolve the reported issue. Handle sensitive data according to organizational privacy policies and applicable regulations.
Exam Tip: Professionalism questions test soft skills. The correct answer almost always involves active listening, clear communication, setting expectations, and respecting confidentiality. Never argue with users, never access data beyond what is needed, and always document your work. These questions are straightforward — choose the most professional, respectful option.
Start practicing →